2 ms·
Dont you think calling it a leak is disingenuous. Passwords were available and NO evidence points towards them being accessed. Thats a vulnerability that was
by basch 8y ago
Dont you think calling it a leak is disingenuous. Passwords were available and NO evidence points towards them being accessed. Thats a vulnerability that was not exploited, as far as they know. A leak would mean the data WAS accessed.
- prophesi 8y agoThe adage "Better safe than sorry" comes to mind. And a leak doesn't need evidence that it was accessed to be deemed a leak. They were stored in plaintext, potentially accessible by internal employees. That's enough to warrant a password reset. It's not asking for much. One should only entrust their password to a hashing algorithm.
- tptacek 8y agoI guess if there's such a thing as an "internal leak", that's what this is. The word "leak", by itself, connotes an exposure that is not in evidence, and given the sensitivity of the topic, I think precision is called for.
- prophesi 8y agoYes, when it comes to this sort of sensitive information, there is such a thing as an internal leak. We've had PCI-compliance to ensure companies handle credit card information properly. Then we have GDPR and similar laws for personally identifying information. Access to account credentials for a large social media platform definitely falls into the sensitive & personally-identifying category.