3 ms·

I agree that better security practices are advisable, but you're victim-blaming. Twitter wasn't 'asking for it', and neither were the individuals who lost bitc

by nickff 6y ago

I agree that better security practices are advisable, but you're victim-blaming. Twitter wasn't 'asking for it', and neither were the individuals who lost bitcoins; the 'hackers' intentionally perpetrated deceptions, misrepresentations, and fraud against both Twitter and the general public. If you compare what these three did to a white-collar crime, the dollar amount was small, but the behavior was egregious.

rschneid 6y ago
Twitter is a platform used widely by some of the most powerful people in the world and in the US government. As a result, there is plenty of justification and precedent for said gov't to regulate their security practices and procedures. To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http. Now, I don't think the government is prepared to do this proactively and effectively, but the idea of a telco that advertises resilience to hacks (whether through social engineering or technical incompetence) sounds like it would be quite appealing to a growing segment of the connected world and whatever such promises that find success in the marketplace might be used to inform legislation or regulation, eventually...
- saghm 6y ago
  > To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http This is probably off-topic, but companies shouldn't even be sending the passwords over HTTPS; passwords should be hashed client-side and then the hash should be sent to the server (preferably over HTTPS).
  - ribosometronome 6y ago
    Wouldn't that allow for a compromised database to leak the information a nefarious user needs to log into accounts? Compared to needing to find a collision if a database of hashes leaked?
    - nicoburns 6y ago
      I think client-side password hashing is generally in addition to server-side hashing. Not instead of it.
  - helsinkiandrew 6y ago
    Can you elaborate on how this makes things more secure (assuming HTTPS) Surely if the server accepts a client side hash of a password, then the hash has become the password
    - namibj 6y ago
      At that point you can do key derivation to get an ed25519 private key from the password and a server-supplied salt (specific to that user), after which the client signs a challenge the server supplied with that private key. When the password was set/changed, the corresponding public key was stored on the server.
    - mewpmewp2 6y ago
      Off the top of my mind. Maybe it could be something like that: 1. Api gives user a fixed salt. 2. User types password into input. 3. Client hashes and sends hash to server. 4. Server has another salt and uses the client sent hash to hash it again. 5. This final hash is compared what is in the database. This way server never has knowledge of the original PW and it's never sent over the network. This reduces for instance the chance of password getting logged in the service etc.
      - helsinkiandrew 6y ago
        But in that case the hash sent to the server in stage 3 is always the same and behaves like a password - capture it and you can use it again elsewhere.
slg 6y ago
The push against "victim blaming" is not about removing any possible role a victim would have in their victimhood. It is about destigmatizing victimhood and not blaming victims for things that are out of their control or that any other reasonable person would do. Let's imagine a situation in which someone breaks into my house and steals my TV. I deserve a decent amount of blame if I left my front door wide open before it happened. I deserve much less blame, but still some blame if I left my front door unlocked. I don't deserve any blame if someone broke down my front door to do it. In this situation, Twitter left their front door unlocked. Furthermore, Twitter is not even the primary victim here. The biggest victims are the people whose accounts were stolen and the people who were tricked into losing their bitcoin.
- saurik 6y ago
  > I don't deserve any blame if someone broke down my front door to do it. I mean, you could have gotten a more sturdy door... drawing the boundary between someone opening an unlocked door and breaking down the door is hard; so I'd agree with "even less blame", but if we believe you are ever at blame here, there isn't anything magical about the lock that shifts you from having blame to being blameless.
  - slg 6y ago
    To repeat myself, the opposition to victim blaming is about "not blaming victims for things that are out of their control or that any other reasonable person would do." I acknowledged that a standard lock is generally not going to stop many determined criminals, but it is an acceptable baseline that all reasonable people can be expected to meet in order to help prevent their home from being burgled. You can of course go above and beyond that, but I think anyone who meets that baseline standard doesn't deserve blame. Back on topic, I think lots of people would agree that allowing low level employees the ability to completely hijack the accounts of some of the most prominent people on the planet with zero oversight is not a reasonable level of security.
    - deleted 6y ago
      [deleted]
ksm1717 6y ago
While the words do sound like victim blaming, id argue that sweeping conclusions that sound like the common rhetoric like “victims can do no wrong” deserve both careful consideration and some wiggle room. Not to mention that it’s a completely different situation than the usual instances where victim blaming is both toxic and common. The only egregious victim blaming that I can think of would be saying “those whose accounts were hacked were asking for it by being on twitter”. And I hope nobody is saying that. I have a feeling that a vast majority would agree that choosing to send your money to a celebrity’s (apparent) bitcoin wallet for any reason will be tough to feel victim-sympathy for, and possibly asking to never see that money again given all of the well regulated systems and norms of money transfer that we have used for decades to centuries. But I understand that they were still taken advantage of and agree that they are victims. Twitter is to blame here. The only thing they are a victim of is failing to protect their users (whom they have the obligation to protect) in a game where they have the ability to be solely the masters of their own security destiny.
Green_man 6y ago
Twitter controls a platform that they profit from. They have a clear responsibility to make their platform harder to abuse. We can't simplify the "victim" as simply Twitter itself, we must (as you did) consider the other victims: the owners of the accounts that were hacked, the narrow user base of twitter that was conned, or the general user base that have lost trust in the platform. These users could have great security discipline on their own accounts, but they couldn't do anything about holes in Twitter's backend. Other comments have mentioned front door locks for the metaphor of reasonable responsibility, but in the perspective of the Twitter users themselves, the broken lock was one they didn't control. Twitter must do better in the future, and whether or not legislation is passed to pass culpability, the general public will respond to future lapses in security.
madaxe_again 6y ago
No, twitter is the perpetrator here, by having woefully inadequate systems. The kid is the victim, of his own hubris, and of twitter freely leaking customer information to anyone who asks for it. I used to be CTO of an ecommerce platform - small fry, barely £1bn in annual transactions - but it was always absolutely clear in my mind that any breach would be my fault through negligence.
edf13 6y ago
It isn’t victim-blaming, it’s expecting Twitter to have relative safeguards in place and not have relative open doors to allow one person access to world leading accounts!
kelnos 6y ago
> you're victim-blaming. Twitter is not the victim here; the users who had their accounts taken over are. Twitter did not lose anything, except an entirely reasonable loss of reputation, because they could have taken measures to prevent this sort of thing from happening, but did not. Companies need to be held accountable for their breaches. Sure, sometimes a company did do everything they could to prevent a breach, and took steps to mitigate the damage in the event of a breach, and they still happen. But that is vanishingly rare. The main thing I've learned from all the breach disclosures (at least where companies are truthful and forthcoming about what happened) is that security practices are lax and insufficient pretty much everywhere. That's not ok, and we need to do something to incentivize these companies to properly protect our data, before we all become victims. If financial sanctions and public shaming is the best way to do that, so be it.
TwoBit 6y ago
The fact that Twitter had a system in which any of thousands of employees at all levels could single-handedly with no oversight alter any of the information in any account shows this was absolutely Twitter's fault.
ramblerman 6y ago
> but you're victim-blaming. Twitter wasn't 'asking for it' It's a bit pathetic to extend this rape analogy to a business. We don't hold individuals and corporations to the same legal, and/or quality standards. So, hopefully we can discuss these important policy issues without worrying if "twitters" feelings get hurt.
partyboat1586 6y ago
Victim blaming is for when people have been psychology abused. It doesn't apply here.
senorjazz 6y ago
> victim-blaming. sometimes the victim deserves some blame.Or at least their actions analysed to see where blame lays

by nickff 6y ago

rschneid 6y ago

Twitter is a platform used widely by some of the most powerful people in the world and in the US government. As a result, there is plenty of justification and precedent for said gov't to regulate their security practices and procedures. To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http. Now, I don't think the government is prepared to do this proactively and effectively, but the idea of a telco that advertises resilience to hacks (whether through social engineering or technical incompetence) sounds like it would be quite appealing to a growing segment of the connected world and whatever such promises that find success in the marketplace might be used to inform legislation or regulation, eventually...

saghm 6y ago
> To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http This is probably off-topic, but companies shouldn't even be sending the passwords over HTTPS; passwords should be hashed client-side and then the hash should be sent to the server (preferably over HTTPS).
- ribosometronome 6y ago
  Wouldn't that allow for a compromised database to leak the information a nefarious user needs to log into accounts? Compared to needing to find a collision if a database of hashes leaked?
  - nicoburns 6y ago
    I think client-side password hashing is generally in addition to server-side hashing. Not instead of it.
- helsinkiandrew 6y ago
  Can you elaborate on how this makes things more secure (assuming HTTPS) Surely if the server accepts a client side hash of a password, then the hash has become the password
  - namibj 6y ago
    At that point you can do key derivation to get an ed25519 private key from the password and a server-supplied salt (specific to that user), after which the client signs a challenge the server supplied with that private key. When the password was set/changed, the corresponding public key was stored on the server.
  - mewpmewp2 6y ago
    Off the top of my mind. Maybe it could be something like that: 1. Api gives user a fixed salt. 2. User types password into input. 3. Client hashes and sends hash to server. 4. Server has another salt and uses the client sent hash to hash it again. 5. This final hash is compared what is in the database. This way server never has knowledge of the original PW and it's never sent over the network. This reduces for instance the chance of password getting logged in the service etc.
    - helsinkiandrew 6y ago
      But in that case the hash sent to the server in stage 3 is always the same and behaves like a password - capture it and you can use it again elsewhere.

slg 6y ago

The push against "victim blaming" is not about removing any possible role a victim would have in their victimhood. It is about destigmatizing victimhood and not blaming victims for things that are out of their control or that any other reasonable person would do. Let's imagine a situation in which someone breaks into my house and steals my TV. I deserve a decent amount of blame if I left my front door wide open before it happened. I deserve much less blame, but still some blame if I left my front door unlocked. I don't deserve any blame if someone broke down my front door to do it. In this situation, Twitter left their front door unlocked. Furthermore, Twitter is not even the primary victim here. The biggest victims are the people whose accounts were stolen and the people who were tricked into losing their bitcoin.

saurik 6y ago
> I don't deserve any blame if someone broke down my front door to do it. I mean, you could have gotten a more sturdy door... drawing the boundary between someone opening an unlocked door and breaking down the door is hard; so I'd agree with "even less blame", but if we believe you are ever at blame here, there isn't anything magical about the lock that shifts you from having blame to being blameless.
- slg 6y ago
  To repeat myself, the opposition to victim blaming is about "not blaming victims for things that are out of their control or that any other reasonable person would do." I acknowledged that a standard lock is generally not going to stop many determined criminals, but it is an acceptable baseline that all reasonable people can be expected to meet in order to help prevent their home from being burgled. You can of course go above and beyond that, but I think anyone who meets that baseline standard doesn't deserve blame. Back on topic, I think lots of people would agree that allowing low level employees the ability to completely hijack the accounts of some of the most prominent people on the planet with zero oversight is not a reasonable level of security.
  - deleted 6y ago
    [deleted]

ksm1717 6y ago

While the words do sound like victim blaming, id argue that sweeping conclusions that sound like the common rhetoric like “victims can do no wrong” deserve both careful consideration and some wiggle room. Not to mention that it’s a completely different situation than the usual instances where victim blaming is both toxic and common. The only egregious victim blaming that I can think of would be saying “those whose accounts were hacked were asking for it by being on twitter”. And I hope nobody is saying that. I have a feeling that a vast majority would agree that choosing to send your money to a celebrity’s (apparent) bitcoin wallet for any reason will be tough to feel victim-sympathy for, and possibly asking to never see that money again given all of the well regulated systems and norms of money transfer that we have used for decades to centuries. But I understand that they were still taken advantage of and agree that they are victims. Twitter is to blame here. The only thing they are a victim of is failing to protect their users (whom they have the obligation to protect) in a game where they have the ability to be solely the masters of their own security destiny.

Green_man 6y ago

Twitter controls a platform that they profit from. They have a clear responsibility to make their platform harder to abuse. We can't simplify the "victim" as simply Twitter itself, we must (as you did) consider the other victims: the owners of the accounts that were hacked, the narrow user base of twitter that was conned, or the general user base that have lost trust in the platform. These users could have great security discipline on their own accounts, but they couldn't do anything about holes in Twitter's backend. Other comments have mentioned front door locks for the metaphor of reasonable responsibility, but in the perspective of the Twitter users themselves, the broken lock was one they didn't control. Twitter must do better in the future, and whether or not legislation is passed to pass culpability, the general public will respond to future lapses in security.

madaxe_again 6y ago

No, twitter is the perpetrator here, by having woefully inadequate systems. The kid is the victim, of his own hubris, and of twitter freely leaking customer information to anyone who asks for it. I used to be CTO of an ecommerce platform - small fry, barely £1bn in annual transactions - but it was always absolutely clear in my mind that any breach would be my fault through negligence.

edf13 6y ago

It isn’t victim-blaming, it’s expecting Twitter to have relative safeguards in place and not have relative open doors to allow one person access to world leading accounts!

kelnos 6y ago

> you're victim-blaming. Twitter is not the victim here; the users who had their accounts taken over are. Twitter did not lose anything, except an entirely reasonable loss of reputation, because they could have taken measures to prevent this sort of thing from happening, but did not. Companies need to be held accountable for their breaches. Sure, sometimes a company did do everything they could to prevent a breach, and took steps to mitigate the damage in the event of a breach, and they still happen. But that is vanishingly rare. The main thing I've learned from all the breach disclosures (at least where companies are truthful and forthcoming about what happened) is that security practices are lax and insufficient pretty much everywhere. That's not ok, and we need to do something to incentivize these companies to properly protect our data, before we all become victims. If financial sanctions and public shaming is the best way to do that, so be it.

TwoBit 6y ago

The fact that Twitter had a system in which any of thousands of employees at all levels could single-handedly with no oversight alter any of the information in any account shows this was absolutely Twitter's fault.

ramblerman 6y ago

> but you're victim-blaming. Twitter wasn't 'asking for it' It's a bit pathetic to extend this rape analogy to a business. We don't hold individuals and corporations to the same legal, and/or quality standards. So, hopefully we can discuss these important policy issues without worrying if "twitters" feelings get hurt.

partyboat1586 6y ago

Victim blaming is for when people have been psychology abused. It doesn't apply here.

senorjazz 6y ago

> victim-blaming. sometimes the victim deserves some blame.Or at least their actions analysed to see where blame lays