3 ms·

> Why can't I personally test the security of my bank? For the same reason your bank can't test how well you store your PIN and secret phrase, I imagine. It's

> Why can't I personally test the security of my bank? For the same reason your bank can't test how well you store your PIN and secret phrase, I imagine. It's not in the contract between you and the bank, and the general law doesn't allow for it ("I was not trying to burgle that house, Your Honour, I was testing its security" — "That's a nice joke, mister, so I won't you hold in contempt of the court. Still, guilty, five years"). > Why can't I ask an organization I trust to test the security of my bank? For the same reason the bank can't ask an organization it trusts to test how well you store your PIN and secret phrase, I imagine: it's not in the contract. And good luck trying to find a bank that would agree to let you inspect their security.

hypeatei 2y ago
Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. I've seen this time and time again on HN. Making analogies that aren't clear doesn't result in useful discourse (people argue over the dumb analogies rather than the thing itself), kinda like I'm doing right now...
- Joker_vD 2y ago
  > Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. Well, go write your congressman about it (or however it's done whenever you are), because it sure does look like the lawmakers and the courts do seem those two things to be kinda analogous; but I doubt that arguing in the HN comment section about laws has ever improved (or will ever improve) those laws.
- robertlagrant 2y ago
  No, analogies are good. Calling them dumb instead of pointing out the difference is what's not useful.
  - hypeatei 2y ago
    Pointing out the difference? These two things (sending data over TCP/IP and testing physical locks on a house) are in two completely different realms.
    - robertlagrant 2y ago
      I don't know what "different realms" means. It's an analogy, so it won't be two identical things. The question is: why doesn't the comparison make sense?
- deleted 2y ago
  [deleted]
Buttons840 2y ago
We need to include in this analogy that the bank is robbed every other week because they forgot to close the vault or they left a pile of cash sitting outside while they went to lunch. In such a situation if an upstanding citizen checks that the vault is actually locked--"did they remember to lock it today?"--the actions of that citizen don't concern me. But let's set the analogy aside. If companies want full control over their systems and who may test the security of those systems, that's fine with me, so long as their full control also comes with full liability. The problem is we currently give companies full control without any responsibility or liability.
- warkdarrior 2y ago
  Responsibility and liability are usually established in court, so go ahead and sue all the companies that have your data. Also you need to demonstrate that you incurred some tangible loss from a data breach.
  - Buttons840 2y ago
    Yes. To get redress I must pay hundreds of thousands of dollars in legal fees (try suing a company like Equifax or AT&T for less) and also provide detailed evidence of exactly what criminal organizations from all over the world have done with my data. Does this seem reasonable? If I fail to meet this standard does that really mean I wasn't harmed? And does this standard apply the other direction? If I personally test the security of a company without permission, do they have to prove that I caused actual damage before I am punished? If the moral standard applies evenly, then I should be able to try opening the vault, and if I fail, no harm done. The bank must show actual harm before I am punished. But no, there is no even application of moral standards here; when it comes to individuals testing security the act itself is criminalized regardless of whether or not harm was done. It is even a felony to experiment with physical devices you own in many cases.
krab 2y ago
Analogies time! I saw this big shiny vault had a side door unlocked, Your Honour. This vault stores my money as well, so I wanted to see - surely they wouldn't let burglars in just like that. I didn't break any lock, I didn't pass any sign. When I saw the door indeed led to the money, I left and wrote the bank a letter.

hypeatei 2y ago

Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. I've seen this time and time again on HN. Making analogies that aren't clear doesn't result in useful discourse (people argue over the dumb analogies rather than the thing itself), kinda like I'm doing right now...

Joker_vD 2y ago
> Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. Well, go write your congressman about it (or however it's done whenever you are), because it sure does look like the lawmakers and the courts do seem those two things to be kinda analogous; but I doubt that arguing in the HN comment section about laws has ever improved (or will ever improve) those laws.
robertlagrant 2y ago
No, analogies are good. Calling them dumb instead of pointing out the difference is what's not useful.
- hypeatei 2y ago
  Pointing out the difference? These two things (sending data over TCP/IP and testing physical locks on a house) are in two completely different realms.
  - robertlagrant 2y ago
    I don't know what "different realms" means. It's an analogy, so it won't be two identical things. The question is: why doesn't the comparison make sense?
deleted 2y ago
[deleted]

Buttons840 2y ago

We need to include in this analogy that the bank is robbed every other week because they forgot to close the vault or they left a pile of cash sitting outside while they went to lunch. In such a situation if an upstanding citizen checks that the vault is actually locked--"did they remember to lock it today?"--the actions of that citizen don't concern me. But let's set the analogy aside. If companies want full control over their systems and who may test the security of those systems, that's fine with me, so long as their full control also comes with full liability. The problem is we currently give companies full control without any responsibility or liability.

warkdarrior 2y ago
Responsibility and liability are usually established in court, so go ahead and sue all the companies that have your data. Also you need to demonstrate that you incurred some tangible loss from a data breach.
- Buttons840 2y ago
  Yes. To get redress I must pay hundreds of thousands of dollars in legal fees (try suing a company like Equifax or AT&T for less) and also provide detailed evidence of exactly what criminal organizations from all over the world have done with my data. Does this seem reasonable? If I fail to meet this standard does that really mean I wasn't harmed? And does this standard apply the other direction? If I personally test the security of a company without permission, do they have to prove that I caused actual damage before I am punished? If the moral standard applies evenly, then I should be able to try opening the vault, and if I fail, no harm done. The bank must show actual harm before I am punished. But no, there is no even application of moral standards here; when it comes to individuals testing security the act itself is criminalized regardless of whether or not harm was done. It is even a felony to experiment with physical devices you own in many cases.

krab 2y ago

Analogies time! I saw this big shiny vault had a side door unlocked, Your Honour. This vault stores my money as well, so I wanted to see - surely they wouldn't let burglars in just like that. I didn't break any lock, I didn't pass any sign. When I saw the door indeed led to the money, I left and wrote the bank a letter.