4 ms·

> Adam wrote in his letter. “Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission chan

> Adam wrote in his letter. “Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission changes within the relevant period.” tsk.

650REDHAIR 6y ago
By trying to sweep it under the rug they just opened themselves up. Crazy.
beervirus 6y ago
Yeah that doesn’t make sense to me. Sales would do something like that. Legal should be erring in the opposite direction.
- jasonwatkinspdx 6y ago
  No. They don't care if customers get pwnd. They care if customers become aware of exactly how they got pwnd and launch a class action. It's shitty but entirely predictable behavior common in these situations.
  - airstrike 6y ago
    But rotating credentials would not hurt or help that alleged goal of hiding the truth from customers...
    - chrisbolt 6y ago
      “force rotation of all customer credentials” = make customers change their passwords, which is a huge red flag that would draw attention to why they were forcing that.
      - hn_throwaway_99 6y ago
        Github just recently logged out all users because they had a bug that could leak other account data into sessions. They were very transparent about why they did that, what happened, and I for one trust them more for it.
        ric2b 6y ago
        But for GitHub it was mostly a preventative measure, while for Ubiquity, regardless of how transparent they were, it would look really bad. Of course it looks even worse now that we know they didn't do anything to help customers.
  - beervirus 6y ago
    Well you’re right that it’s not their job to represent customers. Their client is the company. But telling your client to sweep something like this under the rug isn’t exactly great advice.
Google234 6y ago
This actually seems like criminal advice.
- mywittyname 6y ago
  It's probably considered Consciousness of Guilt.
fuzzylightbulb 6y ago
So hackers breached the network and still might have been present. Having everyone reset their passwords at that time is the LAST thing you want to do, as the hackers could have just collected all the fresh credentials, a significant percentage of which are also used for other services because users are users. Legal made the right decision. You clean up the internals, close the backdoors, and then you notify/refresh user credentials.

650REDHAIR 6y ago

By trying to sweep it under the rug they just opened themselves up. Crazy.

beervirus 6y ago

Yeah that doesn’t make sense to me. Sales would do something like that. Legal should be erring in the opposite direction.

jasonwatkinspdx 6y ago
No. They don't care if customers get pwnd. They care if customers become aware of exactly how they got pwnd and launch a class action. It's shitty but entirely predictable behavior common in these situations.
- airstrike 6y ago
  But rotating credentials would not hurt or help that alleged goal of hiding the truth from customers...
  - chrisbolt 6y ago
    “force rotation of all customer credentials” = make customers change their passwords, which is a huge red flag that would draw attention to why they were forcing that.
    - hn_throwaway_99 6y ago
      Github just recently logged out all users because they had a bug that could leak other account data into sessions. They were very transparent about why they did that, what happened, and I for one trust them more for it.
      - ric2b 6y ago
        But for GitHub it was mostly a preventative measure, while for Ubiquity, regardless of how transparent they were, it would look really bad. Of course it looks even worse now that we know they didn't do anything to help customers.
- beervirus 6y ago
  Well you’re right that it’s not their job to represent customers. Their client is the company. But telling your client to sweep something like this under the rug isn’t exactly great advice.

Google234 6y ago

This actually seems like criminal advice.

mywittyname 6y ago
It's probably considered Consciousness of Guilt.

fuzzylightbulb 6y ago

So hackers breached the network and still might have been present. Having everyone reset their passwords at that time is the LAST thing you want to do, as the hackers could have just collected all the fresh credentials, a significant percentage of which are also used for other services because users are users. Legal made the right decision. You clean up the internals, close the backdoors, and then you notify/refresh user credentials.