5 ms·
Yes, I did. Particularly this part: > If you visit a site on Have I Been Pwned's naughty list, it will throw a flag stating, "You visited hacked site ashleymad
by wyc 9y ago
Yes, I did. Particularly this part:
> If you visit a site on Have I Been Pwned's naughty list, it will throw a flag stating, "You visited hacked site ashleymadison.com."
This does more than just tell users if their credentials have been compromised. That copy is likely to affect traffic in a manner similar to invalid HTTPS certs.
Wouldn't you agree that some degree of subjectivity lies within the specific partnership with Have I Been Pwned and its submissions? Popular does not mean just.
A lot of this is contingent on how the user interface and data are presented in the program. That "there is nothing subjective about this" may be true for only a facet of the whole issue. No doubt, there are potential benefits for everyone here, but some of the worst outcomes have resulted from the best intentions.
- spdustin 9y agoCan you clarify how HIBP could be perceived as either unjust or subjective?
- ajcodez 9y agoTo the extent data breaches are only committed by external bad guys it’s fine. If hacking a competitor causes a user visible flag, there is now incentive.
- ygjb 9y agoHow is a breach from a competitor, who is doing it for financial motives, different from an "external bad guy" who is doing it for financial motives?
- ajcodez 9y agoIt's a little different because the competitor does not want the digital assets being hacked, but rather just wants the hack to be on record.
- reitanqild 9y agoHopefully this will also be an incentive for website owners to let developers spend time on security to avoid getting hacked.
- Dylan16807 9y agoThat could happen from any measure that makes people care about breaches. But I want people to care about breaches. I think it's worth the risk.
- wyc 9y agoHere are a few reasons that I hope you find somewhat convincing: - Single point of failure. It's ran by one person who can be bribed or manipulated. I've never met Troy Hunt, and from what I can tell he looks like a great upstanding guy[1], but $5 wrenches will work on my kneecaps too. - What's the process for reporting and publishing? Appeals? There's no transparency here, aside from a list of 5 one-sentence steps in the FAQ[2]. How do we decide what data are "sensitive"? My guess is that there's not too much review. - As hinted above, with a publicly available shame list, there would exist new incentives to get competitors and enemies on the list. How does this play with a loosely documented review + publish process? With a user interface that might oversimplify the issue? Please don't misunderstand these points as hostility. I really really like Have I Been Pwned and think it's amazing what Troy is doing. It's just that if we're building new web infrastructure, it's important that we get it right. I think where we can agree is that web users deserve more control over their data by default and shouldn't have to learn how to install and use several fringe programs to do so. [1] https://haveibeenpwned.com/About https://haveibeenpwned.com/About [2] https://haveibeenpwned.com/FAQs https://haveibeenpwned.com/FAQs
- nojvek 9y agoTroy Hunt works for Microsoft. What is to say the employer won’t influence the list for personal gain. E.g if Azure and Aws both got hacked, high chances of AWS appearing in the list but not Azure.
- locusm 9y agoI think he is an MVP which is no relation to being a member of staff. He advocates for their products from what I can see, probably because he was a .net dev.