3 ms·

I think it's strange HN sees cyber crime in the opposite way as real crime. It's not my fault if my house gets broken in. I have no obligation to meticulously

I think it's strange HN sees cyber crime in the opposite way as real crime. It's not my fault if my house gets broken in. I have no obligation to meticulously lock all my doors and windows when I leave. But if I get hacked, it's my fault. The onus is on the individual / company to maintain law and order themselves when online. That feels wrong to me.

nwiswell 4y ago
Prima facie it is wrong because it's victim blaming. But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to leave your front door unlocked. Legally, we do assign fault for negligence. If absentmindedly leave your kitchen tap open with the drain stopped and then go on vacation, your flood insurance is probably not going to pay for repairs, even if you didn't deserve to have your house destroyed. From a policy perspective, I think the most appropriate thing would be a middle ground. It is good for everyone's peace of mind to be sure that your entire bank balance won't vanish without recourse, but if you leave your banking "front door" unlocked, the bank covers 90% of the actual unrecoverable loss, but you're on the hook for the other 10%. That eliminates perverse incentives to use weak passwords without being cruel to victims.
- to11mtm 4y ago
  > But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to leave your front door unlocked. I'd argue it's not quite the same... using weak passwords is more like using a lock that can be 'raked'; your security is just lax. Re-using passwords is like using the same key for your front door, back door, garage, car... If someone finds it and makes a copy of it, they have full access. Compromised passwords, it's when you know a key is lost or stolen and you don't re-key. > From a policy perspective, I think the most appropriate thing would be a middle ground. It is good for everyone's peace of mind to be sure that your entire bank balance won't vanish without recourse, but if you leave your banking "front door" unlocked, the bank covers 90% of the actual unrecoverable loss, but you're on the hook for the other 10%. That eliminates perverse incentives to use weak passwords without being cruel to victims. Both of my main financial institutions have 'pretty dang good' security measures on one level or another. One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) The other does not have forced password changes but I know their internal security is... pretty crazy. Losing your badge 3 times is enough to get you fired, and any contractors who do work must be under a very specific specification of video surveillance while working with their clients.
  - clcaev 4y ago
    > One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) Forcing password changes reduces overall security, especially for infrequently accessed services. It only normalizes the reset workflow, and enables easier social engineering. The NIST standard (800-53?) was updated to reflect this reality, and it no longer requires periodic password rotation.
    - rdtwo 4y ago
      Yeah not forcing password changes allows having a unique bank only password and reduces temptation to reuse
- secabeen 4y ago
  > Legally, we do assign fault for negligence. If absentmindedly leave your kitchen tap open with the drain stopped and then go on vacation, your flood insurance is probably not going to pay for repairs, even if you didn't deserve to have your house destroyed. This is not generally true. Insurers are forbidden to pay out claims for intentional bad acts, or fraud, but ordinary negligence is usually covered: > The good thing is your homeowner's policy usually covers you and your family's negligent behavior no matter where it happens. https://www.nolo.com/legal-encyclopedia/does-my-homeowners-insurance-cover-accidents-that-occur-off-my-property.html https://www.nolo.com/legal-encyclopedia/does-my-homeowners-i...
ClumsyPilot 4y ago
There is a vital difference with companies getting hacked. I know I might get robbed at any time, maybe I don't lock my door, thats why I put my money in a bank. The bank has one job - to keep my money safe. If they have no guards andleave the door open, yes, it is their fault. If you are not prepared to keep armed guards money safe, then you shouldn't be taking other people's money. Similarly, companies that cannot keep data safe shouldn't be storing my data in the first place.
- dahfizz 4y ago
  It becomes a question of negligence / due diligence. If a bank has zero physical security measures and leaves the money out in the open, that is negligent. But, even if a bank has all the state of the art, "best practices" physical security measures, they can still be robbed. No bank is going to stop a nation-state army attacking them, for example. I think the same is true of cyber security. Nothing will ever be 100% secure. The question is whether the company has followed reasonable best practices and due diligence. Everything else is up to the government to maintain law and order. > companies that cannot keep data safe shouldn't be storing my data in the first place. If you're expecting absolute safety, either physically or electronically, there is nowhere in the universe you could deposit your money. Otherwise, the FDIC already has regulations in place to make sure banks are reasonably secure.
  - rdtwo 4y ago
    Most banks are borderline negligent in cyber security. Using 2fa via text is less secure in many ways than using a regular old password. At least it’s my fault if I compromised my bank password. A Sim swap attack can’t really be protected against
bluGill 4y ago
Ever been to a bad neighborhood? Notice all the stores have iron bars on the windows? Sure it isn't your fault if your house gets broken in, but you should still lock your door. The more risk you are of your house being broken in the more precaution you should take. Right now odds are very high that someone will attempt some form of cyber crime against you. As such you should be taking precautions to prevent it. It won't be your fault if it happens, but it will still ruin you day, and may cost you a lot anyway.
- rdtwo 4y ago
  Except with bank security it’s like there is a local ordinance that you can’t put bars on and must use a really weak door.
shadowgovt 4y ago
A lot of HN culture is old 'net culture. On the old 'net, people had to take personal responsibility for their own data-house because neither law nor enforcement had caught up yet to the notion of having a system intruded upon. Remember, we had to pass laws to make "unauthorized access" illegal in the same sense trespassing is; before that, it was just "some signals a stranger beeps at your machine could cause it to malfunction or to send signals back they could interpret as your bank account number. If you don't want that, harden your system against malfunction." Nowadays, society has caught up but some people with an old-guard mindset still see someone get their stuff stolen and go "Well, should have locked your doors; only way to guarantee your stuff is safe."
im3w1l 4y ago
We say it's your own fault because it would be so hard to lock up all the hackers. Can't just send a swat team to China, Russia, North Korea etc.
jart 4y ago
These people aren't being hacked though. They're being scammed. They chose to give their money and mfa codes to a stranger who promised them nothing in exchange, and ended up regretting it. It makes things more of a grey area because banks should do what what we tell them to do with our money, and it's really not their job to take a paternalistic stance and judge if your authorized financial choices are stupid or not. How do you draw the line? What if someone wants to buy penny stocks? Should the bank reimburse them?
- miohtama 4y ago
  Also there is an element of friendly fraud. You say you were scammed in fact when you were justing laundering the money through your friend. The bank pays you back for “fraud” and now you have doubled your money. “Our research suggests that friendly fraud will represent 61% of all chargebacks by 2023.”
  - deleted 4y ago
    [deleted]
tcmart14 4y ago
Definitely, my experience and opinion doesn't boil down to all HN, but here is my take. A lot of hacks, the reports after suggest they were ignoring industry best practices that were relatively easy to implement and cheap. Here, I would point the blame. But for sure, if the hack was routed in some crazy new route to exploit software, you just can't protect against, so I wouldnt be so quick to assign blame. But I think another key different is, infrastructure is owned by companies who have engineers and IT whose job it is to run it securely. I think the proper equivalent for the home analogy is, you have an alarm system that was turned on, but didn't alarm when someone broke in. But then we would place the fault on ADT or Simplisafe or whoever.

nwiswell 4y ago

Prima facie it is wrong because it's victim blaming. But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to leave your front door unlocked. Legally, we do assign fault for negligence. If absentmindedly leave your kitchen tap open with the drain stopped and then go on vacation, your flood insurance is probably not going to pay for repairs, even if you didn't deserve to have your house destroyed. From a policy perspective, I think the most appropriate thing would be a middle ground. It is good for everyone's peace of mind to be sure that your entire bank balance won't vanish without recourse, but if you leave your banking "front door" unlocked, the bank covers 90% of the actual unrecoverable loss, but you're on the hook for the other 10%. That eliminates perverse incentives to use weak passwords without being cruel to victims.

to11mtm 4y ago
> But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to leave your front door unlocked. I'd argue it's not quite the same... using weak passwords is more like using a lock that can be 'raked'; your security is just lax. Re-using passwords is like using the same key for your front door, back door, garage, car... If someone finds it and makes a copy of it, they have full access. Compromised passwords, it's when you know a key is lost or stolen and you don't re-key. > From a policy perspective, I think the most appropriate thing would be a middle ground. It is good for everyone's peace of mind to be sure that your entire bank balance won't vanish without recourse, but if you leave your banking "front door" unlocked, the bank covers 90% of the actual unrecoverable loss, but you're on the hook for the other 10%. That eliminates perverse incentives to use weak passwords without being cruel to victims. Both of my main financial institutions have 'pretty dang good' security measures on one level or another. One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) The other does not have forced password changes but I know their internal security is... pretty crazy. Losing your badge 3 times is enough to get you fired, and any contractors who do work must be under a very specific specification of video surveillance while working with their clients.
- clcaev 4y ago
  > One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) Forcing password changes reduces overall security, especially for infrequently accessed services. It only normalizes the reset workflow, and enables easier social engineering. The NIST standard (800-53?) was updated to reflect this reality, and it no longer requires periodic password rotation.
  - rdtwo 4y ago
    Yeah not forcing password changes allows having a unique bank only password and reduces temptation to reuse
secabeen 4y ago
> Legally, we do assign fault for negligence. If absentmindedly leave your kitchen tap open with the drain stopped and then go on vacation, your flood insurance is probably not going to pay for repairs, even if you didn't deserve to have your house destroyed. This is not generally true. Insurers are forbidden to pay out claims for intentional bad acts, or fraud, but ordinary negligence is usually covered: > The good thing is your homeowner's policy usually covers you and your family's negligent behavior no matter where it happens. https://www.nolo.com/legal-encyclopedia/does-my-homeowners-insurance-cover-accidents-that-occur-off-my-property.html https://www.nolo.com/legal-encyclopedia/does-my-homeowners-i...

ClumsyPilot 4y ago

There is a vital difference with companies getting hacked. I know I might get robbed at any time, maybe I don't lock my door, thats why I put my money in a bank. The bank has one job - to keep my money safe. If they have no guards andleave the door open, yes, it is their fault. If you are not prepared to keep armed guards money safe, then you shouldn't be taking other people's money. Similarly, companies that cannot keep data safe shouldn't be storing my data in the first place.

dahfizz 4y ago
It becomes a question of negligence / due diligence. If a bank has zero physical security measures and leaves the money out in the open, that is negligent. But, even if a bank has all the state of the art, "best practices" physical security measures, they can still be robbed. No bank is going to stop a nation-state army attacking them, for example. I think the same is true of cyber security. Nothing will ever be 100% secure. The question is whether the company has followed reasonable best practices and due diligence. Everything else is up to the government to maintain law and order. > companies that cannot keep data safe shouldn't be storing my data in the first place. If you're expecting absolute safety, either physically or electronically, there is nowhere in the universe you could deposit your money. Otherwise, the FDIC already has regulations in place to make sure banks are reasonably secure.
- rdtwo 4y ago
  Most banks are borderline negligent in cyber security. Using 2fa via text is less secure in many ways than using a regular old password. At least it’s my fault if I compromised my bank password. A Sim swap attack can’t really be protected against

bluGill 4y ago

Ever been to a bad neighborhood? Notice all the stores have iron bars on the windows? Sure it isn't your fault if your house gets broken in, but you should still lock your door. The more risk you are of your house being broken in the more precaution you should take. Right now odds are very high that someone will attempt some form of cyber crime against you. As such you should be taking precautions to prevent it. It won't be your fault if it happens, but it will still ruin you day, and may cost you a lot anyway.

rdtwo 4y ago
Except with bank security it’s like there is a local ordinance that you can’t put bars on and must use a really weak door.

shadowgovt 4y ago

A lot of HN culture is old 'net culture. On the old 'net, people had to take personal responsibility for their own data-house because neither law nor enforcement had caught up yet to the notion of having a system intruded upon. Remember, we had to pass laws to make "unauthorized access" illegal in the same sense trespassing is; before that, it was just "some signals a stranger beeps at your machine could cause it to malfunction or to send signals back they could interpret as your bank account number. If you don't want that, harden your system against malfunction." Nowadays, society has caught up but some people with an old-guard mindset still see someone get their stuff stolen and go "Well, should have locked your doors; only way to guarantee your stuff is safe."

im3w1l 4y ago

We say it's your own fault because it would be so hard to lock up all the hackers. Can't just send a swat team to China, Russia, North Korea etc.

jart 4y ago

These people aren't being hacked though. They're being scammed. They chose to give their money and mfa codes to a stranger who promised them nothing in exchange, and ended up regretting it. It makes things more of a grey area because banks should do what what we tell them to do with our money, and it's really not their job to take a paternalistic stance and judge if your authorized financial choices are stupid or not. How do you draw the line? What if someone wants to buy penny stocks? Should the bank reimburse them?

miohtama 4y ago
Also there is an element of friendly fraud. You say you were scammed in fact when you were justing laundering the money through your friend. The bank pays you back for “fraud” and now you have doubled your money. “Our research suggests that friendly fraud will represent 61% of all chargebacks by 2023.”
- deleted 4y ago
  [deleted]

tcmart14 4y ago

Definitely, my experience and opinion doesn't boil down to all HN, but here is my take. A lot of hacks, the reports after suggest they were ignoring industry best practices that were relatively easy to implement and cheap. Here, I would point the blame. But for sure, if the hack was routed in some crazy new route to exploit software, you just can't protect against, so I wouldnt be so quick to assign blame. But I think another key different is, infrastructure is owned by companies who have engineers and IT whose job it is to run it securely. I think the proper equivalent for the home analogy is, you have an alarm system that was turned on, but didn't alarm when someone broke in. But then we would place the fault on ADT or Simplisafe or whoever.