4 ms·

The difference between a breach and a independent discovery is utilization by third parties. Through logging and other measures one can often determine whether

The difference between a breach and a independent discovery is utilization by third parties. Through logging and other measures one can often determine whether exploits have been utilized to engage unauthorized access. Google's defense in this case is not good. They are simply claiming ignorance. 'We don't have any idea if this exploit was utilized, as we were not logging access to the privileged information.' It really defies belief that Google, who's entire business is based on data, would not be logging access to confidential user information (even by the users' themselves). But it's an issue whether true or false. If true it means Google was and/or is likely engaging in poor security practice. If false, it's far worse as it means not only was user information likely accessed by parties that should not have had access to it, but it would also mean that Google then lied about this. An investigation is wholly justified here.

tptacek 8y ago
This is word salad. In fact, Google is engaging in excellent security practice. They re-audited an application, found a minor vulnerability, and fixed it. Most tech companies don't do any of this.
- matthewrobertso 8y ago
  Didn't the WSJ say that Google shut down G+ in response to this vulnerability? Would it be fair to say "They re-audited an application, found a minor vulnerability, and fixed it, decided the impact was so severe that G+ should not exist anymore"?
  - tptacek 8y ago
    No! That is not at all a fair read, even if you take the statement at face value, which nobody does. What they're saying is that they audited the application, found a vulnerability, and then re-evaluated the project in light of its importance to the company and commercial prospects, and decided that the work required to keep maintaining and securing it to the standard they had set for themselves --- again, a standard far higher than most tech companies --- wasn't justified by the returns they'd get on the investment. Better to stop doing it at all than to gradually slide into doing it half-assed.

tptacek 8y ago

This is word salad. In fact, Google is engaging in excellent security practice. They re-audited an application, found a minor vulnerability, and fixed it. Most tech companies don't do any of this.

matthewrobertso 8y ago
Didn't the WSJ say that Google shut down G+ in response to this vulnerability? Would it be fair to say "They re-audited an application, found a minor vulnerability, and fixed it, decided the impact was so severe that G+ should not exist anymore"?
- tptacek 8y ago
  No! That is not at all a fair read, even if you take the statement at face value, which nobody does. What they're saying is that they audited the application, found a vulnerability, and then re-evaluated the project in light of its importance to the company and commercial prospects, and decided that the work required to keep maintaining and securing it to the standard they had set for themselves --- again, a standard far higher than most tech companies --- wasn't justified by the returns they'd get on the investment. Better to stop doing it at all than to gradually slide into doing it half-assed.