5 ms·

Now, while I agree with you that we better preserve civil rights, being stupid and forgetting to lock your front door certainly isn't a crime. However, opening

by ninjin 13y ago

Now, while I agree with you that we better preserve civil rights, being stupid and forgetting to lock your front door certainly isn't a crime. However, opening said door and copying sensitive documents certainly is, no matter how dumb it was of the owner to not lock the door in the first place. What I think we need is public disclosure of who had their data leaked and to make sure that the ToS can't cover "loosing" the data. Then at least we could have a class-action lawsuits and make sure that the incentives push companies towards securing their damn infrastructure instead of relying on insurance coverage and public ignorance.

sp332 13y ago
If it's a company's own data, then fine. But if they take my personal data and then expose me to risk by showing it to any passer-by, they should face criminal charges.
- chc 13y ago
  In that case, say goodbye to the Internet. Running any website with user accounts would be untenable if you can go to jail just because somebody found yet another Rails 0-day.
  - gioele 13y ago
    So refuse to have proper user account, make user accounts simple links to OpenID records and have the OpenID provider secure the personal data. The real question is "why websites (businesses) want user accounts and their personal data?". They answer is "to sell that data or to profile it". You want my data to earn more? You protect it or you are liable for it.
hayksaakian 13y ago
the unlocked door analogy makes no sense in a business context. Businesses have a legal obligation to secure private information of third parties (you and me). If I, as an individual, choose to leave my doors unlocked, that's my prerogative, but if it endangers the security of those that depend on me, then that's my responsibility to take the fall if thieves rob my house.
- film42 13y ago
  Exactly. If I own a bank, and keep a shed with all my money in it, with no padlock, and someone robs me, I'm going to prosecute them to the fullest. Meanwhile, I'm just as guilty for failing to secure the holdings of my customers. Now, what happens if instead of robbing, someone informs me, "your vault (shed) is highly vulnerable, you need to fix it." Right now, businesses say, "Ha! That's theft! You're going to prison, and you probably stole some money too!" The problem is not with the hacker, but with the system.
EthanHeilman 13y ago
>being stupid and forgetting to lock your front door certainly isn't a crime. It's sidewalks all over again. If I have sidewalk and I don't make it safe for people to walk on, I am liable. No different with security, companies have a responsibility.
- LinaLauneBaer 13y ago
  You are not liable. At least not according to most laws in european countries. It may be different in the US though. If you don't make your sidewalk safe for people and someone breaks his neck because of that you are only liable if it was not obvious that the sidewalk was not safe. For example: If there is ice on the sidewalk it is obvious that it is not safe to walk on. Same is true for a wet floor in the supermarket. Even without a sign saying "DANGER" it is obvious that it is dangerous to walk over the wet floor fast. In most european countries not removing the ice from your sidewalk can only be punished with a monetary fine. But it has nothing to do with paying for other peoples injuries.
  - apgwoz 13y ago
    It is of course not always obvious that there is a) ice on a sidewalk. b) that a floor is wet.
    - LinaLauneBaer 13y ago
      In most cases I am sure it is obvious. If there is 0 F outside, snow, dark, icy sidewalks and you are going outside acting like it is summer and you fall down it is your own fault and nobody except you is liable for that. I think we agree here. I can only talk about the German court system in detail but usually cases where somebody breaks his arm because of an icy sidewalk do not even end up in a court room. For a sidewalk to be icy it has to be cold. If you are going outside, it is cold and your are acting like it is summer (even without snow, it being dark, ...) you are the one who fell and nobody is liable for that. It is common knowledge that you should be careful. This is at least how it works in Germany and in many countries in Europe.
- 13y ago

by ninjin 13y ago

sp332 13y ago

If it's a company's own data, then fine. But if they take my personal data and then expose me to risk by showing it to any passer-by, they should face criminal charges.

chc 13y ago
In that case, say goodbye to the Internet. Running any website with user accounts would be untenable if you can go to jail just because somebody found yet another Rails 0-day.
- gioele 13y ago
  So refuse to have proper user account, make user accounts simple links to OpenID records and have the OpenID provider secure the personal data. The real question is "why websites (businesses) want user accounts and their personal data?". They answer is "to sell that data or to profile it". You want my data to earn more? You protect it or you are liable for it.

hayksaakian 13y ago

the unlocked door analogy makes no sense in a business context. Businesses have a legal obligation to secure private information of third parties (you and me). If I, as an individual, choose to leave my doors unlocked, that's my prerogative, but if it endangers the security of those that depend on me, then that's my responsibility to take the fall if thieves rob my house.

film42 13y ago
Exactly. If I own a bank, and keep a shed with all my money in it, with no padlock, and someone robs me, I'm going to prosecute them to the fullest. Meanwhile, I'm just as guilty for failing to secure the holdings of my customers. Now, what happens if instead of robbing, someone informs me, "your vault (shed) is highly vulnerable, you need to fix it." Right now, businesses say, "Ha! That's theft! You're going to prison, and you probably stole some money too!" The problem is not with the hacker, but with the system.

EthanHeilman 13y ago

>being stupid and forgetting to lock your front door certainly isn't a crime. It's sidewalks all over again. If I have sidewalk and I don't make it safe for people to walk on, I am liable. No different with security, companies have a responsibility.

LinaLauneBaer 13y ago
You are not liable. At least not according to most laws in european countries. It may be different in the US though. If you don't make your sidewalk safe for people and someone breaks his neck because of that you are only liable if it was not obvious that the sidewalk was not safe. For example: If there is ice on the sidewalk it is obvious that it is not safe to walk on. Same is true for a wet floor in the supermarket. Even without a sign saying "DANGER" it is obvious that it is dangerous to walk over the wet floor fast. In most european countries not removing the ice from your sidewalk can only be punished with a monetary fine. But it has nothing to do with paying for other peoples injuries.
- apgwoz 13y ago
  It is of course not always obvious that there is a) ice on a sidewalk. b) that a floor is wet.
  - LinaLauneBaer 13y ago
    In most cases I am sure it is obvious. If there is 0 F outside, snow, dark, icy sidewalks and you are going outside acting like it is summer and you fall down it is your own fault and nobody except you is liable for that. I think we agree here. I can only talk about the German court system in detail but usually cases where somebody breaks his arm because of an icy sidewalk do not even end up in a court room. For a sidewalk to be icy it has to be cold. If you are going outside, it is cold and your are acting like it is summer (even without snow, it being dark, ...) you are the one who fell and nobody is liable for that. It is common knowledge that you should be careful. This is at least how it works in Germany and in many countries in Europe.
13y ago