4 ms·

We need to start charging companies with criminal negligence if they are not using secure password hashing algorithms. People reuse passwords and this leak put

by adrr 7y ago

We need to start charging companies with criminal negligence if they are not using secure password hashing algorithms. People reuse passwords and this leak puts other companies at risk.

sieabahlpark 7y ago
You can't sue a company for your own bad security practices.
whatshisface 7y ago
That would be a civil case prosecuted by the other companies, not a criminal case.
- kokowawa393 7y ago
  It should be criminal.
  - alasdair_ 7y ago
    People that re-use passwords should be considered negligent. There is no reason to do so for anything but the most trivial logins.
  - gruez 7y ago
    Good luck proving that a "reasonable person" shouldn't have done it. Most people on HN probably do, but I wouldn't be surprised if everyone coming out of a 3 month coding bootcamp only knew to hash passwords and nothing else. The other comments in this thread seems to suggest that the company is filled with bootcamp programmers.
    - shakna 7y ago
      As a government body actually publishes advice on this, NIST [0], it may well be possible to argue for what is reasonable in a court of law. [0] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions https://csrc.nist.gov/projects/hash-functions/nist-policy-on...
    - adrr 7y ago
      I just googled how to store passwords in a DB and the first result said I shouldn’t use MD5 or SHA. Reasonable person would do a cursory search for information if they didn’t have the knowledge. I am willing to bet they knew better. When I worked for a company that stored passwords in clear text, we knew it was wrong but never prioritized fixing it. If the execs would have faced jail time, I bet it would have been prioritized.
JudgeWapner 7y ago
they should be sued based on the number of breached records, period. let their insurance company dictate what hash algorithm to use. Damages would be automatically awarded to plaintiffs based on what data was breached. Just like a car accident: you destroyed my rear bumper, tail light, and window, the damages were $3200. Pay up.

by adrr 7y ago

We need to start charging companies with criminal negligence if they are not using secure password hashing algorithms. People reuse passwords and this leak puts other companies at risk.

sieabahlpark 7y ago

You can't sue a company for your own bad security practices.

whatshisface 7y ago

That would be a civil case prosecuted by the other companies, not a criminal case.

kokowawa393 7y ago
It should be criminal.
- alasdair_ 7y ago
  People that re-use passwords should be considered negligent. There is no reason to do so for anything but the most trivial logins.
- gruez 7y ago
  Good luck proving that a "reasonable person" shouldn't have done it. Most people on HN probably do, but I wouldn't be surprised if everyone coming out of a 3 month coding bootcamp only knew to hash passwords and nothing else. The other comments in this thread seems to suggest that the company is filled with bootcamp programmers.
  - shakna 7y ago
    As a government body actually publishes advice on this, NIST [0], it may well be possible to argue for what is reasonable in a court of law. [0] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions https://csrc.nist.gov/projects/hash-functions/nist-policy-on...
  - adrr 7y ago
    I just googled how to store passwords in a DB and the first result said I shouldn’t use MD5 or SHA. Reasonable person would do a cursory search for information if they didn’t have the knowledge. I am willing to bet they knew better. When I worked for a company that stored passwords in clear text, we knew it was wrong but never prioritized fixing it. If the execs would have faced jail time, I bet it would have been prioritized.

JudgeWapner 7y ago

they should be sued based on the number of breached records, period. let their insurance company dictate what hash algorithm to use. Damages would be automatically awarded to plaintiffs based on what data was breached. Just like a car accident: you destroyed my rear bumper, tail light, and window, the damages were $3200. Pay up.