4 ms·

> Do we really want the government to have that much say in whether businesses live or die? The company broke the law in a way that could have potentially harm

by fao_ 8y ago

> Do we really want the government to have that much say in whether businesses live or die? The company broke the law in a way that could have potentially harmed* individuals (passwords are critical secrets, many users do not have more than one, and so could lose their entire identity and maybe several years worth of funds. Sure, you can say that is the fault of the user, but there is the assumption of security here that was given by the company and not fulfilled). If you rent a deposit box at a bank, with the assumption of safety, and it turns out they leave all the doors unlocked, don't hire guards, and someone came in and stole everyone's things and took them to the market, then closure of the bank is absolutely deserved. Conversely, if a prison gives the assumption of security, but doesn't hire guards, or bother locking cells, and all the inmates walk out and some people are killed, does the prison deserve to go bankrupt? These examples are exaggerated, yes, but roughly similar in circumstance. Hopefully enough to show that, yes, there are circumstances in which we want the government to have that hold over companies. Now, do we want governments to have restraint? Sure. But it seems clear to me that they very openly are acting in restraint in this case. 20k EUR is a pittance to what was potentially lost by the people involved in the breach. * - (Indeed, in America and a few other countries with weak to non-existent social welfare nets, loss of identity and money is likely to lead to homelessness and eventual death for the person, if they do not have family to rely on).

thaumasiotes 8y ago
> If you rent a deposit box at a bank, with the assumption of safety, and it turns out they leave all the doors unlocked, don't hire guards, and someone came in and stole everyone's things and took them to the market, then closure of the bank is absolutely deserved. OK, but I don't think any government action to close the bank would be necessary in that case. So how does giving the government a say help?
- orf 8y ago
  In that example the goods stolen are tangible and have real, solid value that anybody can recognize. In the case of things covered by GDPR the value is opaque and intangible, and only valuable to certain people. Letting 'the free hand of the market, driven by the layman who doesn't understand this, is not effective. If you want proof, well, it's in the pudding. Edit: also, if banks wheew getting knocked over as much as sites and apps, the government would intervene
- close04 8y ago
  I have yet to see a person against regulation that didn't run screaming for the authorities as soon as they were tricked, swindled, defrauded, abused by some company because no regulation was put in place. Most recent cases that come to mind are Bitcoin thefts. "The government shouldn't do anything to regulate or even look in the general direction of Bitcoin". Oh, the exchange left your pockets empty? "The Police and the government should do something!" Companies aren't scared of consumers because as a mass they have no idea what's good for them or how to protect themselves. Without a watchdog we'd all just be open for abuse with no leverage to stop it. Companies are far more motivated and capable to abuse you than you are to defend yourself.
- ivanhoe 8y ago
  It's not the same situation because in the case of a bank the risk is obvious to anyone, but it's might be hard for non-tech users of a chat app to understand the dangers of unencrypted passwords. It's the same like regulating the other industries, say layman can't assess how good lawyer or civil engineer someone is, so government requires them to have certain education and licenses or they can't work. We will need something like that sooner or later in IT because there's simply too much amateurism in industry now, where everyone and their mother has a startup these days and people with no proper experience and knowledge are trying to handle often very sensitive things. Just look at crypto-market and all those hacked sites - not hacked because hackers are evil geniuses, but because programmers who built them suck at their job... and market can't regulate it itself because the demand is so damn high
saurik 8y ago
> ...passwords are critical secrets, many users do not have more than one, and so could lose their entire identity and maybe several years worth of funds. Sure, you can say that is the fault of the user, but there is the assumption of security here that was given by the company and not fulfilled... I have so little sympathy for this position that despite generally having been pro-GDPR I no longer can support it if it is going to be used to encourage users to do something fundamentally stupid :/. The reality is that if we are going to make users think using one password is somehow ok then we need to be using authentication protocols that don't involve sending that password to a server in the first place: this is 2018, and challenge response takes like an hour to implement; the idea that sending a critical password to someone in the hope that they immediately hash it and store it is something that is somehow protected is insane.
- bryanrasmussen 8y ago
  I have little sympathy for the position that users just need to be not stupid and do things differently like they have been told to do for the last 20 years and yet have never done.
  - saurik 8y ago
    ...but what they are doing will never actually be secure no matter how hard we all cover our ears and scream into the void so we don't hear it when they keep getting screwed over and over again. We can't actually make that secure no matter how many passwords we hash, we can only attempt to mitigate some fraction of the eventual carnage. What we need to be doing is spending our time either on a massive education campaign or on technological solutions (like challenge response passwords, which HTTP never added even while every other old protocol was carefully adapting to get this right), not entrenching the position that users should be allowed to do the thing that will never ever ever be secure by putting up laws that somehow make it look sane. The point here isn't "shame on the users": the point here is "shame on developers and lawmakers for working against users by encouraging them to do this horribly insecure thing rather than doing something sane". Seriously: how about we instead make a law (with a GDRP-like lead up of multiple years to "get ready for it") which says that "handling passwords at all isn't legal, even in transit (whether on a third-party SSL termination service or on your own servers)", and lets see how many mere hours it suddenly takes the Chrome/Firefox teams to come up with a real solution to this problem?

by fao_ 8y ago

thaumasiotes 8y ago

> If you rent a deposit box at a bank, with the assumption of safety, and it turns out they leave all the doors unlocked, don't hire guards, and someone came in and stole everyone's things and took them to the market, then closure of the bank is absolutely deserved. OK, but I don't think any government action to close the bank would be necessary in that case. So how does giving the government a say help?

orf 8y ago
In that example the goods stolen are tangible and have real, solid value that anybody can recognize. In the case of things covered by GDPR the value is opaque and intangible, and only valuable to certain people. Letting 'the free hand of the market, driven by the layman who doesn't understand this, is not effective. If you want proof, well, it's in the pudding. Edit: also, if banks wheew getting knocked over as much as sites and apps, the government would intervene
close04 8y ago
I have yet to see a person against regulation that didn't run screaming for the authorities as soon as they were tricked, swindled, defrauded, abused by some company because no regulation was put in place. Most recent cases that come to mind are Bitcoin thefts. "The government shouldn't do anything to regulate or even look in the general direction of Bitcoin". Oh, the exchange left your pockets empty? "The Police and the government should do something!" Companies aren't scared of consumers because as a mass they have no idea what's good for them or how to protect themselves. Without a watchdog we'd all just be open for abuse with no leverage to stop it. Companies are far more motivated and capable to abuse you than you are to defend yourself.
ivanhoe 8y ago
It's not the same situation because in the case of a bank the risk is obvious to anyone, but it's might be hard for non-tech users of a chat app to understand the dangers of unencrypted passwords. It's the same like regulating the other industries, say layman can't assess how good lawyer or civil engineer someone is, so government requires them to have certain education and licenses or they can't work. We will need something like that sooner or later in IT because there's simply too much amateurism in industry now, where everyone and their mother has a startup these days and people with no proper experience and knowledge are trying to handle often very sensitive things. Just look at crypto-market and all those hacked sites - not hacked because hackers are evil geniuses, but because programmers who built them suck at their job... and market can't regulate it itself because the demand is so damn high

saurik 8y ago

> ...passwords are critical secrets, many users do not have more than one, and so could lose their entire identity and maybe several years worth of funds. Sure, you can say that is the fault of the user, but there is the assumption of security here that was given by the company and not fulfilled... I have so little sympathy for this position that despite generally having been pro-GDPR I no longer can support it if it is going to be used to encourage users to do something fundamentally stupid :/. The reality is that if we are going to make users think using one password is somehow ok then we need to be using authentication protocols that don't involve sending that password to a server in the first place: this is 2018, and challenge response takes like an hour to implement; the idea that sending a critical password to someone in the hope that they immediately hash it and store it is something that is somehow protected is insane.

bryanrasmussen 8y ago
I have little sympathy for the position that users just need to be not stupid and do things differently like they have been told to do for the last 20 years and yet have never done.
- saurik 8y ago
  ...but what they are doing will never actually be secure no matter how hard we all cover our ears and scream into the void so we don't hear it when they keep getting screwed over and over again. We can't actually make that secure no matter how many passwords we hash, we can only attempt to mitigate some fraction of the eventual carnage. What we need to be doing is spending our time either on a massive education campaign or on technological solutions (like challenge response passwords, which HTTP never added even while every other old protocol was carefully adapting to get this right), not entrenching the position that users should be allowed to do the thing that will never ever ever be secure by putting up laws that somehow make it look sane. The point here isn't "shame on the users": the point here is "shame on developers and lawmakers for working against users by encouraging them to do this horribly insecure thing rather than doing something sane". Seriously: how about we instead make a law (with a GDRP-like lead up of multiple years to "get ready for it") which says that "handling passwords at all isn't legal, even in transit (whether on a third-party SSL termination service or on your own servers)", and lets see how many mere hours it suddenly takes the Chrome/Firefox teams to come up with a real solution to this problem?