3 ms·

> Breach Alerts: Breach alerts will inform a user if a site they've visited has been breached and will ask if the user wants to have their account checked to de

by maeln 9y ago

> Breach Alerts: Breach alerts will inform a user if a site they've visited has been breached and will ask if the user wants to have their account checked to determine if it was compromised. If it was compromised, some helpful information will be presented to the user. (October) This is very interesting. If Chrome decide to follow the same path it could give a serious incentive to some website to be more careful about there security. The whole "display a warning when login are passed via HTTP" already managed to create some reaction. It probably won't be a revolution but it might be a good first step.

yjftsjthsd-h 9y ago
And of course we should be ready for the slew of sites complaining about how terrible and irresponsible it is to tell users that they've been compromised:)
- ksk 9y ago
  The last thing a business wants is a browser scaring customers away without cause. But I think they would be OK as long as the list is maintained and is accurate. Certainly, we should do more to penalize hackers, and not blame the victims of cyber attacks (as is sometimes the case).
  - yjftsjthsd-h 9y ago
    > we should do more to penalize hackers Malicious hacking is already illegal with significant penalties. > not blame the victims If the victims failed even basic security measures, I'm quite happy to give them their share of blame. There have been plenty of reports of exposed databases with no password protection, places that stored passwords in plain text, folks running unpatched OSs... You can't just ignore security and pretend that you're not at fault.
    - ksk 9y ago
      >Malicious hacking is already illegal with significant penalties. Yes, more people should end up in jail. >If the victims failed even basic security measures, I'm quite happy to give them their share of blame. Please detail how you have established that the victims themselves personally ignored security practices. >There have been plenty of reports of exposed databases with no password protection, places that stored passwords in plain text, folks running unpatched OSs... You can't just ignore security and pretend that you're not at fault. You are making broad claims. Remember that the non-technical business owners/managers/CEOs etc need our help, and they don't need people shaming them for using vendors or consultants who might have made made mistakes.
garrettdc 9y ago
I think I remember some password managers that have similar features alerting if a site that you have an account with was breached. There has to be some sort of external accountability or pressure to make these organizations move the needle on their security practices.

by maeln 9y ago

yjftsjthsd-h 9y ago

And of course we should be ready for the slew of sites complaining about how terrible and irresponsible it is to tell users that they've been compromised:)

ksk 9y ago
The last thing a business wants is a browser scaring customers away without cause. But I think they would be OK as long as the list is maintained and is accurate. Certainly, we should do more to penalize hackers, and not blame the victims of cyber attacks (as is sometimes the case).
- yjftsjthsd-h 9y ago
  > we should do more to penalize hackers Malicious hacking is already illegal with significant penalties. > not blame the victims If the victims failed even basic security measures, I'm quite happy to give them their share of blame. There have been plenty of reports of exposed databases with no password protection, places that stored passwords in plain text, folks running unpatched OSs... You can't just ignore security and pretend that you're not at fault.
  - ksk 9y ago
    >Malicious hacking is already illegal with significant penalties. Yes, more people should end up in jail. >If the victims failed even basic security measures, I'm quite happy to give them their share of blame. Please detail how you have established that the victims themselves personally ignored security practices. >There have been plenty of reports of exposed databases with no password protection, places that stored passwords in plain text, folks running unpatched OSs... You can't just ignore security and pretend that you're not at fault. You are making broad claims. Remember that the non-technical business owners/managers/CEOs etc need our help, and they don't need people shaming them for using vendors or consultants who might have made made mistakes.

garrettdc 9y ago

I think I remember some password managers that have similar features alerting if a site that you have an account with was breached. There has to be some sort of external accountability or pressure to make these organizations move the needle on their security practices.