3 ms·

Yet another example of someone security "testing" someone else's servers/systems without permission. That's called hacking. Doesn't matter if you have "good fai

Yet another example of someone security "testing" someone else's servers/systems without permission. That's called hacking. Doesn't matter if you have "good faith" or not. It's not your property and you don't get to access it in ways the owners don't desire you to access it without being subject to potential civil and criminal enforcement against you.

SenAnder 3y ago
Look at it from a consumer rights angle. A product is advertised as having some feature ("100% security" in this case), but nobody is allowed to test (even without causing any harm) if that is true. It's effectively legalizing fraud for a big chunk of computer security. Sure fraud itself is technically still illegal, but so is exposing it.
edwinjm 3y ago
If they don't do it, criminals will do it. I know what my preference is.
- InSteady 3y ago
  No, let's bury our heads in the sand while being sure to handicap (and treat as hostile) the only group of people who seem to care and have the expertise to do something about this giant mess we are in with regards to consumer, patient, and citizen data security.
Buttons840 3y ago
Meanwhile companies leak the private data of millions of people and nothing happens. If a curious kid does a port scan police will smash down doors. People will face decades in prison. If a negligent company leaks the private data of every single American, well, gee, what could we have done more, we had that one company do an audit and they didn't find anything and, gee, we're just really sorry, so lets all move on and here's a free year of credit monitoring which you may choose to continue paying us for at the end of the free year.
InSteady 3y ago
As a user of the site who has been falsely assured that your data is "100% secure" and totally anonymous, is that data in fact not your property? Perhaps not in a strictly legal sense, but from an ethical standpoint it is certainly more of a grey area than corporations and their lawyers would want us to roll over and accept. My understanding is that these security researchers only accessed their own accounts and data on the cloud servers, and in doing so they did not bypass any "effective technical protections on access." Thankfully for all of us, the DoJ appears to disagree with your sentiment. At least with the current administration. Is it your position is that when you are lied to, and your sensitive and personally identifying information is being grossly mishandled by a company, your only recourse is to spend thousands of dollars and incredible amounts of time on a court case that has very little chance of achieving anything?

SenAnder 3y ago

Look at it from a consumer rights angle. A product is advertised as having some feature ("100% security" in this case), but nobody is allowed to test (even without causing any harm) if that is true. It's effectively legalizing fraud for a big chunk of computer security. Sure fraud itself is technically still illegal, but so is exposing it.

edwinjm 3y ago

If they don't do it, criminals will do it. I know what my preference is.

InSteady 3y ago
No, let's bury our heads in the sand while being sure to handicap (and treat as hostile) the only group of people who seem to care and have the expertise to do something about this giant mess we are in with regards to consumer, patient, and citizen data security.

Buttons840 3y ago

Meanwhile companies leak the private data of millions of people and nothing happens. If a curious kid does a port scan police will smash down doors. People will face decades in prison. If a negligent company leaks the private data of every single American, well, gee, what could we have done more, we had that one company do an audit and they didn't find anything and, gee, we're just really sorry, so lets all move on and here's a free year of credit monitoring which you may choose to continue paying us for at the end of the free year.

InSteady 3y ago

As a user of the site who has been falsely assured that your data is "100% secure" and totally anonymous, is that data in fact not your property? Perhaps not in a strictly legal sense, but from an ethical standpoint it is certainly more of a grey area than corporations and their lawyers would want us to roll over and accept. My understanding is that these security researchers only accessed their own accounts and data on the cloud servers, and in doing so they did not bypass any "effective technical protections on access." Thankfully for all of us, the DoJ appears to disagree with your sentiment. At least with the current administration. Is it your position is that when you are lied to, and your sensitive and personally identifying information is being grossly mishandled by a company, your only recourse is to spend thousands of dollars and incredible amounts of time on a court case that has very little chance of achieving anything?