4 ms·

I'm a bit surprised by the general tone of the comments on this. Not using BCC on group threads like the one mentioned is essentially a PII breach. The fact th

I'm a bit surprised by the general tone of the comments on this. Not using BCC on group threads like the one mentioned is essentially a PII breach. The fact that this was an organization responsible for the care of minors, which refused to remove someone who was erroneously given access to that data, definitely warrants concern. If the author had found a security vulnerability in a school website, responsibly disclosed it, and deleted all information gathered, I doubt they would be getting the same level of side eye.

duxup 7y ago
>definitely warrants concern. Concern about being removed from an email list in a timely fashion?
- glloydell 7y ago
  Concern about the private information of students and families being improperly disclosed.
  - duxup 7y ago
    Their email addresses?
    - glloydell 7y ago
      It's indicative of poor data privacy practices, as is the failure to remove someone who shouldn't have a access to the information being sent in the emails.
    - glloydell 7y ago
      https://www.dol.gov/general/ppii https://www.dol.gov/general/ppii "PII is defined as information: (i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address"
      - duxup 7y ago
        Are you sure that's always the case? School groups for my kids actually share that information as a way for parents to contact each other. I'm not certain that we can say that any given email list is required to be private.
        glloydell 7y ago
        It's not always the case to be sure, but I'd argue that there's a large difference between making the intentional choice to share information and accidentally disclosing it to unintended parties.
    - 0xdeadb00f 7y ago
      He was able to obtain a lot of personal information from those email addresses wasn't he?
nwallin 7y ago
> responsibly disclosed it, That's the problem here. The disclosure as represented by the author themself is decidedly not responsible.
- glloydell 7y ago
  Sharing the dataset with the full email list instead of individually sharing his results with each person on the list definitely toes the boundary, but given that the parents are going to be the drivers of change in this situation I'd say it's reasonable. If you were in the same position as the author, how would you handle disclosure?
  - nwallin 7y ago
    > given that the parents are going to be the drivers of change in this situation I'd say it's reasonable. (Note: I shortened your quote, and the shortened bit does not give your intent. But it's the part I want to respond to. Other readers should read OPs full text.) The drivers of change with regards to the Equifax leak was the voting populous of the United States- I image if the Equifax hacker sent the credit reports of everyone compromised by the leak to everyone compromised by the leak and claimed to be an honest security researcher, it wouldn't have gone well. > If you were in the same position as the author, how would you handle disclosure? The author mentioned having the contact information of the legal council of the school. Send an email to them saying that email addresses are PII and they shouldn't be widely distributed. Escalate from there. If they ignore it, send a spreadsheet of names, email addresses, and facebook accounts to the lawyer. If they ignore that, start digging, send more - anyway, the point is, start at DEFCON 4 and work your way up, don't immediately step to DEFCON 2. In this case, where the solution is to paste into the BCC box instead of the TO or CC box, a 30 day window ought to be sufficient, but a zero day window is completely unacceptable.

duxup 7y ago

>definitely warrants concern. Concern about being removed from an email list in a timely fashion?

glloydell 7y ago
Concern about the private information of students and families being improperly disclosed.
- duxup 7y ago
  Their email addresses?
  - glloydell 7y ago
    It's indicative of poor data privacy practices, as is the failure to remove someone who shouldn't have a access to the information being sent in the emails.
  - glloydell 7y ago
    https://www.dol.gov/general/ppii https://www.dol.gov/general/ppii "PII is defined as information: (i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address"
    - duxup 7y ago
      Are you sure that's always the case? School groups for my kids actually share that information as a way for parents to contact each other. I'm not certain that we can say that any given email list is required to be private.
      - glloydell 7y ago
        It's not always the case to be sure, but I'd argue that there's a large difference between making the intentional choice to share information and accidentally disclosing it to unintended parties.
  - 0xdeadb00f 7y ago
    He was able to obtain a lot of personal information from those email addresses wasn't he?

nwallin 7y ago

> responsibly disclosed it, That's the problem here. The disclosure as represented by the author themself is decidedly not responsible.

glloydell 7y ago
Sharing the dataset with the full email list instead of individually sharing his results with each person on the list definitely toes the boundary, but given that the parents are going to be the drivers of change in this situation I'd say it's reasonable. If you were in the same position as the author, how would you handle disclosure?
- nwallin 7y ago
  > given that the parents are going to be the drivers of change in this situation I'd say it's reasonable. (Note: I shortened your quote, and the shortened bit does not give your intent. But it's the part I want to respond to. Other readers should read OPs full text.) The drivers of change with regards to the Equifax leak was the voting populous of the United States- I image if the Equifax hacker sent the credit reports of everyone compromised by the leak to everyone compromised by the leak and claimed to be an honest security researcher, it wouldn't have gone well. > If you were in the same position as the author, how would you handle disclosure? The author mentioned having the contact information of the legal council of the school. Send an email to them saying that email addresses are PII and they shouldn't be widely distributed. Escalate from there. If they ignore it, send a spreadsheet of names, email addresses, and facebook accounts to the lawyer. If they ignore that, start digging, send more - anyway, the point is, start at DEFCON 4 and work your way up, don't immediately step to DEFCON 2. In this case, where the solution is to paste into the BCC box instead of the TO or CC box, a 30 day window ought to be sufficient, but a zero day window is completely unacceptable.