6 ms·

I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage thi

I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.

Terr_ 3y ago
Disclosure liability insurance, low premiums if there was nothing to leak. Of course, that assumes a different world where companies actually pay for screwing up in the first place.
A4ET8a8uTh0 3y ago
Obviously, IANAL In a sense, that gradation is present for other offenses. You kill a man by accident? It may end up being involuntary manslaughter. You kill that same man with malice and planning? It charge will move to aggravated and premeditated murder. At the end of the day, a life was taken and some level of judicial review should take place. That does not appear to happen for 'hack' events.
- ribosometronome 3y ago
  Are involuntary manslaughter cases not usually predicated on some sort of negligence or other criminal activity on the part of the manslaughter? I don't think I've ever heard of anyone being punished for being the person in the wrong place when someone else decides to commit suicide by train or vehicle, for example. If we take the comparison down a step (and into what I think is maybe a more comparable situation), I routinely see warnings in parking lots that they are not liable for stolen property or damage and imagine those are generally probably pretty accurate outside of, again, some negligence on the side of the business.
- gretch 3y ago
  The difference between this situation is that you still committed an action, compared to simply being acted on. A better analogy would be like if you were a bank holding peoples' money. Armed assailants break into the money and take it. Is the bank liable because it did not have adequate defenses for the attack? But the bank situation is easy to solve because it's money and money is fungible, so you solve it with insurance. Leaked data can't be revoked and it's hard to quantify. If you make the policy wrong, you essentially end up punishing a victim party (the end users are victims, but the firm that was attacked is also a victim).
Nextgrid 3y ago
The root cause behind the proliferation of privacy breaches is that the legal framework against spying/hacking turns out to have a massive vulnerability. Developing & spreading spyware that collects people's personal data without permission is illegal (you don't even need to leak the collected data for it to be illegal), but wrap it in some flashy marketing, dozens of pages of unscrutable ToS and "privacy" policy, and suddenly not only your spyware operation became legal but you can even leak or sell the data in total impunity. This is valid in Europe as much as the US. Keep in mind that even before the GDPR, most countries had some sort of legislation around personal data processing, use and storage, but none of it was enforced. The GDPR is no better in terms of enforcement, which is why you see tons of (non-compliant) "consent" flows and spying continues as usual for the most part since businesses entirely based on non-consensual data processing are still alive and kicking.
mooreds 3y ago
> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewards programs, where they capture what you've bought and when you have bought it. If it was just about repeat business, they'd still be using punch cards, like they did a decade ago. I don't have any insight into how they use the data, but why would they offer free things (restaurants offer appetizers, grocery stores offer discounts, etc) unless the value they received was more than the cost of the incentive?
- Affric 3y ago
  I am still waiting for digital identity. Not sure why I can’t authenticate myself with these companies based on a private key and any details they want be disclosed to them for whatever reason don’t just come ephemerally from my server. Obviously, you could also have a third party acting in this space for the non-tech savvy. Right now all my data is held by corporate types who don’t give a shit.
  - mooreds 3y ago
    Passkeys are a start. They have their issues (I wrote about some here: https://ciamweekly.substack.com/p/on-webauthn-and-passkeys https://ciamweekly.substack.com/p/on-webauthn-and-passkeys ) but at least it is widespread, well supported, standardized, (possibly) anonymous public private key cryptography.
    - __MatrixMan__ 3y ago
      It seems likely that you know passkeys better than I do (you wrote a blog about them after all), so I've got a question. My impression is that there's a server side component. It's not just a key in your device, it's a key in your device that's blessed by someone who maintains a server. My further impression is that the people who manage the servers (either the authenticating-you server or the supporting-auth-for-you server) will be able to configure allow/deny lists for each other. They can say: > sorry passkeys.jimbobsmomsbasement.com, you're not on the list of servers that I trust, so I'm not going to accept this key Quoting GP here: > Right now all my data is held by corporate types who don’t give a shit. Is it true that passkey providers will be able to use this feature band together and prevent passkey providers that they don't like from being useful? It was something about attestations--I didn't fully get it the first time it was explained to me. If so, doesn't that make the "corporate types who don't give a shit" problem worse? At least with a password the corporate types couldn't deny you the right to authenticate because in their estimation your password provider isn't corporate enough.
1vuio0pswjnm7 3y ago
Data centers could be closed, removing their negative environmental impacts.
aeternum 3y ago
The problem is the core idea is flawed. The same concept (don't store the data) was applied to creditcard account data 10 years ago in many point-of-sale systems. Malware simply evolved to logs the data itself. Not collecting user data in the first place might be a solve, but don't let simply not storing it create a false sense of security. Your user's data is still very much at risk.
- dj_mc_merlin 3y ago
  That's an improvement. It changes the risk profile from "company whose security practices you have no clue about getting hacked" to "one of my personal devices getting infected with malware", which you can at least do something about.
  - aeternum 3y ago
    It doesn't because many companies believe they are safe simply because they don't "hold" your personal data. If it transits their systems it is still at risk, and those companies are much more likely to have security issues because why invest when they're not "holding" user data.
andoando 3y ago
I disagree. I dont see any reason users wouldn't equally share the risk if neither party did anything wrong. I suppose if the company makes a claim like "We wont share your data with anyone" then you could make that point
- teeray 3y ago
  That assumes users fully understood what they were consenting to. Agreements and Privacy Policies are written to exhaust and bamboozle the users so they just hit “accept.”
fvdessen 3y ago
This is exactly what the GDPR is all about btw.
_heimdall 3y ago
I agree with the sentiment here, but I'm not sure how that could ever really be implemented. Our laws shouldn't punish people for honestly doing the best they know how to, especially with a caveat that it doesn't matter if it was industry standard. Not only is that confusing and at serious risk of punishing all the wrong people, it creates incentives to help hack your competition and throw them to the legal wolves.
- cuu508 3y ago
  > Our laws shouldn't punish people for honestly doing the best they know how to Sure, but holding on to data you do not strictly need is not doing the best
  - AnthonyMouse 3y ago
    Sometimes there is data you do strictly need but it's still sensitive. Then someone finds 0-day and relieves you of it. It would not be just or prudent for this to bankrupt anyone it happens to, who is just as much a victim as the person whose data it is.
  - _heimdall 3y ago
    Who gets to decide what data is needed? I'd argue that my bank doesn't need to retain details of my transactions, only the amount paid/owed. For sure they don't need that data indefinitely. Do I legally go after them because I don't think they need that data? And does the defendant in such a case just need to provide any potential use case for a specific piece of data they store?
    - cuu508 3y ago
      What you should do when you believe your bank is mishandling your personal information depends on your local laws. In European countries, you would first contact your bank and get them to clarify precisely what data they are storing about you, and what legal basis they are relying on to do so (they should have this already available in their privacy policy, so perhaps you would just go and read that). If the bank refuses to answer, or if you disagree with them about the lawfulness of processing your data, you would then file a complaint with your local data protection authority. After the DPA is done with the case if you disagree with their conclusion, the next step would be to go to the court.
Nursie 3y ago
That’s basically what the GDPR tried to do, and a great plan. Instead of making the retention of data a good thing, make it toxic, make it risky. You don’t want PII in your logs, on anyone’s workstation or anywhere else it’s not absolutely necessary. Make it radioactive.
GoblinSlayer 3y ago
What industry thinks is right? We don't have a sound solution for breaches, 20% of attack surface can be covered with formally verified software, that's a lot of effort for a smallish gain, so risk should be mitigated somehow and minimization of data hoarding is an available mitigation.

Terr_ 3y ago

Disclosure liability insurance, low premiums if there was nothing to leak. Of course, that assumes a different world where companies actually pay for screwing up in the first place.

A4ET8a8uTh0 3y ago

Obviously, IANAL In a sense, that gradation is present for other offenses. You kill a man by accident? It may end up being involuntary manslaughter. You kill that same man with malice and planning? It charge will move to aggravated and premeditated murder. At the end of the day, a life was taken and some level of judicial review should take place. That does not appear to happen for 'hack' events.

ribosometronome 3y ago
Are involuntary manslaughter cases not usually predicated on some sort of negligence or other criminal activity on the part of the manslaughter? I don't think I've ever heard of anyone being punished for being the person in the wrong place when someone else decides to commit suicide by train or vehicle, for example. If we take the comparison down a step (and into what I think is maybe a more comparable situation), I routinely see warnings in parking lots that they are not liable for stolen property or damage and imagine those are generally probably pretty accurate outside of, again, some negligence on the side of the business.
gretch 3y ago
The difference between this situation is that you still committed an action, compared to simply being acted on. A better analogy would be like if you were a bank holding peoples' money. Armed assailants break into the money and take it. Is the bank liable because it did not have adequate defenses for the attack? But the bank situation is easy to solve because it's money and money is fungible, so you solve it with insurance. Leaked data can't be revoked and it's hard to quantify. If you make the policy wrong, you essentially end up punishing a victim party (the end users are victims, but the firm that was attacked is also a victim).

Nextgrid 3y ago

The root cause behind the proliferation of privacy breaches is that the legal framework against spying/hacking turns out to have a massive vulnerability. Developing & spreading spyware that collects people's personal data without permission is illegal (you don't even need to leak the collected data for it to be illegal), but wrap it in some flashy marketing, dozens of pages of unscrutable ToS and "privacy" policy, and suddenly not only your spyware operation became legal but you can even leak or sell the data in total impunity. This is valid in Europe as much as the US. Keep in mind that even before the GDPR, most countries had some sort of legislation around personal data processing, use and storage, but none of it was enforced. The GDPR is no better in terms of enforcement, which is why you see tons of (non-compliant) "consent" flows and spying continues as usual for the most part since businesses entirely based on non-consensual data processing are still alive and kicking.

mooreds 3y ago

> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewards programs, where they capture what you've bought and when you have bought it. If it was just about repeat business, they'd still be using punch cards, like they did a decade ago. I don't have any insight into how they use the data, but why would they offer free things (restaurants offer appetizers, grocery stores offer discounts, etc) unless the value they received was more than the cost of the incentive?

Affric 3y ago
I am still waiting for digital identity. Not sure why I can’t authenticate myself with these companies based on a private key and any details they want be disclosed to them for whatever reason don’t just come ephemerally from my server. Obviously, you could also have a third party acting in this space for the non-tech savvy. Right now all my data is held by corporate types who don’t give a shit.
- mooreds 3y ago
  Passkeys are a start. They have their issues (I wrote about some here: https://ciamweekly.substack.com/p/on-webauthn-and-passkeys https://ciamweekly.substack.com/p/on-webauthn-and-passkeys ) but at least it is widespread, well supported, standardized, (possibly) anonymous public private key cryptography.
  - __MatrixMan__ 3y ago
    It seems likely that you know passkeys better than I do (you wrote a blog about them after all), so I've got a question. My impression is that there's a server side component. It's not just a key in your device, it's a key in your device that's blessed by someone who maintains a server. My further impression is that the people who manage the servers (either the authenticating-you server or the supporting-auth-for-you server) will be able to configure allow/deny lists for each other. They can say: > sorry passkeys.jimbobsmomsbasement.com, you're not on the list of servers that I trust, so I'm not going to accept this key Quoting GP here: > Right now all my data is held by corporate types who don’t give a shit. Is it true that passkey providers will be able to use this feature band together and prevent passkey providers that they don't like from being useful? It was something about attestations--I didn't fully get it the first time it was explained to me. If so, doesn't that make the "corporate types who don't give a shit" problem worse? At least with a password the corporate types couldn't deny you the right to authenticate because in their estimation your password provider isn't corporate enough.

1vuio0pswjnm7 3y ago

Data centers could be closed, removing their negative environmental impacts.

aeternum 3y ago

The problem is the core idea is flawed. The same concept (don't store the data) was applied to creditcard account data 10 years ago in many point-of-sale systems. Malware simply evolved to logs the data itself. Not collecting user data in the first place might be a solve, but don't let simply not storing it create a false sense of security. Your user's data is still very much at risk.

dj_mc_merlin 3y ago
That's an improvement. It changes the risk profile from "company whose security practices you have no clue about getting hacked" to "one of my personal devices getting infected with malware", which you can at least do something about.
- aeternum 3y ago
  It doesn't because many companies believe they are safe simply because they don't "hold" your personal data. If it transits their systems it is still at risk, and those companies are much more likely to have security issues because why invest when they're not "holding" user data.

andoando 3y ago

I disagree. I dont see any reason users wouldn't equally share the risk if neither party did anything wrong. I suppose if the company makes a claim like "We wont share your data with anyone" then you could make that point

teeray 3y ago
That assumes users fully understood what they were consenting to. Agreements and Privacy Policies are written to exhaust and bamboozle the users so they just hit “accept.”

fvdessen 3y ago

This is exactly what the GDPR is all about btw.

_heimdall 3y ago

I agree with the sentiment here, but I'm not sure how that could ever really be implemented. Our laws shouldn't punish people for honestly doing the best they know how to, especially with a caveat that it doesn't matter if it was industry standard. Not only is that confusing and at serious risk of punishing all the wrong people, it creates incentives to help hack your competition and throw them to the legal wolves.

cuu508 3y ago
> Our laws shouldn't punish people for honestly doing the best they know how to Sure, but holding on to data you do not strictly need is not doing the best
- AnthonyMouse 3y ago
  Sometimes there is data you do strictly need but it's still sensitive. Then someone finds 0-day and relieves you of it. It would not be just or prudent for this to bankrupt anyone it happens to, who is just as much a victim as the person whose data it is.
- _heimdall 3y ago
  Who gets to decide what data is needed? I'd argue that my bank doesn't need to retain details of my transactions, only the amount paid/owed. For sure they don't need that data indefinitely. Do I legally go after them because I don't think they need that data? And does the defendant in such a case just need to provide any potential use case for a specific piece of data they store?
  - cuu508 3y ago
    What you should do when you believe your bank is mishandling your personal information depends on your local laws. In European countries, you would first contact your bank and get them to clarify precisely what data they are storing about you, and what legal basis they are relying on to do so (they should have this already available in their privacy policy, so perhaps you would just go and read that). If the bank refuses to answer, or if you disagree with them about the lawfulness of processing your data, you would then file a complaint with your local data protection authority. After the DPA is done with the case if you disagree with their conclusion, the next step would be to go to the court.

Nursie 3y ago

That’s basically what the GDPR tried to do, and a great plan. Instead of making the retention of data a good thing, make it toxic, make it risky. You don’t want PII in your logs, on anyone’s workstation or anywhere else it’s not absolutely necessary. Make it radioactive.

GoblinSlayer 3y ago

What industry thinks is right? We don't have a sound solution for breaches, 20% of attack surface can be covered with formally verified software, that's a lot of effort for a smallish gain, so risk should be mitigated somehow and minimization of data hoarding is an available mitigation.