3 ms·

> Just wanted to make this same point - right now, cryptocurrency has negative value for society. Perhaps this is a justification for banning the current implem

> Just wanted to make this same point - right now, cryptocurrency has negative value for society. Perhaps this is a justification for banning the current implementations. Ehhhh, I think the overall impact of Bitcoin is negative, but the "democratizing large-scale crime" argument is a pretty poor argument for why that is. First, Bitcoin isn't "democratizing" anything good or bad--people need to stop using this word with regard to Bitcoin. But assuming you mean something along the lines of "enabling", or "empowering", I'm not sure that the shift in computer hacking crime which is caused by Bitcoin is actually negative. Prior to Bitcoin, the people who paid for poor security were consumers whose data, money, and time were stolen. In theory if an entity exposes your data, you can sue them, but in reality, data breaches are common and when entities actually get sued, they rarely pay out significantly. I've followed the Equifax case every step of the way for years and still haven't received a dime, and I doubt many people would follow through all the hoops they've put in place--I'm mostly doing it out of curiosity at this point. That still happens, but more and more, ransomware's biggest targets are large entities which should have secured their services better. Not only does ransomware punish the entities who should have prioritized security, not the consumers, it also makes it public knowledge whose security is lax. Now there are a lot of complexities here. In theory, ransomeware hackers could also sell the data--but as far as I know that doesn't happen much, probably because they rely on the "honest crook" effect to ever get paid. And sometimes ransomware is employed against individuals. And to be clear, I'm not endorsing ransomeware attacks. I'm just saying this looks like harm reduction to me: if a big business is going to not prioritize security and get hacked, then I'd rather they pay a ransom than have user's private data sold on the darkweb. In a more just system, that's just the fines they'd be paying anyway.

yyyk 6y ago
What harm reduction happens when the 'large entities' are the courts[0], municipalities[1] or even hospitals[2]? Alleged better safeguarding of our data* isn't worth it. * I suspect that right now companies find it cheaper to pay than to improve their security. [0] https://wtop.com/national/2020/05/texas-high-courts-hit-by-ransomware-attack-refuse-to-pay/ https://wtop.com/national/2020/05/texas-high-courts-hit-by-r... [1] https://www.msspalert.com/cybersecurity-research/municipality-ransomware-attacks-2019/ https://www.msspalert.com/cybersecurity-research/municipalit... [2] https://www.wwnytv.com/2020/07/28/western-ny-hospital-recounts-ransomware-experience-smc-deals-with-malware-attack/ https://www.wwnytv.com/2020/07/28/western-ny-hospital-recoun... https://edition.cnn.com/2019/10/11/us/alabama-hospital-ransomware-attack/index.html https://edition.cnn.com/2019/10/11/us/alabama-hospital-ranso...
- kerkeslager 6y ago
  > What harm reduction happens when the 'large entities' are the courts[0], municipalities[1] or even hospitals[2]? Aren't these the entities that you would most want to keep your data secure? > Alleged better safeguarding of our data* isn't worth it. > * I suspect that right now companies find it cheaper to pay than to improve their security. That makes no sense, because if you don't improve your security, you'll be hacked in the same way again. There isn't an upper bound on how much it can cost to not improve your security.
  - yyyk 6y ago
    >Aren't these the entities that you would most want to keep your data secure? I don't think the local municipality or the courts have anything I'd consider sensitive on me. Regardless, my bigger desire is for them to stay running, especially the hospitals. I'm not willing to temporarily shut some down 'for better security'. >That makes no sense, because if you don't improve your security, you'll be hacked in the same way again. There isn't an upper bound on how much it can cost to not improve your security. What actually happens is that the targets pay, and issue tougher mandates which may or may not be respected in their organization. These hacks are rare enough for now - I suspect hackers don't like to hit the same target again soon after (bigger risk of the target not paying you) - so eventually the organization slips back into same security morass they were in the first place, if they ever left it. There isn't a true desire to change. Also, there is an upper bound if you're paying insurance, like that hospital did[0]. Over the long term insurers will raise their price, but at least it's a predictable bound. [0] https://www.wwnytv.com/2020/07/28/western-ny-hospital-recounts-ransomware-experience-smc-deals-with-malware-attack/ https://www.wwnytv.com/2020/07/28/western-ny-hospital-recoun...
tsimionescu 6y ago
Even if the ransomware perpetrators aren't selling the data, do you think there is any real chance that a company that just paid millions of dollars in ransom would next go and invest more money into security? More likely, other criminals will come knocking on the same company's systems and get that data for other purposes.
- kerkeslager 6y ago
  > Even if the ransomware perpetrators aren't selling the data, do you think there is any real chance that a company that just paid millions of dollars in ransom would next go and invest more money into security? Yes. Or, they can get hacked again and pay another ransom until they learn their lesson.

yyyk 6y ago

What harm reduction happens when the 'large entities' are the courts[0], municipalities[1] or even hospitals[2]? Alleged better safeguarding of our data* isn't worth it. * I suspect that right now companies find it cheaper to pay than to improve their security. [0] https://wtop.com/national/2020/05/texas-high-courts-hit-by-ransomware-attack-refuse-to-pay/ https://wtop.com/national/2020/05/texas-high-courts-hit-by-r... [1] https://www.msspalert.com/cybersecurity-research/municipality-ransomware-attacks-2019/ https://www.msspalert.com/cybersecurity-research/municipalit... [2] https://www.wwnytv.com/2020/07/28/western-ny-hospital-recounts-ransomware-experience-smc-deals-with-malware-attack/ https://www.wwnytv.com/2020/07/28/western-ny-hospital-recoun... https://edition.cnn.com/2019/10/11/us/alabama-hospital-ransomware-attack/index.html https://edition.cnn.com/2019/10/11/us/alabama-hospital-ranso...

kerkeslager 6y ago
> What harm reduction happens when the 'large entities' are the courts[0], municipalities[1] or even hospitals[2]? Aren't these the entities that you would most want to keep your data secure? > Alleged better safeguarding of our data* isn't worth it. > * I suspect that right now companies find it cheaper to pay than to improve their security. That makes no sense, because if you don't improve your security, you'll be hacked in the same way again. There isn't an upper bound on how much it can cost to not improve your security.
- yyyk 6y ago
  >Aren't these the entities that you would most want to keep your data secure? I don't think the local municipality or the courts have anything I'd consider sensitive on me. Regardless, my bigger desire is for them to stay running, especially the hospitals. I'm not willing to temporarily shut some down 'for better security'. >That makes no sense, because if you don't improve your security, you'll be hacked in the same way again. There isn't an upper bound on how much it can cost to not improve your security. What actually happens is that the targets pay, and issue tougher mandates which may or may not be respected in their organization. These hacks are rare enough for now - I suspect hackers don't like to hit the same target again soon after (bigger risk of the target not paying you) - so eventually the organization slips back into same security morass they were in the first place, if they ever left it. There isn't a true desire to change. Also, there is an upper bound if you're paying insurance, like that hospital did[0]. Over the long term insurers will raise their price, but at least it's a predictable bound. [0] https://www.wwnytv.com/2020/07/28/western-ny-hospital-recounts-ransomware-experience-smc-deals-with-malware-attack/ https://www.wwnytv.com/2020/07/28/western-ny-hospital-recoun...

tsimionescu 6y ago

Even if the ransomware perpetrators aren't selling the data, do you think there is any real chance that a company that just paid millions of dollars in ransom would next go and invest more money into security? More likely, other criminals will come knocking on the same company's systems and get that data for other purposes.

kerkeslager 6y ago
> Even if the ransomware perpetrators aren't selling the data, do you think there is any real chance that a company that just paid millions of dollars in ransom would next go and invest more money into security? Yes. Or, they can get hacked again and pay another ransom until they learn their lesson.