6 ms·
No specific comments to the breach... But, I couldn't help but chuckle at We Take Your Security Seriously™. Why does every company, after demonstrating a lack
by ziddoap 6y ago
No specific comments to the breach... But, I couldn't help but chuckle at We Take Your Security Seriously™.
Why does every company, after demonstrating a lack of security, like to say this exact line? I can just imagine the PR person hovering over the shoulder of whoever authored the post yelling "make sure you tell the victims of this breach that we care!"
- deleted 6y ago[deleted]
- throwaway5752 6y agoIt's impossible to secure yourself against a devoted persistent threat group over the long term. The asymmetry of effort is not tractable to overcome. So they can take your security seriously, but they will be hacked, or they have already.
- sounds 6y agoI think it is possible to secure yourself against a devoted, persistent threat group. I think it's expensive, but possible. Do you have data to back up your claim that no one, ever has ever successfully remained secure?
- not2b 6y agoNo one could possibly prove this kind of negative.
- snoshy 6y agoWhy not? All you have to do is point to one particular company whose systems have not been verifiably breached after having resisted actual attempts.
- someguydave 6y agomost attacker groups would be unlikely to share that result
- imoverclocked 6y agoChallenge accepted? Just because known attempts have failed doesn’t mean the unknown ones have too.
- WaitWaitWha 6y ago> one particular company whose systems have not been verifiably breached The unknown unknown. How can you be sure all the "resisted actual attempts" been even detected?
- deleted 6y ago[deleted]
- not2b 6y agoYou've changed the requirement. To prove a company hasn't been breached, you'd also have to prove that there hasn't been a breach that hasn't been detected (so breached, but not verified). Any given target might already be quietly owned by some state actor or corrupt insider with allies on the outside.
- justinclift 6y agoSeveral places probably would have met those goals... ... right up until the SolarWinds hack became public. The point being, provable "we've never been breached" seems to have a way of turning out to be wrong. :/
- swirepe 6y agoMy name is Ozymandias, King of Kings; Look on my Works, ye Mighty, and despair!
- rodgerd 6y agoWhat evidence do you have that anyone has?
- ikiris 6y agoWhen was the last time you heard of a google user data breach?
- rodgerd 6y agohttps://www.forbes.com/sites/kateoflahertyuk/2018/10/09/google-plus-breach-what-happened-who-was-impacted-and-how-to-delete-your-account/?sh=75faf8ef6491 https://www.forbes.com/sites/kateoflahertyuk/2018/10/09/goog... https://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ https://arstechnica.com/information-technology/2013/11/googl... Maybe you should know literally anything about the topic at hand before making sweeping assertions? I realise that's asking a lot here at HN, but it would improve the site a lot.
- harrierpigeon 6y agohttps://en.wikipedia.org/wiki/2018_Google_data_breach https://en.wikipedia.org/wiki/2018_Google_data_breach https://www.express.co.uk/news/uk/1372333/Gmail-hacked-Google-down-latest-update-security-data-breach-server-error-news-vn https://www.express.co.uk/news/uk/1372333/Gmail-hacked-Googl... Not unheard of at Google, either.
- ziddoap 6y agoI don't think my post argues, or even attempts to argue, against your point. It was a light-hearted jest at the fact that this exact line is in every single breach notification I have read for the past few years. The more serious point I was alluding at was not "just don't get breached", it was that the "we care" line rings hollow after the 250th time reading it.
- throwaway5752 6y agoMy misread, apologies. I think the "we care" is a dodge around the reality that most are uncomfortable with, which is, "we make your data safe as possible but we will likely be hacked and you should compartmentalize your personal data accordingly with that expectation". But I am no good with marketing.
- pseudalopex 6y agoMost companies choose to collect data they don't have to.
- luser007 6y agoThey put all of their users eggs in one basket in the cloud. That makes for a very interesting target. They could have not done that. The users were probably unaware that their data was even placed on the cloud servers of some third party. Ubiquiti used to be cool. They've taken a nose dive in recent years in several ways: Firmware upgrade suddenly including telemetry by default, forcing people to use their NVR appliance instead of installing their software on their private servers, etc. Had Ubiquiti not moved people to "cloud solutions" an attacker would have to attack millions of peoples equipment. Now he only had to attack one providers network.
- unethical_ban 6y agoI heard rumors about the telemetry thing, but that is usually an overhyped concern - unless it is sending flow logs or something. When did they stop allowing people to use a private server for central management? I see Unifi still has a network controller.
- luser007 6y agoSorry for being obtuse - it wasn't my intention. I'm thinking of "Unifi Video" that is going out (EOL announced six months ago), where you could either buy their appliance OR download an official .deb package and install the NVR software on your own server. They replace that with "Unifi Protect" that comes ONLY as an NVR appliance. No more .deb packages. It also requires you to buy one of their other products (Cloud Key 2), IIRC.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- mirthflat83 6y agoI mean, should they say that they don’t care about your security?
- kenniskrag 6y agothey should tell me, what they are going to improve. :)
- ziddoap 6y agoWeird polar opposite stance. No, that is not what I'm saying. I'm saying don't put platitudes in a breach notification.
- kenniskrag 6y ago> That phenomenon is called counter-signaling, which I first ran into listening to Dan Jurafsky making the point that if a menu uses the word "fresh", its a low-brow restaurant. A high-brow restaurant would never use the word "fresh" -- the freshness is implicit in the other signals. https://kelley.iu.edu/riharbau/cs-randfinal.pdf https://kelley.iu.edu/riharbau/cs-randfinal.pdf source: https://news.ycombinator.com/item?id=25713050 https://news.ycombinator.com/item?id=25713050
- jiveturkey 6y agoItalian franchise[0] restaurant in Sacramento has this huge neon sign in their window: "health inspected". Neon. It's just that one instance of the store. Not that I've seen them all, but never seen that signage in their other stores. [0] Maybe not technically a franchise. Not sure. There are a bunch in California.
- MasterScrat 6y agoReminds me of a restaurant in Goa, India, which proudly advertises: "Vegetables are cleaned with clean water before use!"
- jkaplowitz 6y agoIn India and many other less developed countries, proper culinary hygiene is very far from universal, and contaminated water is common. It's less absurd of a statement than it would be in the US.
- Daho0n 6y agoWell, it might be a sign seen in a restaurant in Flint, Michigan :)
- KirillPanov 6y agoWell, it's not like Sacramento has a Ganges River...
- 6y ago
- hsbauauvhabzb 6y agoThey opted to TELL people about it which is a good indicator. I’m sure there’s many companies who choose not to (which may be against the law). It’s also HR spin on the topic, but iirc ubiquity offer bug bounties on a range of devices they sell so there’s at least some truth to the spin. ‘We know they breached but don’t know what they did’ is an interesting statement. One POV is that they didn’t have sufficient logging and segregation to determine how widespread the breach was, the other is that they’re not arrogant enough to think their SIEM adequately captures everything.
- ziddoap 6y agoI'm unsure how your statement is meant as a response to mine. I obviously agree that it is a good indicator that they notified customers of a breach.
- jlgaddis 6y ago> They opted to TELL people about it which is a good indicator. Aren't they based in California which, if I remember correctly, as a law requiring them to notify the victims of a data breach? Would they still have chosen to in the absence of such a law? We'll never know, I guess.
- jiveturkey 6y agoThe real genius in the announcement is, "data hosted by a third party provider". Absolutely irrelevant, but subtly implying that the error was the fault of a third party. That will be the new norm in these kinds of annoucements, I'm sure. Just like SolarWinds dropping "Team City", saying "no evidence" of a breach of it. So why mention it at all?
- BHSPitMonkey 6y agoIt rolls off the tongue better than "We now wish to begin taking your security seriously"
- dreamcompiler 6y agoI'm sure it's also the case that your call is important to them. Isn't that what companies always say while making you wait on hold for 45 minutes?
- aksss 6y agoAlong with the stock, “due to COVID-19, our service sucks right now”.
- rawoke083600 6y ago"make sure you tell the victims of this breach that we care!" HAHA ! Too True ! Reminds me of getting "punished" as a child... Parent: "Now remember this will hurt me more than it will hurt you" PS. No child were abused in the making of the above comment. My parents were/is excellent !