2 ms·
In some cases, I might be tempted to agree with you, but this is blindly being applied by an automated attack. What if some of that deleted data is volunteer-c
by KMag 6y ago
In some cases, I might be tempted to agree with you, but this is blindly being applied by an automated attack. What if some of that deleted data is volunteer-canvassed anonymized survey data of homeless people, and its loss sets back a homeless relief program by months, resulting in several people freezing to death this winter?
- dredmorbius 6y agoThe data may be modified at any time without a trace, rendering it void. Secure your damned database. The fault and responsibility lie with the deploying organisation and tools vendor. Meow is just the messenger.
- KMag 6y agoBut if they had used the password changes API to assign random passwords to all accounts, as suggested, then the data couldn't be modified. Am I missing something?
- dredmorbius 6y agoMy understanding is that password-secured DBs aren't vulnerable to Meow remediations.
- _-___________-_ 6y agoParent's point is that any conclusion one could make from the data is worthless because, being public and unsecured, it could have been modified by any Internet user at any time before a password was set.
- dredmorbius 6y agoCorrect.
- hhjj 6y agoThen people should feel bad their negligence did cost lives.
- KMag 6y agoBoth the DB admins and the attackers should both feel guilt. However, if the attackers simply assigned randomly-generated passwords to all of the accounts, then no data would be lost and the DB admins would still have their DBs temporarily become inaccessible while they figured out how to force-reset their passwords. If you're going to go for disruption, I think the suggested lockout gives a much better ratio of good being done to potential damage being done.
- dredmorbius 6y agoSomething tells me that this level of pain would prove insufficient for education.