3 ms·

I don't know why companies think that if a third party is breached and steals their data from them, said company somehow is any less culpable. If you give your

I don't know why companies think that if a third party is breached and steals their data from them, said company somehow is any less culpable. If you give your data to a third party, you are still fully responsible for the security of that data. Don't trust the third party? Don't give them the data.

taeric 2y ago
I mostly agree for data given. With carve outs for data that is necessary for something. For a silly example, recall back when Amazon was hiding information in their emails so that they wouldn't be sharing purchase information with third parties. It sucks, because I don't necessarily know how you could codify the difference here. If you said that Amazon was sharing customer emails and purchases with a third party, that is indeed suspicious as heck. When you restate that they email you receipts with this information, it sounds a lot different. Indeed, it was very inconvenient when they didn't do that. This is also why most hospitals have that ridiculous, "you have a new message on the portal" emails. Which are so infuriating.
bee_rider 2y ago
If anything it looks worse somehow… it takes it out of the “maybe they made a technical screw up, after all IT isn’t really a core competency for Toyota” into the “are they good at evaluating the parties they do business with?” I don’t expect Toyota to be very good at IT. But I expect them to somehow figure out if they are working with incompetent or evil third parties, because they also buy airbags and brakes from third parties, so like, they should be good at evaluating their vendors.
basch 2y ago
Imagine in the physical world. You put something in a storage locker with a key. Someone nefarious asks you for the key, and steals your things out of the storage locker. Then you blame the storage locker for unlocking to your key.

taeric 2y ago

I mostly agree for data given. With carve outs for data that is necessary for something. For a silly example, recall back when Amazon was hiding information in their emails so that they wouldn't be sharing purchase information with third parties. It sucks, because I don't necessarily know how you could codify the difference here. If you said that Amazon was sharing customer emails and purchases with a third party, that is indeed suspicious as heck. When you restate that they email you receipts with this information, it sounds a lot different. Indeed, it was very inconvenient when they didn't do that. This is also why most hospitals have that ridiculous, "you have a new message on the portal" emails. Which are so infuriating.

bee_rider 2y ago

If anything it looks worse somehow… it takes it out of the “maybe they made a technical screw up, after all IT isn’t really a core competency for Toyota” into the “are they good at evaluating the parties they do business with?” I don’t expect Toyota to be very good at IT. But I expect them to somehow figure out if they are working with incompetent or evil third parties, because they also buy airbags and brakes from third parties, so like, they should be good at evaluating their vendors.

basch 2y ago

Imagine in the physical world. You put something in a storage locker with a key. Someone nefarious asks you for the key, and steals your things out of the storage locker. Then you blame the storage locker for unlocking to your key.