6 ms·

Until there are significant financial damages associated with each of these breaches, companies just won't invest enough to secure the information. These sorts

by gkanai 2y ago

Until there are significant financial damages associated with each of these breaches, companies just won't invest enough to secure the information. These sorts of breaches should be existential to the company- they should never happen. And yet because the penalties are almost nothing, companies just are not incentivized to secure the data appropriately. If a breach meant the firing of the CEO and the CTO and the board, then you'd know that companies would spend a lot more on security and privacy.

deleted 2y ago
[deleted]
layer8 2y ago
I’m completely sympathetic to that view. However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner, I’m afraid that we won’t see any such penalties.
- croemer 2y ago
  Very good point. In addition, my email address etc has been breached so many times that each extra leak has almost no marginal impact.
  - Loughla 2y ago
    Is almost like publicly accessible information like email, phone, address, and, honestly, ss# at this point shouldn't be used for anything serious that doesn't require some sort of authentication beyond itself. Weird.
    - BobbyTables2 2y ago
      And the fact that this is now pretty obvious seems to make such continued use an astounding display of mass negligence.
    - franga2000 2y ago
      Credential stuffing isn't the only threat. Leaked emails and phone numbers become spam and phishing targets and phishing can get a lot more convincing when they also have your home address and other details.
- stackskipton 2y ago
  >However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner Which means nothing gets done because it's pretty hard to prove where any one misusing your information got it from. My identity was stolen after breach but when I took it up with entity that lost my information, they were like "Prove it" which of course I couldn't because people who did it to me were never caught.
  - davisr 2y ago
    I own my email domain, and I register for each service with a different address. For example, flightaware-20240817@mydomain.net. This way, I know where my email addresses leak from.
    - michaelteter 2y ago
      With some email services including Gmail and Protonmail you can add +whatever to your username part of the email address to get the same result. My name+flightaware@gmail.com for example… And many mail hosting services let you assign a catch-all, which allows you to simply use anything@mydomain.com to get the same result.
      - maeil 2y ago
        The former would seem ineffective, surely anyone buying such a dataset would just remove the "+___" part in emails that have them?
        iamacyborg 2y ago
        Why would they bother?
        InvertedRhodium 2y ago
        To limit evidence of culpability in the event of a data leak exactly like the one we’re discussing.
- MrJohz 2y ago
  With GDPR, simply leaking personal data is enough to earn you penalties. If your security is insufficient that someone can take this much personal data (and based on some of the other comments here it was a lot of personal data), then you have not upheld your responsibility according to GDPR. So I disagree, we don't need to wait until the data breaches lead to any particular outcomes, we need laws that make it clear that data breaches alone constitute damages to the people whose data was released. More people should be protected by GDPR-style laws, and more companies need to recognise that data security is something they need to take deeply seriously.
  - robertlagrant 2y ago
    Is there precedent for this? E.g. if I accidentally sell a faulty door lock, does that constitute damages automatically? Don't damages require damage?
    - MrJohz 2y ago
      My private details leaking is damage, that's the point here. If I trust you with my confidential details (which can be anything from my bank details to my email address), and your data security protocols mean that my data gets stolen, then I have suffered damages, and GDPR comes into play.
    - dwattttt 2y ago
      IANAL. Damages are relevant in-so-far as a relevant law addresses or requires them. Nothing stops a law from assuming damages under some circumstances.
  - District5524 2y ago
    That's not how it works. I think you are mixing up damages to be awarded by courts to an individual data subject (right to compensation, Article 82) with penalties (Article 83-84) - the latter having a special meaning, in practice covering the administrative fines by authorities (DPAs). There was a case by the ECJ (C 300/21) saying that for damages to be awarded to the individual, they have to prove the material or non-material damages involved. Regardless, any data protection authority can and do fine companies for breaches such as this one and also for late filing, and while DPAs also have to take into account the damages caused to data subjects when deciding the amount of fine, that's not a standard that has to be proven for each data subject separately and is therefore not as strict as the right to compensation. FlightAware definitely should be fined... Like Booking, NTT or Twitter or banks for breach obligations, for more than €400k. But it's still strange that very few US companies were fined so far in relation to no or late breach notifications - not that they were not fined heavily for failure to comply with other obligations. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- amsterdorn 2y ago
  I don't like this take, companies use this same mentality to justify inaction with their impact on climate change. Who decides what a "severe" outcome is? The companies themselves? Why don't we hold them to a higher standard?
  - harshaxnim 2y ago
    Of course it's not a likeable take, but it's a grounded one. And it's exactly the reason why companies don't care about climate change either.
    - croemer 2y ago
      Climate change is a terrible analogy because: a) everyone is impacted by climate change, not just the customers who gave their data b) climate change has very real consequences for people
      - amsterdorn 2y ago
        How does this explain that it's a bad analogy? Both of these are true and can apply to both. Read up on the SSN leak from last week, I didn't give them my data. And it can have real consequences.
  - chii 2y ago
    > justify inaction with their impact on climate change. but this is the correct justification. If the customer is the one buying these products that cause climate impact, why is it the sole responsibility of the company to pay the cost of rectification? In such situations, where externality is problematic, it is up to the gov't to push regulations to prevent it. A carbon capture tax, for example, is one such way. > Why don't we hold them to a higher standard? why should companies be held to a higher standard than a person?
    - immibis 2y ago
      > why is it the sole responsibility of the company to pay the cost of rectification? It isn't - it's the company's responsibility to pass the cost to the customer.
jfoster 2y ago
It would mean that if all current & prospective customers abandon them for it.
KingOfCoders 2y ago
If a breach means jailtime, we would see a drastic reduction.
- dgoldstein0 2y ago
  If breaches were automatic jail time, no one in their right mind would want these jobs. One same reaction would be to stop collecting personal data, but a lot of Internet businesses would have a hard time adjusting to that. A more practical policy proposal would criminalize extreme negligence while focusing on financial penalties for lesser beaches. Possibly the young missing vs current policies is that the duty to protect user data should probably increase with the amount of data collected - the juicier target you make your company, the more the penalty needs to hurt. This could mean companies taking a hard look e.g. at whether they really need your address and phone number because every extra bit of hacked information should cost them more.
  - thanksgiving 2y ago
    Prison time should be limited to the CEO and board members.
    - smolder 2y ago
      In general, prison time is for the peasants, not the royalty.
  - strogonoff 2y ago
    Imagine if software engineers had to have a license, and they stood to lose their license in cases of malpractice. When your license is your bread & butter and you cannot work without it, losing it is devastating—and much more devastating than losing a particular position at some company (so even if you are required to implement an insecure solution, you would have no problems telling respective manager to shove it, respectfully).
  - Nextgrid 2y ago
    > a lot of Internet businesses would have a hard time adjusting to that. Why? The majority of situations where you need an account can be replaced with pseudonymous info. Netflix needs an account and some payment data (which can itself be a pseudonymous card number with no identifying info attached), but it doesn't need to know my name or anything else. I can see that the whole advertising/data broker/"growth & engagement" crowd would end up begging on the streets, but I'm not sure many actually valuable businesses would be affected all that much.
n_plus_1_acc 2y ago
They'd simply be hired as a manager in another company
Simon_ORourke 2y ago
Surely a mealy-mouthed email without a formal apology or admission of culpability will be the order the day - perhaps with a $2 Amazon voucher for those willing to click a box and agree to not sue for damages or engage in public disparagement. What I find surprising more that the usual lack of accountability in these cases is how little its impact tends to be felt on Wall Street. A slight dip in the share price maybe for a week or so, but then it's back to business as usual.
Log_out_ 2y ago
The only solution..throw away one time pad generated personal data,tightly coupled to the lifetime of the used service.
trustno2 2y ago
If security breaches lead to jail time, nobody but a few big companies will build anything. Be careful what you wish for.
- figassis 2y ago
  My side projects will never leak passwords. How is that not security 101? You do not need to "invest" in this, every single engineer needs to have this level of working knowledge. Not having this in place should absolutely mean not being allowed to run a business online.
  - croemer 2y ago
    How can you be so sure? Never is a strong word unless you never use passwords in your side projects. And this here wasn't a side project. It's easier if only one person controls a code base than with complexity.
  - trustno2 2y ago
    What if someone gets into your app logic and make a POST trigger that gets the passwords out. What if you log all POST requests for debugging purposes and forget to sanitize the logs. What if you have XSS in your web app that sends the password to a third party. What if your mobile phone app has a dependency that includes a keylogger. The likelihood of this increases the more layers you have in your organization (for example, the log pipeline team assumes the logs are already sanitized; the login form team assumes the log team is sanitizing them; it all goes through some A/B testing team that just dumps all data to "data lake" somewhere unsafe; the FE team puts in random node.js dependencies as it's "just a frontend"; etc). Passwords can leak from more places than just from the DB...
    - figassis 2y ago
      Getting into the app's running process is an effective way to exfiltrate everything, and likely they'd have a lot more to worry about there. I don't however think that piggybacking on a live app does not give you the size of these leaks. I mean, does every user of a service access the service in these periods? More likely they steal the app's credentials (db, cloud provider, etc) and then go to town on data at rest. You're right on logs and things like fullstory, but no one on any team should assume things are sanitized. You do your job independently. If you're an infra, devops, sre, does it make sense to say I thought they had it handled? Was that what you marketed on your resume? Not saying there aren't complexities involved, but in many of these cases I see a lot of low hanging fruit, likely due to moving too quickly. We really need to own up to the fact that we've grown too comfortable with not giving any thought to other people's data. Why is it that there are the PCI audits when you handle card data, but not when you handle PII? Because card fraud hits the banks and they don't want to pay for any of that. So an entire industry was spawned, it's not perfect, but it helps a lot. You do not see a lot of credit card leaks.
xlinux 2y ago
Why not the people who built such crappy software?
deleted 2y ago
[deleted]
Ekaros 2y ago
I'm starting to think there should be some statutory minimum like 10€ per account that will be automatic minimum fine. Then depending on type of information it scales up from there.

by gkanai 2y ago

deleted 2y ago

[deleted]

layer8 2y ago

I’m completely sympathetic to that view. However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner, I’m afraid that we won’t see any such penalties.

croemer 2y ago
Very good point. In addition, my email address etc has been breached so many times that each extra leak has almost no marginal impact.
- Loughla 2y ago
  Is almost like publicly accessible information like email, phone, address, and, honestly, ss# at this point shouldn't be used for anything serious that doesn't require some sort of authentication beyond itself. Weird.
  - BobbyTables2 2y ago
    And the fact that this is now pretty obvious seems to make such continued use an astounding display of mass negligence.
  - franga2000 2y ago
    Credential stuffing isn't the only threat. Leaked emails and phone numbers become spam and phishing targets and phishing can get a lot more convincing when they also have your home address and other details.
stackskipton 2y ago
>However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner Which means nothing gets done because it's pretty hard to prove where any one misusing your information got it from. My identity was stolen after breach but when I took it up with entity that lost my information, they were like "Prove it" which of course I couldn't because people who did it to me were never caught.
- davisr 2y ago
  I own my email domain, and I register for each service with a different address. For example, flightaware-20240817@mydomain.net. This way, I know where my email addresses leak from.
  - michaelteter 2y ago
    With some email services including Gmail and Protonmail you can add +whatever to your username part of the email address to get the same result. My name+flightaware@gmail.com for example… And many mail hosting services let you assign a catch-all, which allows you to simply use anything@mydomain.com to get the same result.
    - maeil 2y ago
      The former would seem ineffective, surely anyone buying such a dataset would just remove the "+___" part in emails that have them?
      - iamacyborg 2y ago
        Why would they bother?
        InvertedRhodium 2y ago
        To limit evidence of culpability in the event of a data leak exactly like the one we’re discussing.
MrJohz 2y ago
With GDPR, simply leaking personal data is enough to earn you penalties. If your security is insufficient that someone can take this much personal data (and based on some of the other comments here it was a lot of personal data), then you have not upheld your responsibility according to GDPR. So I disagree, we don't need to wait until the data breaches lead to any particular outcomes, we need laws that make it clear that data breaches alone constitute damages to the people whose data was released. More people should be protected by GDPR-style laws, and more companies need to recognise that data security is something they need to take deeply seriously.
- robertlagrant 2y ago
  Is there precedent for this? E.g. if I accidentally sell a faulty door lock, does that constitute damages automatically? Don't damages require damage?
  - MrJohz 2y ago
    My private details leaking is damage, that's the point here. If I trust you with my confidential details (which can be anything from my bank details to my email address), and your data security protocols mean that my data gets stolen, then I have suffered damages, and GDPR comes into play.
  - dwattttt 2y ago
    IANAL. Damages are relevant in-so-far as a relevant law addresses or requires them. Nothing stops a law from assuming damages under some circumstances.
- District5524 2y ago
  That's not how it works. I think you are mixing up damages to be awarded by courts to an individual data subject (right to compensation, Article 82) with penalties (Article 83-84) - the latter having a special meaning, in practice covering the administrative fines by authorities (DPAs). There was a case by the ECJ (C 300/21) saying that for damages to be awarded to the individual, they have to prove the material or non-material damages involved. Regardless, any data protection authority can and do fine companies for breaches such as this one and also for late filing, and while DPAs also have to take into account the damages caused to data subjects when deciding the amount of fine, that's not a standard that has to be proven for each data subject separately and is therefore not as strict as the right to compensation. FlightAware definitely should be fined... Like Booking, NTT or Twitter or banks for breach obligations, for more than €400k. But it's still strange that very few US companies were fined so far in relation to no or late breach notifications - not that they were not fined heavily for failure to comply with other obligations. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
amsterdorn 2y ago
I don't like this take, companies use this same mentality to justify inaction with their impact on climate change. Who decides what a "severe" outcome is? The companies themselves? Why don't we hold them to a higher standard?
- harshaxnim 2y ago
  Of course it's not a likeable take, but it's a grounded one. And it's exactly the reason why companies don't care about climate change either.
  - croemer 2y ago
    Climate change is a terrible analogy because: a) everyone is impacted by climate change, not just the customers who gave their data b) climate change has very real consequences for people
    - amsterdorn 2y ago
      How does this explain that it's a bad analogy? Both of these are true and can apply to both. Read up on the SSN leak from last week, I didn't give them my data. And it can have real consequences.
- chii 2y ago
  > justify inaction with their impact on climate change. but this is the correct justification. If the customer is the one buying these products that cause climate impact, why is it the sole responsibility of the company to pay the cost of rectification? In such situations, where externality is problematic, it is up to the gov't to push regulations to prevent it. A carbon capture tax, for example, is one such way. > Why don't we hold them to a higher standard? why should companies be held to a higher standard than a person?
  - immibis 2y ago
    > why is it the sole responsibility of the company to pay the cost of rectification? It isn't - it's the company's responsibility to pass the cost to the customer.

jfoster 2y ago

It would mean that if all current & prospective customers abandon them for it.

KingOfCoders 2y ago

If a breach means jailtime, we would see a drastic reduction.

dgoldstein0 2y ago
If breaches were automatic jail time, no one in their right mind would want these jobs. One same reaction would be to stop collecting personal data, but a lot of Internet businesses would have a hard time adjusting to that. A more practical policy proposal would criminalize extreme negligence while focusing on financial penalties for lesser beaches. Possibly the young missing vs current policies is that the duty to protect user data should probably increase with the amount of data collected - the juicier target you make your company, the more the penalty needs to hurt. This could mean companies taking a hard look e.g. at whether they really need your address and phone number because every extra bit of hacked information should cost them more.
- thanksgiving 2y ago
  Prison time should be limited to the CEO and board members.
  - smolder 2y ago
    In general, prison time is for the peasants, not the royalty.
- strogonoff 2y ago
  Imagine if software engineers had to have a license, and they stood to lose their license in cases of malpractice. When your license is your bread & butter and you cannot work without it, losing it is devastating—and much more devastating than losing a particular position at some company (so even if you are required to implement an insecure solution, you would have no problems telling respective manager to shove it, respectfully).
- Nextgrid 2y ago
  > a lot of Internet businesses would have a hard time adjusting to that. Why? The majority of situations where you need an account can be replaced with pseudonymous info. Netflix needs an account and some payment data (which can itself be a pseudonymous card number with no identifying info attached), but it doesn't need to know my name or anything else. I can see that the whole advertising/data broker/"growth & engagement" crowd would end up begging on the streets, but I'm not sure many actually valuable businesses would be affected all that much.

n_plus_1_acc 2y ago

They'd simply be hired as a manager in another company

Simon_ORourke 2y ago

Surely a mealy-mouthed email without a formal apology or admission of culpability will be the order the day - perhaps with a $2 Amazon voucher for those willing to click a box and agree to not sue for damages or engage in public disparagement. What I find surprising more that the usual lack of accountability in these cases is how little its impact tends to be felt on Wall Street. A slight dip in the share price maybe for a week or so, but then it's back to business as usual.

Log_out_ 2y ago

The only solution..throw away one time pad generated personal data,tightly coupled to the lifetime of the used service.

trustno2 2y ago

If security breaches lead to jail time, nobody but a few big companies will build anything. Be careful what you wish for.

figassis 2y ago
My side projects will never leak passwords. How is that not security 101? You do not need to "invest" in this, every single engineer needs to have this level of working knowledge. Not having this in place should absolutely mean not being allowed to run a business online.
- croemer 2y ago
  How can you be so sure? Never is a strong word unless you never use passwords in your side projects. And this here wasn't a side project. It's easier if only one person controls a code base than with complexity.
- trustno2 2y ago
  What if someone gets into your app logic and make a POST trigger that gets the passwords out. What if you log all POST requests for debugging purposes and forget to sanitize the logs. What if you have XSS in your web app that sends the password to a third party. What if your mobile phone app has a dependency that includes a keylogger. The likelihood of this increases the more layers you have in your organization (for example, the log pipeline team assumes the logs are already sanitized; the login form team assumes the log team is sanitizing them; it all goes through some A/B testing team that just dumps all data to "data lake" somewhere unsafe; the FE team puts in random node.js dependencies as it's "just a frontend"; etc). Passwords can leak from more places than just from the DB...
  - figassis 2y ago
    Getting into the app's running process is an effective way to exfiltrate everything, and likely they'd have a lot more to worry about there. I don't however think that piggybacking on a live app does not give you the size of these leaks. I mean, does every user of a service access the service in these periods? More likely they steal the app's credentials (db, cloud provider, etc) and then go to town on data at rest. You're right on logs and things like fullstory, but no one on any team should assume things are sanitized. You do your job independently. If you're an infra, devops, sre, does it make sense to say I thought they had it handled? Was that what you marketed on your resume? Not saying there aren't complexities involved, but in many of these cases I see a lot of low hanging fruit, likely due to moving too quickly. We really need to own up to the fact that we've grown too comfortable with not giving any thought to other people's data. Why is it that there are the PCI audits when you handle card data, but not when you handle PII? Because card fraud hits the banks and they don't want to pay for any of that. So an entire industry was spawned, it's not perfect, but it helps a lot. You do not see a lot of credit card leaks.

xlinux 2y ago

Why not the people who built such crappy software?

deleted 2y ago

[deleted]

Ekaros 2y ago

I'm starting to think there should be some statutory minimum like 10€ per account that will be automatic minimum fine. Then depending on type of information it scales up from there.