6 ms·

I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way

by robryan 15y ago

I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way there is some warning.

Mithrandir 15y ago
If the person/people who did this just wanted to expose security flaws, releasing a DB filled with innocent people's personal information is really over the top.
dandelany 15y ago
You're kidding, right? The people releasing it are presumably the ones who stole it in the first place. In a bank robbery, do you blame the manufacturer of the safe that was cracked? Or home invasions on the alarm system that failed to catch the thieves? No, the perpetrators of the crime are at fault. Even if I agreed with you on who was at fault here (which I clearly don't), do you think any significant number of victims of this leak will honestly blame Stratfor more than they blame the hackers behind the attack? If not, the point I made above still stands: Anonymous has alienated anyone who has ever paid for a Stratfor membership. Which is quite a diverse, and likely intelligent, group of people.
- joshAg 15y ago
  To continue using your metaphor of a real world safe: I also blame the manufacturer of the safe because the safe was not as secure as they claimed and because it's not like securing things correctly is an unsolved problem or even just np-hard. information can be stolen more than once, and if it can be stolen by these people, then you can damn well bet that it can be stolen by people who might not want to let you know that they took the information. how long has that data been sitting there unsecured? how many times has that data been stolen through unauthorized access? is it even reasonable to ask to be able to run a pen test against anyone who wants my information, so that i can actually know my data is secure?
  - sambeau 15y ago
    In what way is this any different than someone picking the lock to the front door of your house, smashing things up with a baseball bat, carrying your valuables out to the street and then leaving you a note saying "you should have bought a better lock"? I'd far rather live in a world where we didn't need the lock in the first place.
    - joshAg 15y ago
      it's not. the issue (for me) is how valuable the valuables are and how much security is protecting the valuables. There's a good reason why there's a major difference between the security protecting the mona lisa and the security protecting my car, even though both are secured and both are valuable. when people under-secure assests that they claim to be securing, especially when those assets aren't theirs, I think they're partially to blame when the assets are eventually stolen. I'm blaming stratfor because i think they did a shitty job securing their customers' info, especially since the info belonged to paying customers.
  - nl 15y ago
    not like securing things correctly is an unsolved problem or even just np-hard. Given that Google, RSA and Intel have all been penetrated (that we know about), and all have a passing knowledge of security I think this has turned out to be harder than you seem to think it is.
    - joshAg 15y ago
      I didn't say it was easy; it's usually pretty hard/expensive to do it right. But there are known best practices, and it looks like those weren't followed (at the very least, have a good password policy and salt the goddammed passwords before hashing). here are two examples of companies doing security right: [1] http://blog.lastpass.com/2011/05/lastpass-security-notification.html http://blog.lastpass.com/2011/05/lastpass-security-notificat... [2] http://arstechnica.com/gaming/news/2011/11/valve-confirms-steam-hack-credit-cards-personal-info-may-be-stolen.ars http://arstechnica.com/gaming/news/2011/11/valve-confirms-st...
  - 15y ago
- rbanffy 15y ago
  I don't think the leak of the password hashes is that serious. Sh*t happens. What I find inexcusable 1) the hashes being weak and not salted (I couldn't confirm that - and yes, I downloaded the data) and 2) the leak of credit card data, billing addresses and other personal info. That information should never, ever, under no circumstances, be accessible.
  - ballard 15y ago
    http://www.braintreepayments.com/services/pci-compliance http://www.braintreepayments.com/services/pci-compliance Basically, PCI is huge pain to do correctly (multiple snort boxen, logging, change control audit environment, etc.). This is why using a payment gateway to store all customer payment data makes sense. They are responsible for taking on the enormous security burden and doing it well. PCI compliance or not, security is the ol' cat and mouse gambit. This is however NO excuse for not ensuring customer data is protected by every clever means possible.
TheCowboy 15y ago
My information was released without warning. They dumped everything days ago. They could have informed Stratfor about the vulnerability, or even waited to give people a chance to cancel their cards. Stratfor probably is to blame for lax security. But the hackers are as much to blame for violating my privacy. I think Dan's point about alienating the wrong people by picking the wrong battles is the most important. Treating innocent people as 'collateral damage' is dehumanizing. Edit for zobzu: They posted everything days ago. My post contains none of the implied strawmen you assume. I believe we're on the same side, so I'm not sure why you are flaming me. You didn't address anything I said in my post. Please review the guidelines so we can keep the discussion civil and useful: http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html
- zobzu 15y ago
  Actually they warned people a few days ago. But yeah, I agree with you, you're much better off when people hack those accounts, steal the money and not do tell anybody, so they can keep stealing from it from time to time, and since you don't know about it, you're secure! Plus I guess it's only ok to see collateral damage when it's poor people getting killed by the army in other countries, on TV. Cause yeah it's TV. Feel sad for 2 min and go grab a coffee. Heck in this war all you have to do is switch credit card. Not switch a leg for a plastic one. Oh I know this is not going to be popular.
  - tomjen3 15y ago
    Nice troll.
- robryan 15y ago
  Yeah I agree they haven't take the best form of action which would be to email everyone in the dataset and give them a chance to change their credit card without giving out the whole set. At the same time though this is a better outcome than the information being silently sold.

by robryan 15y ago

I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way there is some warning.

Mithrandir 15y ago

If the person/people who did this just wanted to expose security flaws, releasing a DB filled with innocent people's personal information is really over the top.

dandelany 15y ago

You're kidding, right? The people releasing it are presumably the ones who stole it in the first place. In a bank robbery, do you blame the manufacturer of the safe that was cracked? Or home invasions on the alarm system that failed to catch the thieves? No, the perpetrators of the crime are at fault. Even if I agreed with you on who was at fault here (which I clearly don't), do you think any significant number of victims of this leak will honestly blame Stratfor more than they blame the hackers behind the attack? If not, the point I made above still stands: Anonymous has alienated anyone who has ever paid for a Stratfor membership. Which is quite a diverse, and likely intelligent, group of people.

joshAg 15y ago
To continue using your metaphor of a real world safe: I also blame the manufacturer of the safe because the safe was not as secure as they claimed and because it's not like securing things correctly is an unsolved problem or even just np-hard. information can be stolen more than once, and if it can be stolen by these people, then you can damn well bet that it can be stolen by people who might not want to let you know that they took the information. how long has that data been sitting there unsecured? how many times has that data been stolen through unauthorized access? is it even reasonable to ask to be able to run a pen test against anyone who wants my information, so that i can actually know my data is secure?
- sambeau 15y ago
  In what way is this any different than someone picking the lock to the front door of your house, smashing things up with a baseball bat, carrying your valuables out to the street and then leaving you a note saying "you should have bought a better lock"? I'd far rather live in a world where we didn't need the lock in the first place.
  - joshAg 15y ago
    it's not. the issue (for me) is how valuable the valuables are and how much security is protecting the valuables. There's a good reason why there's a major difference between the security protecting the mona lisa and the security protecting my car, even though both are secured and both are valuable. when people under-secure assests that they claim to be securing, especially when those assets aren't theirs, I think they're partially to blame when the assets are eventually stolen. I'm blaming stratfor because i think they did a shitty job securing their customers' info, especially since the info belonged to paying customers.
- nl 15y ago
  not like securing things correctly is an unsolved problem or even just np-hard. Given that Google, RSA and Intel have all been penetrated (that we know about), and all have a passing knowledge of security I think this has turned out to be harder than you seem to think it is.
  - joshAg 15y ago
    I didn't say it was easy; it's usually pretty hard/expensive to do it right. But there are known best practices, and it looks like those weren't followed (at the very least, have a good password policy and salt the goddammed passwords before hashing). here are two examples of companies doing security right: [1] http://blog.lastpass.com/2011/05/lastpass-security-notification.html http://blog.lastpass.com/2011/05/lastpass-security-notificat... [2] http://arstechnica.com/gaming/news/2011/11/valve-confirms-steam-hack-credit-cards-personal-info-may-be-stolen.ars http://arstechnica.com/gaming/news/2011/11/valve-confirms-st...
- 15y ago
rbanffy 15y ago
I don't think the leak of the password hashes is that serious. Sh*t happens. What I find inexcusable 1) the hashes being weak and not salted (I couldn't confirm that - and yes, I downloaded the data) and 2) the leak of credit card data, billing addresses and other personal info. That information should never, ever, under no circumstances, be accessible.
- ballard 15y ago
  http://www.braintreepayments.com/services/pci-compliance http://www.braintreepayments.com/services/pci-compliance Basically, PCI is huge pain to do correctly (multiple snort boxen, logging, change control audit environment, etc.). This is why using a payment gateway to store all customer payment data makes sense. They are responsible for taking on the enormous security burden and doing it well. PCI compliance or not, security is the ol' cat and mouse gambit. This is however NO excuse for not ensuring customer data is protected by every clever means possible.

TheCowboy 15y ago

My information was released without warning. They dumped everything days ago. They could have informed Stratfor about the vulnerability, or even waited to give people a chance to cancel their cards. Stratfor probably is to blame for lax security. But the hackers are as much to blame for violating my privacy. I think Dan's point about alienating the wrong people by picking the wrong battles is the most important. Treating innocent people as 'collateral damage' is dehumanizing. Edit for zobzu: They posted everything days ago. My post contains none of the implied strawmen you assume. I believe we're on the same side, so I'm not sure why you are flaming me. You didn't address anything I said in my post. Please review the guidelines so we can keep the discussion civil and useful: http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html

zobzu 15y ago
Actually they warned people a few days ago. But yeah, I agree with you, you're much better off when people hack those accounts, steal the money and not do tell anybody, so they can keep stealing from it from time to time, and since you don't know about it, you're secure! Plus I guess it's only ok to see collateral damage when it's poor people getting killed by the army in other countries, on TV. Cause yeah it's TV. Feel sad for 2 min and go grab a coffee. Heck in this war all you have to do is switch credit card. Not switch a leg for a plastic one. Oh I know this is not going to be popular.
- tomjen3 15y ago
  Nice troll.
robryan 15y ago
Yeah I agree they haven't take the best form of action which would be to email everyone in the dataset and give them a chance to change their credit card without giving out the whole set. At the same time though this is a better outcome than the information being silently sold.