4 ms·
The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker". >If a company leaves data
by FDSGSG 6y ago
The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker".
>If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable.
Is it "theft" if you leave your keys in your car and I take it?
- strogonoff 6y agoIMO the “car with keys inside” analogy is not great for poorly implemented infosec. The latter is both more benign (no physical property directly stolen) and at the same time worse (the scale means multitudes of people will become vulnerable to further attacks, identity theft, doxxing and so on, rather than just one person losing the means of movement). It’s just different qualitatively. What should have impact on how we view the actions of a hacker is the context of said actions, not just the “hacking” part. If the hacker exploited company’s infosec negligence to profit in some way (say, by selling the data), or irresponsibly disclosed the data or the vulnerability possibly causing harm to affected users, it is one thing. Otherwise, the same sequence of hacker’s actions that exploits the vulnerability does not compare to stealing a car with keys inside—it is (another faulty analogy warning) more like looking at a car through some magical looking glass that highlights the keys left inside by the owner.
- sbarre 6y agoIt certainly is.. but now let's go talk to your insurance company and see how they feel about covering the loss.