4 ms·
Requiring businesses to file breach notifications over credential stuffing attacks seems completely insane to me. What's next? Breach notifications over phishin
by gggggg5 4y ago
Requiring businesses to file breach notifications over credential stuffing attacks seems completely insane to me. What's next? Breach notifications over phishing campaigns?
Perhaps the goal is to render breach notifications useless by flooding them with nonsense like this?
- RhodesianHunter 4y agoWhat's insane is thinking that a bank that handles people's money shouldn't be required to report a coordinated successful attack, regardless of whether their technology is at fault.
- gggggg5 4y agoThere are thousands of coordinated successful phishing campaigns going on against Paypal every day, what value would that reporting provide to anyone?
- prophesi 4y agoIf all it takes is someone to download one of the countless publicly-available-on-github plaintext password compilations and automate login attempts to require a company to file a breach notification, I think all of the top services in the world would have to file one every hour.