7 ms·

The Difficulty of Disclosure, Surebet247 and the Streisand Effect

96 points by weinzierl 7y ago

ryanlol 7y ago
> I'll refrain from posting the entire messages he received as they were a bit, well, "legal" So... why?
- blantonl 7y ago
  Have you ever noticed that photos of lawyers typically have a backdrop of volumes of books with reams and reams of text? That’s why - because it was probably reams and reams of legalese bullshit
iafrikan 7y ago
The lovely thing now is they will possibly face GDPR scrutiny after this --> https://www.iafrikan.com/2020/01/07/surebet247-nigeria-sports-betting-soccer-gambling-nitda-gdpr-european-union-data-breach/ https://www.iafrikan.com/2020/01/07/surebet247-nigeria-sport...
- mr__y 7y ago
  Assuming that all the information in the troyhunt article is true I wish them the worst possible outcome from the bottom of my heart
IfOnlyYouKnew 7y ago
Tangentially related: I’ve always considered the “Streisand effect” to be vaguely immoral, even though I usually agree with the side it’s ostensibly helping. That’s because it’s fundamentally (and often gleefully) negating people’s legal rights, and replacing it with the mob’s moral convictions. Telling people they may have some legal right, but they better not even try using it is dangerous. I’ve heard about it’s abuse in smaller settings, i. e. “of course they did not give you a promotion because your are (black/white/woman/old/...). But if you complain about it, working here will become miserable”.
- mr__y 7y ago
  According to the article they were contacted via email and DMs first, many days before it went public. They were given enough time to verify this and respond accordingly. Also due to GDPR they are obliged to inform the users (at least those from EU) about the data breach - it is not their right to decide whether to inform or not anymore. They do not have to make a public announcement and could just send emails directly to affected users, but considering the total number of affected users I really doubt it would not become a public issue anyways. But one thing holds: it is still not their legal right to remain silent, they are required to inform the affected users (at minimum those from EU)
  - iafrikan 7y ago
    Not only based on GDPR, but also Nigeria's NDPR. They failed horribly. See here - https://www.iafrikan.com/2020/01/06/nigeria-data-protection-regulation-surebet247-national-information-technology-development-agency-nitda-breach-security-leak-soccer-betting-sports-gambling/ https://www.iafrikan.com/2020/01/06/nigeria-data-protection-...
    - mr__y 7y ago
      Do you know what possible fines or other consequences they could be facing? I'm really corious about that. (this paragraph does not refer to NDPR or Nigeria) I have a general impression that very often the possible fines are far too low and it could be perfectly sound business decision to ignore the security or just keep it to a very minimum. Why spend a lot of money on auditing, improving the software, buying additional infrastructure when the cost of ignoring those and even the probability of anything happening is relatively low. For example why spend hundreds of thousands or possibly millions of dolars on security when the worst thing that could happen is a low fine with a marginal probability of breach happening then being discovered, then being reported, then being investigated and then actually a legal action actually being taken. My point is that it might actually be a lot cheaper to face the consequences of a breach than to improve security. I'm not sure what could be done to improve that situation.
- akerl_ 7y ago
ComodoHacker 7y ago
The specific of online gambling business is there are lot of shady things going on. You just aren't competitive if you're all legal and honest. When something goes wrong, something you can't immediately fix, the optimal strategy often is cover things up and not attract the attention of regulators at all costs. Because once you did, it's better to dump your company, save whatever assets you can and start over. This might explain their attitude.
- deleted 7y ago
  [deleted]
glitcher 7y ago
Really great write-up as usual from Mr. Hunt! Some bits that I found especially amusing: Auto-response email from the company says "To add additional comments, please reply to this email". The email address it came from is "noreply@surebet247.com". Troy's opinion of gambling: "Granted, gambling merely amounts to a tax on people who can't do maths" :)

96 points by weinzierl 7y ago

ryanlol 7y ago

> I'll refrain from posting the entire messages he received as they were a bit, well, "legal" So... why?

blantonl 7y ago
Have you ever noticed that photos of lawyers typically have a backdrop of volumes of books with reams and reams of text? That’s why - because it was probably reams and reams of legalese bullshit

iafrikan 7y ago

The lovely thing now is they will possibly face GDPR scrutiny after this --> https://www.iafrikan.com/2020/01/07/surebet247-nigeria-sports-betting-soccer-gambling-nitda-gdpr-european-union-data-breach/ https://www.iafrikan.com/2020/01/07/surebet247-nigeria-sport...

mr__y 7y ago
Assuming that all the information in the troyhunt article is true I wish them the worst possible outcome from the bottom of my heart

IfOnlyYouKnew 7y ago

Tangentially related: I’ve always considered the “Streisand effect” to be vaguely immoral, even though I usually agree with the side it’s ostensibly helping. That’s because it’s fundamentally (and often gleefully) negating people’s legal rights, and replacing it with the mob’s moral convictions. Telling people they may have some legal right, but they better not even try using it is dangerous. I’ve heard about it’s abuse in smaller settings, i. e. “of course they did not give you a promotion because your are (black/white/woman/old/...). But if you complain about it, working here will become miserable”.

mr__y 7y ago
According to the article they were contacted via email and DMs first, many days before it went public. They were given enough time to verify this and respond accordingly. Also due to GDPR they are obliged to inform the users (at least those from EU) about the data breach - it is not their right to decide whether to inform or not anymore. They do not have to make a public announcement and could just send emails directly to affected users, but considering the total number of affected users I really doubt it would not become a public issue anyways. But one thing holds: it is still not their legal right to remain silent, they are required to inform the affected users (at minimum those from EU)
- iafrikan 7y ago
  Not only based on GDPR, but also Nigeria's NDPR. They failed horribly. See here - https://www.iafrikan.com/2020/01/06/nigeria-data-protection-regulation-surebet247-national-information-technology-development-agency-nitda-breach-security-leak-soccer-betting-sports-gambling/ https://www.iafrikan.com/2020/01/06/nigeria-data-protection-...
  - mr__y 7y ago
    Do you know what possible fines or other consequences they could be facing? I'm really corious about that. (this paragraph does not refer to NDPR or Nigeria) I have a general impression that very often the possible fines are far too low and it could be perfectly sound business decision to ignore the security or just keep it to a very minimum. Why spend a lot of money on auditing, improving the software, buying additional infrastructure when the cost of ignoring those and even the probability of anything happening is relatively low. For example why spend hundreds of thousands or possibly millions of dolars on security when the worst thing that could happen is a low fine with a marginal probability of breach happening then being discovered, then being reported, then being investigated and then actually a legal action actually being taken. My point is that it might actually be a lot cheaper to face the consequences of a breach than to improve security. I'm not sure what could be done to improve that situation.
akerl_ 7y ago

ComodoHacker 7y ago

The specific of online gambling business is there are lot of shady things going on. You just aren't competitive if you're all legal and honest. When something goes wrong, something you can't immediately fix, the optimal strategy often is cover things up and not attract the attention of regulators at all costs. Because once you did, it's better to dump your company, save whatever assets you can and start over. This might explain their attitude.

deleted 7y ago
[deleted]

glitcher 7y ago

Really great write-up as usual from Mr. Hunt! Some bits that I found especially amusing: Auto-response email from the company says "To add additional comments, please reply to this email". The email address it came from is "noreply@surebet247.com". Troy's opinion of gambling: "Granted, gambling merely amounts to a tax on people who can't do maths" :)