4 ms·

OK. What do you find to be acceptable grounds for treating a situation as if there were no abuse? Bear in mind that proving no abuse is impossible, as it's alw

by Kalium 8y ago

OK. What do you find to be acceptable grounds for treating a situation as if there were no abuse? Bear in mind that proving no abuse is impossible, as it's always possible that the hypothetical abuser got one step further than your investigation and covered their tracks.

dleslie 8y ago
Never not inform. When such a vulnerability is discovered the right thing to do is to inform the users of its possible severity and the duration during which it was available. Always.
- reificator 8y ago
  So then all security audits just become you paying someone large amounts of money to get really bad press for yourself. Regardless of whether you've actually lost customer information or not. At which point why not just stop being proactive? Hardline stances sell great on forums, that doesn't make them right.
  - mannykannot 8y ago
    > At which point why not just stop being proactive? The attitude that absence of evidence should be treated as if it didn't happen leads to exactly that conclusion - that it's better to not be able to tell what's happening.
- buzer 8y ago
  If that ever becomes standard, every actually relevant notification would be lost in the noise. Multiple local privilege escalation vulnerabilities are discovered yearly in both Linux and Windows (along with many other OSes and userland applications). Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day they were created until date X each time that happens? After all, there is no way to prove no one abused that before their systems were patched (including the period between system creation and vulnerability being publicly released).
  - CaptSpify 8y ago
    > Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day... I'd love for that to happen. Maybe then everyone will start to pick up on the fact that all of our computer systems are insanely insecure.
    - davidcbc 8y ago
      It is much more likely in my opinion that people would become desensitized to data breaches and stop taking any of them seriously. Equifax or Cambridge Analytica would have been just another in a deluge of notifications.
- UncleMeat 8y ago
  Does your place of business inform for every closed xss bug? Sqli? Every buffer overrun? Directory traversal? The bar for "bug that could potentially lead to access to user data" is so low that I'd say that any business that isn't finding hundreds of these bugs a year isn't doing a serious job on security.
  - dleslie 8y ago
    We try to, yes.
- Kalium 8y ago
  Are you familiar with California's Proposition 65? It was based on the same concept - never not inform. Some might opine that the consequences might have failed to meet hopes.
  - dleslie 8y ago
    Nope, am Canadian. Canada is going to require disclosure of breaches starting November 1. That may allow for companies to still fail to disclose the _possibility_ of breaches, however. https://globalnews.ca/news/4122202/data-breach-canada-privacy-commissioner/ https://globalnews.ca/news/4122202/data-breach-canada-privac...
    - Kalium 8y ago
      https://en.wikipedia.org/wiki/California_Proposition_65_(1986) https://en.wikipedia.org/wiki/California_Proposition_65_(198... Long story short, California requires labeling of things that may contain chemicals hazardous for a variety of reasons. The idea was simple - never not inform. The intentions were pure. The result is that basically everything has a vague and uninformative label about how it may contain chemicals that could be hazardous. The labels are spectacularly uninformative and incredibly numerous. They are universally ignored by everyone, as they constitute a sea of noise. The net result is that a wonderful, laudable, pure, kind, and compassionate idea - never not inform - has led to a deluge of useless informational notices in which actual useful notices are impossible to find. It might be worth considering that there could be a lesson in there.
      - dleslie 8y ago
        Labeling is slightly different than simply informing, in that it is a specific method of informing. It would be like requiring Google to display information regarding this security issue on all of its pages. Warning labels have dubious efficacy, as evidenced by decades of grotesque warnings upon cigarette packaging and their limited success at reducing consumption; but that's not to say we ought not be able to know about the potential harms of a product or service, just that product labels sort of suck as a method of informing users. OTOH, Canada requires nutritional information on all food, and that's reasonably useful and successful _because_ the content of that label is strictly defined and reasonably useful.
- spdionis 8y ago
  You are hereby informed that all technology systems may have vulnerabilities that may be exploited. Duh.
mjw1007 8y ago
There's a scale from "there's no evidence of abuse and if there had been abuse we're certain we would have seen evidence" to "there's no evidence of abuse but there's no reason to suppose if there had been abuse we'd see any evidence". Companies tend not to be terribly good at articulating where we are on that sort of scale.
- Kalium 8y ago
  You're absolutely right! There very much is such a scale. Even the companies who are the very best at communications will tend to struggle to communicate clearly when filtered through a press that have strong incentives to construe everything as a data breach. Lay people reading either of your statements will tend to stop at "there's no evidence" and go "What do you mean, 'no evidence'!? I want certainty!". Witness how readily and widely this whole G+ event has been mis-reported as MASSIVE DATA BREACH. While you're completely correct, perhaps there's room for subtlety here.
s73v3r_ 8y ago
Exactly. There must always be an assumption that abuse happened.
tyingq 8y ago
Read Google's response carefully. They say they only had 2 weeks of api logs. They never say if the logs even had enough context to detect abuse. After reading it, I got the impression they have no idea what did, or did not happen.

by Kalium 8y ago

dleslie 8y ago

Never not inform. When such a vulnerability is discovered the right thing to do is to inform the users of its possible severity and the duration during which it was available. Always.

reificator 8y ago
So then all security audits just become you paying someone large amounts of money to get really bad press for yourself. Regardless of whether you've actually lost customer information or not. At which point why not just stop being proactive? Hardline stances sell great on forums, that doesn't make them right.
- mannykannot 8y ago
  > At which point why not just stop being proactive? The attitude that absence of evidence should be treated as if it didn't happen leads to exactly that conclusion - that it's better to not be able to tell what's happening.
buzer 8y ago
If that ever becomes standard, every actually relevant notification would be lost in the noise. Multiple local privilege escalation vulnerabilities are discovered yearly in both Linux and Windows (along with many other OSes and userland applications). Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day they were created until date X each time that happens? After all, there is no way to prove no one abused that before their systems were patched (including the period between system creation and vulnerability being publicly released).
- CaptSpify 8y ago
  > Do you really want that every single company releases notifications that roughly every single of their systems were vulnerable since the day... I'd love for that to happen. Maybe then everyone will start to pick up on the fact that all of our computer systems are insanely insecure.
  - davidcbc 8y ago
    It is much more likely in my opinion that people would become desensitized to data breaches and stop taking any of them seriously. Equifax or Cambridge Analytica would have been just another in a deluge of notifications.
UncleMeat 8y ago
Does your place of business inform for every closed xss bug? Sqli? Every buffer overrun? Directory traversal? The bar for "bug that could potentially lead to access to user data" is so low that I'd say that any business that isn't finding hundreds of these bugs a year isn't doing a serious job on security.
- dleslie 8y ago
  We try to, yes.
Kalium 8y ago
Are you familiar with California's Proposition 65? It was based on the same concept - never not inform. Some might opine that the consequences might have failed to meet hopes.
- dleslie 8y ago
  Nope, am Canadian. Canada is going to require disclosure of breaches starting November 1. That may allow for companies to still fail to disclose the _possibility_ of breaches, however. https://globalnews.ca/news/4122202/data-breach-canada-privacy-commissioner/ https://globalnews.ca/news/4122202/data-breach-canada-privac...
  - Kalium 8y ago
    https://en.wikipedia.org/wiki/California_Proposition_65_(1986) https://en.wikipedia.org/wiki/California_Proposition_65_(198... Long story short, California requires labeling of things that may contain chemicals hazardous for a variety of reasons. The idea was simple - never not inform. The intentions were pure. The result is that basically everything has a vague and uninformative label about how it may contain chemicals that could be hazardous. The labels are spectacularly uninformative and incredibly numerous. They are universally ignored by everyone, as they constitute a sea of noise. The net result is that a wonderful, laudable, pure, kind, and compassionate idea - never not inform - has led to a deluge of useless informational notices in which actual useful notices are impossible to find. It might be worth considering that there could be a lesson in there.
    - dleslie 8y ago
      Labeling is slightly different than simply informing, in that it is a specific method of informing. It would be like requiring Google to display information regarding this security issue on all of its pages. Warning labels have dubious efficacy, as evidenced by decades of grotesque warnings upon cigarette packaging and their limited success at reducing consumption; but that's not to say we ought not be able to know about the potential harms of a product or service, just that product labels sort of suck as a method of informing users. OTOH, Canada requires nutritional information on all food, and that's reasonably useful and successful _because_ the content of that label is strictly defined and reasonably useful.
spdionis 8y ago
You are hereby informed that all technology systems may have vulnerabilities that may be exploited. Duh.

mjw1007 8y ago

There's a scale from "there's no evidence of abuse and if there had been abuse we're certain we would have seen evidence" to "there's no evidence of abuse but there's no reason to suppose if there had been abuse we'd see any evidence". Companies tend not to be terribly good at articulating where we are on that sort of scale.

Kalium 8y ago
You're absolutely right! There very much is such a scale. Even the companies who are the very best at communications will tend to struggle to communicate clearly when filtered through a press that have strong incentives to construe everything as a data breach. Lay people reading either of your statements will tend to stop at "there's no evidence" and go "What do you mean, 'no evidence'!? I want certainty!". Witness how readily and widely this whole G+ event has been mis-reported as MASSIVE DATA BREACH. While you're completely correct, perhaps there's room for subtlety here.

s73v3r_ 8y ago

Exactly. There must always be an assumption that abuse happened.

tyingq 8y ago

Read Google's response carefully. They say they only had 2 weeks of api logs. They never say if the logs even had enough context to detect abuse. After reading it, I got the impression they have no idea what did, or did not happen.