6 ms·

Facebook ex-security chief: How ‘hypertargeting’ threatens democracy

103 points by longdefeat 8y ago

kerng 8y ago
Alex Stamos is an interesting CISO both Yahoo and Facebook had giant breaches under his tenure and he leaves pretty much right after.
- m0zg 8y ago
  "Success consists of going from failure to failure without loss of enthusiasm." -- Winston Churchill
  - sexyrouter 8y ago
    I hope people stop quoting such an awful man responsible for genocide in South Asia. It's a very painful memory for some everytime his name comes up.
    - deleted 8y ago
      [deleted]
  - thatcat 8y ago
    Sounds like what some one would do if they got a golden parachute from every failure.
- MR4D 8y ago
  From the article it looked like he told the truth about the attacks at Yahoo and Marissa lied. I’d leave too under those conditions. Nice knowing that the SEC investigation backs up his story.
  - m0zg 8y ago
    As a CISO it was his responsibility to never end up in that situation in the first place.
    - throwawaymath 8y ago
      This is a very naive view of information security. The most sophisticated approaches to modern security - either in technical app/net sec or in risk management - begin from the assumption that vulnerabilities exist and will be exploited. Every security team should be proactively trying to eliminate security vulnerabilities. But they will happen nonetheless, and the mark of truly secure organizations is in the way they respond to such vulnerabilities. At the CISO level this becomes even more important: a CISO is not only responsible for setting the organizational mandates for security. They are also responsible for being the public face which responds to notable security events.
      - m0zg 8y ago
        Well, neither Yahoo's nor FB's security teams have eliminated the gaping security holes in question, from which I conclude that maybe he just isn't as good as his "public face" would imply.
        kerng 8y ago
        I wouldn't hire a CISO associated with multiple large breaches in the past as CISO for my company... I think there would be better options.
        m0zg 8y ago
        And neither would I, but a lot of people here apparently would, if his "public face" is pretty enough.
    - jedberg 8y ago
      That is only true if management follows your recommendations. If they decide profit is more important than security, than your job is to mitigate as much risk as possible and detect breaches as quickly as possible. Which he did.
- jedberg 8y ago
  According to the article, that's because in both cases they asked him to help in the cover up, and he refused to bend his ethics like that.
  - lawnchair_larry 8y ago
    But also according to the article, he’s not a very effective manager and difficult to work both for and with. That’s consistent with what I’ve heard in security circles outside of his infosec microcelebrity friends. You do need exceptional people and political skills to be effective in these jobs, and arrogance is a really bad attribute if your job is to influence.
- nelsonic 8y ago
  A CISO's task is thankless. Beyond financial compensation, which is comparatively lower than the "rock star developers" or executives, the CISO does not get thanked for making the product(s) more secure, ensuring security tends to add more dev time and QA steps which makes everyone working on the product feel like things are taking longer. The CISO is fighting against the mindset of all other managers in the company who just want to "deliver" the features to make their numbers for the quarter (so they can get a bonus or be promoted), and the developers who are required to "cut corners" both in terms of quality and security in order to ship. Both Yahoo and Facebook have a history of insecurity that dates back far before the arrival of Alex Stamos, who as others have said, is the "fall guy" when the leaders of the organisation prioritise short-term profits/growth over the security of user's data.
  - lawnchair_larry 8y ago
    The compensation for these roles is VP+ level, way more than rockstar developers.
    - chillee 8y ago
      There's a lot that's uneviable about Stamos's position - his compensation is not one of them.
- trumped 8y ago
  It doesn't take way from the fact that he is right...
pixl97 8y ago
I didn't realize that Alex was part of the of the Oregon Trail generation till now. Heh, I feel a kinship with him, though we have never met. Having to let corporate types over rule you that security is a secondary concern to profit. And they may not be wrong in the sense that you need profit to survive. But much like burning oil for fuel, our security pollution is building up and the entire world is starting to pay for it.
- throwaway415415 8y ago
  Oregon trail?
  - otoburb 8y ago
    It's a game.[1] [1] https://en.wikipedia.org/wiki/The_Oregon_Trail_(series) https://en.wikipedia.org/wiki/The_Oregon_Trail_(series)
    - moonshinefe 8y ago
      Uhh, I grew up playing the game in public school in the 90s and certainly never considered myself identified by that particular game or felt connected with anyone because they happened to play a game in that series too. That's just weird. There were hundreds of games at the time.
      - martincmartin 8y ago
        The game was taught in many schools in the U.S. for a while. So many kids who weren't gamers, or didn't have a computer and home, would have played it. That makes it different from the hundreds of other games.
tacoman 8y ago
Stamos sometimes has a guest spot on the Risky Business podcast. He's incredibly insightful and candid. Other than Dan Geer, I can't think of anyone else that can articulate the current state of infosec as well as he can.
- nelsonic 8y ago
  Direct link: https://risky.biz/RB522 https://risky.biz/RB522 for anyone wondering. (Agree super insightful)
rblion 8y ago
Anyone have a link to the lecture?
black_puppydog 8y ago
That would be much more interesting, if yahoo.com wasn't so obnoxious with their hypertargeting cookie settings. :|
- eveningcoffee 8y ago
  Yahoo thinks that GDPR is a new cookie law. Lets see how long this idea will fly.
deleted 8y ago
[deleted]
blub 8y ago
I haven't managed to bring myself to view any webpage owned by the Oath group, of which Yahoo is apparently part of since the GDPR came into effect. They opt-in by default for dozens and dozens of advertising companies from all over the world, including many from Europe. Some of these companies are considered fundamental partners and one can't even opt out of having one's info pilfered by them. Google and Facebook are apparently two of them... which makes the whole exercise pointless. I selected to view the privacy policy of one of the partners and when I returned everything was pre-selected again. Scum.
techslave 8y ago
him again? come on dude. move on.

103 points by longdefeat 8y ago

Alex Stamos is an interesting CISO both Yahoo and Facebook had giant breaches under his tenure and he leaves pretty much right after.

m0zg 8y ago
"Success consists of going from failure to failure without loss of enthusiasm." -- Winston Churchill
- sexyrouter 8y ago
  I hope people stop quoting such an awful man responsible for genocide in South Asia. It's a very painful memory for some everytime his name comes up.
  - deleted 8y ago
    [deleted]
- thatcat 8y ago
  Sounds like what some one would do if they got a golden parachute from every failure.
MR4D 8y ago
From the article it looked like he told the truth about the attacks at Yahoo and Marissa lied. I’d leave too under those conditions. Nice knowing that the SEC investigation backs up his story.
- m0zg 8y ago
  As a CISO it was his responsibility to never end up in that situation in the first place.
  - throwawaymath 8y ago
    This is a very naive view of information security. The most sophisticated approaches to modern security - either in technical app/net sec or in risk management - begin from the assumption that vulnerabilities exist and will be exploited. Every security team should be proactively trying to eliminate security vulnerabilities. But they will happen nonetheless, and the mark of truly secure organizations is in the way they respond to such vulnerabilities. At the CISO level this becomes even more important: a CISO is not only responsible for setting the organizational mandates for security. They are also responsible for being the public face which responds to notable security events.
    - m0zg 8y ago
      Well, neither Yahoo's nor FB's security teams have eliminated the gaping security holes in question, from which I conclude that maybe he just isn't as good as his "public face" would imply.
      - kerng 8y ago
        I wouldn't hire a CISO associated with multiple large breaches in the past as CISO for my company... I think there would be better options.
        m0zg 8y ago
        And neither would I, but a lot of people here apparently would, if his "public face" is pretty enough.
  - jedberg 8y ago
    That is only true if management follows your recommendations. If they decide profit is more important than security, than your job is to mitigate as much risk as possible and detect breaches as quickly as possible. Which he did.
jedberg 8y ago
According to the article, that's because in both cases they asked him to help in the cover up, and he refused to bend his ethics like that.
- lawnchair_larry 8y ago
  But also according to the article, he’s not a very effective manager and difficult to work both for and with. That’s consistent with what I’ve heard in security circles outside of his infosec microcelebrity friends. You do need exceptional people and political skills to be effective in these jobs, and arrogance is a really bad attribute if your job is to influence.
nelsonic 8y ago
A CISO's task is thankless. Beyond financial compensation, which is comparatively lower than the "rock star developers" or executives, the CISO does not get thanked for making the product(s) more secure, ensuring security tends to add more dev time and QA steps which makes everyone working on the product feel like things are taking longer. The CISO is fighting against the mindset of all other managers in the company who just want to "deliver" the features to make their numbers for the quarter (so they can get a bonus or be promoted), and the developers who are required to "cut corners" both in terms of quality and security in order to ship. Both Yahoo and Facebook have a history of insecurity that dates back far before the arrival of Alex Stamos, who as others have said, is the "fall guy" when the leaders of the organisation prioritise short-term profits/growth over the security of user's data.
- lawnchair_larry 8y ago
  The compensation for these roles is VP+ level, way more than rockstar developers.
  - chillee 8y ago
    There's a lot that's uneviable about Stamos's position - his compensation is not one of them.
trumped 8y ago
It doesn't take way from the fact that he is right...

pixl97 8y ago

I didn't realize that Alex was part of the of the Oregon Trail generation till now. Heh, I feel a kinship with him, though we have never met. Having to let corporate types over rule you that security is a secondary concern to profit. And they may not be wrong in the sense that you need profit to survive. But much like burning oil for fuel, our security pollution is building up and the entire world is starting to pay for it.

throwaway415415 8y ago
Oregon trail?
- otoburb 8y ago
  It's a game.[1] [1] https://en.wikipedia.org/wiki/The_Oregon_Trail_(series) https://en.wikipedia.org/wiki/The_Oregon_Trail_(series)
  - moonshinefe 8y ago
    Uhh, I grew up playing the game in public school in the 90s and certainly never considered myself identified by that particular game or felt connected with anyone because they happened to play a game in that series too. That's just weird. There were hundreds of games at the time.
    - martincmartin 8y ago
      The game was taught in many schools in the U.S. for a while. So many kids who weren't gamers, or didn't have a computer and home, would have played it. That makes it different from the hundreds of other games.

tacoman 8y ago

Stamos sometimes has a guest spot on the Risky Business podcast. He's incredibly insightful and candid. Other than Dan Geer, I can't think of anyone else that can articulate the current state of infosec as well as he can.

nelsonic 8y ago
Direct link: https://risky.biz/RB522 https://risky.biz/RB522 for anyone wondering. (Agree super insightful)

rblion 8y ago

Anyone have a link to the lecture?

black_puppydog 8y ago

That would be much more interesting, if yahoo.com wasn't so obnoxious with their hypertargeting cookie settings. :|

eveningcoffee 8y ago
Yahoo thinks that GDPR is a new cookie law. Lets see how long this idea will fly.

deleted 8y ago

[deleted]

blub 8y ago

I haven't managed to bring myself to view any webpage owned by the Oath group, of which Yahoo is apparently part of since the GDPR came into effect. They opt-in by default for dozens and dozens of advertising companies from all over the world, including many from Europe. Some of these companies are considered fundamental partners and one can't even opt out of having one's info pilfered by them. Google and Facebook are apparently two of them... which makes the whole exercise pointless. I selected to view the privacy policy of one of the partners and when I returned everything was pre-selected again. Scum.

techslave 8y ago

him again? come on dude. move on.