7 ms·
Knuddels: Chat platform must pay after hacker attack fine
- ronreiter 8y agoThis is actually a cool idea - paying idiot tax
- StavrosK 8y agoIn my experience, this is mostly what the GDPR is. There is no excuse for storing plaintext passwords in 2014+ and 20k is a fair fine for a mid-size company.
- pbhjpbhj 8y ago€20k doesn't seem much to me. Cheaper than taking on a security consultant. Not that you need a security consultant to know passwords shouldn't be stored (at all, nevermind plaintext). If they're doing that then they're likely being sloppy elsewhere, and by only paying €20k across the last n years they might have saved a €million. If your company is in the same boat probably worth not bothering to get any security issues addressed. Why address security, just pay the much smaller fine if you ever get caught ... I couldn't find Knuddels annual profit but they appear to have a dozen staff, which suggests to me the fine is too small.
- johannes1234321 8y agoThe fine is small since they completely complied with all inquiries and took proper steps to inform users and improve security. Thus do what the actual goals is. Making money is no a goal of GDPR, but ensuring data safety.
- pbhjpbhj 8y agoFines need to be extremely punitive to make the risk-reward analysis favour fixing security _before_ the company gets caught.
- johannes1234321 8y agoEven the threat of death penalty doesn't stop crimes. True, if there is no punishment and a threat is teethless nobody acts on it (that's why the big GDPR outcry also came only this year after the two year introductory phase) However if you have too high fines what happens s that companies try everything to hide the fault and lie to avoid the fines. Here a company complied to all things, improved security (which according to the data privacy agency let to six digit costs (while a question is how you measure this) - see other comments) and therefore got a low punishment. The punishment also has another effect: It makes it clear that fines are being collected. If it were higher the Knuddels company would go to court and we'd have an example case only in two or more years. The goal is to improve data safety. That goal was achieved.
- rocqua 8y agoThere is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock). The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't have other options' or people who 'know they are wrong, but don't give a f*ck about that'. Especially that first type of person won't respond to more punishment. The second kind of crime is much more calculated. Here, the response to harsher punishment would be a lot better. This is generally why the fines on overweight trucks are so high. It is actually required in order to make the calculation unacceptable for driving overweight.
- johannes1234321 8y agoI used the introductory example in response to the request of "extremely punitive" fines. Extreme fines lead to companies trying to be clever in hiding their faults. Moderate fines more likely lead to companies coming out by themselves. On the comparison with overweight trucks: I doubt anybody builds an insecure system to gain an economical benefit, not using state-of-the-art technology is a mistake/stupidity/carelessness/.... "See how much money we earned from saving CPU time of bcrypt!" nobody said.
- lorenzhs 8y agoWell, the fine is only 20k€ because they were very cooperative, quick to fix the worst issues, and promised to continue improving their security further. According to the Data Protection Officer's statement their total expenses were in the six figures. They also explicitly state that the fine wasn't higher as not to place a disproportionate burden on the company's finances, which probably means that they wouldn't have been able to afford a significantly higher fine. Contrary to the fear-mongering on this site, the purpose of GDPR isn't to fine companies out of existence.
- pbhjpbhj 8y agoYes, I saw that elsewhere when I'd finished writing. More cooperative still would be doing the changes before you're caught. If you could skip your tax bill for a few years, but get a much smaller fine if you cooperated when caught then you'd be silly to actually pay. In short, in terms of pour encourage les autres this fails badly IMO.
- AnthonyMouse 8y ago> If you could skip your tax bill for a few years, but get a much smaller fine if you cooperated when caught then you'd be silly to actually pay. If you do the work ahead of time, you pay the cost of doing the work. If you wait for the fine, you pay the cost of doing the work plus the fine. It doesn't take a lot of fine to make doing the work to begin with worth it -- basically just accounting for chance of getting away with it and time value of money, which goes down as the government gets better at catching more people quicker, as should be their primary goal for something like this.
- pbhjpbhj 8y agoMaybe, but there's much more work that needs doing to secure PII than just not having plaintext passwords. So, they can seemingly avoid doing all that work too, and maintaining those systems (with staffing costs). And you get a leg-up over the competition who can't use the cash that they put in to security. That means those with poor security regimes may "win" because the costs of poor PII hygiene are externalised. It would certainly be nice to imagine all the 2 million UK corporations are addressing PII security rather than hiding and hoping not to get a fine ...
- wpietri 8y agoIf bad security is a consciously chosen company strategy, then sure, the fine is too small. But most places don't do dumb stuff like this because they've smartly chosen to be dumb. It's just thoughtlessness, just focusing on the wrong things. And one of those wrong things is "saving" money by being too cheap. If a cheapskate client asked me to store passwords in plaintext on the theory they could save a few days of dev work, I'd love to be able to say, "Sorry, that's such a bad idea it's illegal. Fines start at €20k and go up." Their cheapness meter would swing into the red and they'd leave me alone. If they company had actually chosen to be broadly negligent, it's clear the regulator could have imposed a much bigger fine, so I think your case is covered too.
- usrusr 8y ago> I couldn't find Knuddels annual profit but they appear to have a dozen staff, which suggests to me the fine is too small. On the other hand they seem to have at least as many open positions. This is either a sign of strong growth or a sign of inability to offer competitive pay. For a struggling pre-Facebook social web relic, it's easy to guess which one it is.
- Svoka 8y agoThis is what GDPR should be about.
- mark_sz 8y agoMaybe https://www.plus.net/ https://www.plus.net/ should be next. Reported few times without any result.
- johnnyfaehell 8y agoReport for what? Storing plain text passwords?
- mark_sz 8y agoReported to them that it's not a good idea.
- kodablah 8y agoI see this is based on a Spiegel article. Can someone link to the full ruling? One thing I am curious about is how the number was derived. Regardless, even if you disagree with the scope of the law (which I do but not the intent of course), it is a very welcoming sign to see some actual enforcement happening. An under/subjectively enforced law of this size is much worse than a reasonably enforced one.
- lorenzhs 8y agoHere's the Data Protection Officer's press release (in German): https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/ https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... - the relevant paragraph is towards the end. The tl;dr is that the fine is rather low because they were very cooperative and quick to follow suggestions for improvement, and have additional improvements planned. Also, they likely couldn't afford more, and the goal of GDPR fines is not only to be effective and a deterrent, but also proportionate. The DPO says that including the cost of IT security measures taken and planned, the total expense for Knuddels is a six-digit figure.
- nf05papsjfVbc 8y agoI think the cost of complying with the law is just cost of conducting a business lawfully. So, those parts should not be spoken of as if they were part of the damages.
- lorenzhs 8y agoWell obviously they should have improved their security practices years ago. Nonetheless, they incurred the costs now, as a result of self-reporting a data breach (which is mandatory). That's the number that's relevant as a deterrent for others, so I think it's fine to report it this way.
- mirages 8y agoGDPR is not supposed to be enforced after a 2 year grace period ?
- LoSboccacc 8y agoThat was starting March 2016
- NewsAware 8y agoThat 2 year grace period ended in May 2018
- Majestic121 8y agoIt was, and the grace period ended in may of this year
- dorianm 8y agoFull list of 5000+ websites that store their passwords in plain text: https://github.com/plaintextoffenders/plaintextoffenders/blob/master/offenders.csv https://github.com/plaintextoffenders/plaintextoffenders/blo...
- the_duke 8y agoSomeone should send a friendly email to each of those offenders, linking the ruling. It's also fair to say that the next few years will be a busy time for the government agencies tasked with GDRP enforcement. (Assuming they do it properly, which falls within the responsibility of the relevant country)
- tyingq 8y agoThey should, though assuming a bloated org structure and process, fixing it now is probably more expensive than the €20000 fine.
- lorenzhs 8y agoNote that the actual cost to Knuddels is much higher, because you also have to include the cost of implementing proper security measures. The Data Protection Officer's statement (https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/ https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue..., in German) states that the total cost to Knuddels is a six figure sum.
- jtbayly 8y agoBut the fine would have been more if they had refused to fix it. So the calculus isn’t straightforward.
- the_duke 8y agoFor a larger company, should be considerably higher. Also, the ruling mentioned a reduced fine for cooperation and quick remediation. This probably wouldn't play out so well with a bloated structure and process, as you mentioned.
- codeulike 8y agoI read the headline as saying that Knuddels was a platform for chatting about GDPR, which made it all seem very ironic. edit: title has been changed, nevermind
- pmontra 8y agoAttack, succeed and blackmail could become a business. "If you don't pay me X we'll report you under GDPR and you'll have to pay much more."
- claudius 8y ago"If you don’t pay me X we’ll report you under criminal law and you’ll have to pay much more." "If you don’t pay me X we’ll report you under environmental protection law and you’ll have to pay much more." "If you don’t pay me X we’ll report you under labour regulations law and you’ll have to pay much more." How would GDPR be special?
- TomMarius 8y agoIn the extreme large fines.
- SmellyGeekBoy 8y agoNone of these other things are designed to protect against misuse of personal data specifically?
- AnthonyMouse 8y ago> How would GDPR be special? The proportion of businesses who are unintentionally violating it is unusually high.
- nothrabannosir 8y ago
- sbhn 8y agoWho gets the money, after those who administer it take there cut
- Tomte 8y agoThe state, Baden-Württemberg.
- tyingq 8y ago"Knuddels is safer than ever." Corporate speak is just so funny. The bar for "safer than ever" is pretty low when your dev team hasn't heard of password hashing.
- ygra 8y agoWell, you can work your way up with ever increasing levels of safety by adding first MD5, then moving to SHA-1, then adding a salt, and eventually something sensible like bcrypt. That's four more press releases right there :-)
- Double_a_92 8y agoThe passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...
- jeandejean 8y agoFunny to speak about security and a GDPR fine for a website that hasn't HTTPS activated...
- bausshf 8y agoI don't see much reason why their website should have HTTPS though. There are no input fields, no requests sent with personal information at all etc. Everything that's questionable already comes over HTTPS on their site though, like Facebook content etc.
- hnaj 8y agoAccording to the link: https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/ https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... They were doing this so they could filter out the passwords from chats (i.e. to make it so users can't give out their passwords to other users). Not saying this justifies it, but it's interesting.
- Drakim 8y agoIt's possible to do that without storing the passwords in plain text though! Run each word of the chat though the same hash+salt mechanism and compare to what you have stored.
- xaitv 8y agoBut what if people have multi-word passwords? At that point the solutions become so over-engineered(either use some ngram-like setup to detect passwords being posted or save a hash for each separate word of the user's password, which also decreases security since then you know the user has a multi-word password) that you might as well drop that feature.
- gpm 8y agoJust forbid spaces?
- AnthonyMouse 8y agoThat significantly reduces entropy in the password. Also, the premise is faulty, because as soon as users figure out they can't type their password in the chat, they'll just describe it in words or split it into two pieces etc.
- Drakim 8y agoGive them a big scary message "Never give out your password to strangers" when the censoring happens, because it's highly likely somebody is pretending to be an admin asking for a password in that situation.
- ru999gol 8y agoSeems like they got punished for informing the government about the hack, obviously gives the next company that gets hacked a reason to try to hide it.
- the8472 8y agoThe fine was set low for cooperating with the DPO. If you hide it and someone leaks it then the agency could ask for much more.
- anotheryou 8y agolaughably little though (20k)