4 ms·
It also highlights that the privacy and security were not as important to management as launching the app on a fixed deadline.
by KevinEldon 13y ago
It also highlights that the privacy and security were not as important to management as launching the app on a fixed deadline.
- generj 13y agoYes, in that the security checks were forced through. But that's not atypical - the security requirements for federal sites are amazingly complex to navigate, and even if the site was a) functional and b) secure in time for testing, it's likely they would have punted that down the road a bit, or even indefinitely. The mind still boggles. If I was even asked by a client to put a password reset in analytics, I would report it to my manager immediately, then refuse the client's request. If the client didn't give up on tracking this, we'd have to stop working for them. That's how serious raw PII is in analytics. You'd have to be seriously incompetent to even consider tracking a password request.
- pionar 13y ago"Never attribute to malice that which is adequately explained by stupidity." I think that situation was probably just sloppy coding of some sort, not an intentional act.
- generj 13y agoReflecting on the blogger sourced by Arstechnica, you are correct. The data is present in the URL (queryString) for the page, so there is nothing malicious about the analytics code, which is merely going about it's default of reporting the URL of the page. Returning that sort of data in a queryString is still far outside the realm of common sense.
- Spooky23 13y agoOf course. They already had to do a password reset for everyone -- it's probably been breached already.