3 ms·

If users fully understand what it means, ok. But I suspect this will create a "one strike and your out" dynamic for web developers. Nobody writes perfect bug-fr

If users fully understand what it means, ok. But I suspect this will create a "one strike and your out" dynamic for web developers. Nobody writes perfect bug-free software (though some of us try harder than others). A "has ever peen pwned" boolean is not much more useful than "has ever had a bug".

sverhagen 9y ago
Ashley Madison, Equifax, just two, before even pulling out the good old search engine. I believe at least a significant percentage of breaches are due to malpractice. If that's a distinction being made, I have no problem shaming the perpetrators out of their business.
- adventured 9y ago
  Might as well include Target, Yahoo, eBay and most major banks. Or more reasonably, nearly every major site or service that has ever existed. It would be better to just have a list of sites that have never had any kind of breach happen. That would be a nice small list for Firefox to track.
  - wallacoloo 9y ago
    > Or more reasonably, nearly every major site or service that has ever existed. So maybe this could help change practices to be safer. I think this mindset that "90% of companies don't prioritize security, so we should just accept this" is dangerous. As a consumer, data breaches can cause massive headaches - if you've ever dealt with identity theft, you know this. The security with which companies store their data should be factored into your decision of whether or not to be their customer, because it does affect the value their product provides you.
  - sverhagen 9y ago
    I suppose I was saying that not all breaches are created equally. The Target breach that I vaguely recall was initiated by some IoT devices on the far edge of the network (then escalated into critical system). That doesn't make it right, by any means, but somehow it seems a more complex problem to control than simply encrypting core data, specifically if said data are your crown jewels to begin with (credit card numbers -- Equifax' core business). I didn't study the details of the particular Target breach, so I may have things wrong, but I'm merely trying to illustrate that I could have more sympathy for some breaches over others.
  - hannob 9y ago
    > Or more reasonably, nearly every major site or service that has ever existed. The interesting thing is that this is absolutely not true. Just think Facebook or Google.
    - icebraining 9y ago
      It's rare, and they only got email subject lines, but it happens: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora
  - Fnoord 9y ago
    Plenty of websites won't be included in a whitelist. Perhaps it makes sense to include the date of the latest breach to the shown data breach data.
st3fan 9y ago
You can suspect all the doomsday scenarios you want. But please read the article and the README of the experimental plugin first.
richdougherty 9y ago
The current situation is "∞ strikes and you're out", which is pretty terrible. I think it's worth exploring ways to change that situation, even if the there's a chance it'll be used too strictly.
nsgi 9y ago
I think the warning should be removed if the site has had a recent clean pentest.
vim_wannabe 9y ago
Looks like that is indeed the idea: >it does give users an idea that, at some point or another, the site's security procedures were less than optimal. We'll see if the big sites like Tumbler end up getting a warning. ;^)
Kronopath 9y ago
In most other engineering disciplines, “one strike and you’re out” is the norm, because of the amount of damage that a single uncaught error can make. As software takes on more and more important duties in the world, it starts approaching this point as well.
- deleted 9y ago
  [deleted]

sverhagen 9y ago

Ashley Madison, Equifax, just two, before even pulling out the good old search engine. I believe at least a significant percentage of breaches are due to malpractice. If that's a distinction being made, I have no problem shaming the perpetrators out of their business.

adventured 9y ago
Might as well include Target, Yahoo, eBay and most major banks. Or more reasonably, nearly every major site or service that has ever existed. It would be better to just have a list of sites that have never had any kind of breach happen. That would be a nice small list for Firefox to track.
- wallacoloo 9y ago
  > Or more reasonably, nearly every major site or service that has ever existed. So maybe this could help change practices to be safer. I think this mindset that "90% of companies don't prioritize security, so we should just accept this" is dangerous. As a consumer, data breaches can cause massive headaches - if you've ever dealt with identity theft, you know this. The security with which companies store their data should be factored into your decision of whether or not to be their customer, because it does affect the value their product provides you.
- sverhagen 9y ago
  I suppose I was saying that not all breaches are created equally. The Target breach that I vaguely recall was initiated by some IoT devices on the far edge of the network (then escalated into critical system). That doesn't make it right, by any means, but somehow it seems a more complex problem to control than simply encrypting core data, specifically if said data are your crown jewels to begin with (credit card numbers -- Equifax' core business). I didn't study the details of the particular Target breach, so I may have things wrong, but I'm merely trying to illustrate that I could have more sympathy for some breaches over others.
- hannob 9y ago
  > Or more reasonably, nearly every major site or service that has ever existed. The interesting thing is that this is absolutely not true. Just think Facebook or Google.
  - icebraining 9y ago
    It's rare, and they only got email subject lines, but it happens: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora
- Fnoord 9y ago
  Plenty of websites won't be included in a whitelist. Perhaps it makes sense to include the date of the latest breach to the shown data breach data.

st3fan 9y ago

You can suspect all the doomsday scenarios you want. But please read the article and the README of the experimental plugin first.

richdougherty 9y ago

The current situation is "∞ strikes and you're out", which is pretty terrible. I think it's worth exploring ways to change that situation, even if the there's a chance it'll be used too strictly.

nsgi 9y ago

I think the warning should be removed if the site has had a recent clean pentest.

vim_wannabe 9y ago

Looks like that is indeed the idea: >it does give users an idea that, at some point or another, the site's security procedures were less than optimal. We'll see if the big sites like Tumbler end up getting a warning. ;^)

Kronopath 9y ago

In most other engineering disciplines, “one strike and you’re out” is the norm, because of the amount of damage that a single uncaught error can make. As software takes on more and more important duties in the world, it starts approaching this point as well.

deleted 9y ago
[deleted]