4 ms·

Some things were not plainly spelled out: * July 11 2023 this was caught, April 2021 it was suspected to have happened. So, 2+ years they had this credential,

Some things were not plainly spelled out: * July 11 2023 this was caught, April 2021 it was suspected to have happened. So, 2+ years they had this credential, and 2 months from detection until disclosure. * How many tokens were forged, how much did they access? I'm assuming bad if they didn't disclose. * No timetable from once detected to fix implemented. Just "this issue has been corrected". Hope they implemented that quickly... * They've fixed 4 direct problems, but obviously there's some systemic issues. What are they doing about those?

ranting-moth 3y ago
Adverse inference is very valid. https://en.m.wikipedia.org/wiki/Adverse_inference https://en.m.wikipedia.org/wiki/Adverse_inference
- jeremyjh 3y ago
  Its valid in a civil court where discovery processes exist. It doesn't really apply to public relations, where information could be withheld for a number of unknowable reasons. Of course everyone is free to speculate, but its not supported by a link to theories of common law in civil torts.
tadzikpk 3y ago
If this credential is still valid 2 years later, what is their credential rotation policy?
- roboman 3y ago
  ^ agree! What an easy mitigation this would have been.
- Fatnino 3y ago
  5 years. The dump is from 2018
  - roymj88 3y ago
    Whoah... Surely this may not be the only news waiting to come out.. They just need to find out what else they've got during this period..
    - Fatnino 3y ago
      A little tidbit that they neglected to underline is that they hadn't rotated that key in at least 5 years.
- lucasRW 3y ago
  It's not a password though, but probably a private key, not that easy to rotate every now and then.