5 ms·

This is getting ridiculous. When are we going to see legislation enacted to take these people to task? Surely there is a case to be made that their negligence

This is getting ridiculous. When are we going to see legislation enacted to take these people to task? Surely there is a case to be made that their negligence causes (or has the potential to cause) real harm to their users. We need a Saul Goodman to put together a class action.

camus2 13y ago
> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...
- bruceboughton 13y ago
  Pro-active enforcement is not always necessary. The possibility of a large fine if found in breach of the law is usually enough for responsible companies to take the matter seriously. Of course, you also need guidelines for implementation.
- markdown 13y ago
  > And how would you enforce this ? ... mandated paid audits No, that would be quite silly and wouldn't work. It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behind bars for negligence. I'm dreaming of course. Steal a loaf of bread, life in jail without parole. Expose the private data of millions... have a strong whisky, put out a press release, head to the golf course.
  - sdoering 13y ago
    Even more simpler: If "adequate" protections are missing: Pay every breached user $10. That way such a breach gets a hefty price-tag and devs/PMs could argue with management, that it is economically feasible to implement these measures. I know of a PM, that tells devs, that report security-problems inside his product, that they should not care, but instead finish "that news shiny little thing" and that that is their job in his opinion, not detect some strange security-problem.
    - shubb 13y ago
      Well, what would happen would be, any sane bushiness would take out insurance, and the insurance companies would mandate / audit security best practices. If a shop wants to insure it's stock, the insurance company tell them what they need. An alarm? Big metal shutters? A night guard. Depends what you are guarding. In practice, a password is pretty valuable. Not to the company, but the loss to the user can be pretty significant. In the UK, the Data Protection Act does allow fines against companies that fail to encrypt specific information (inc passwords). They handed out 2.5MM in fines last year, but I think they mostly go after people selling data, rather than just messing up and losing it. Recent UK fines: http://www.ico.org.uk/enforcement/fines http://www.ico.org.uk/enforcement/fines OH WOW they fined sony after the geohotz hack http://www.ico.org.uk/enforcement/~/media/documents/library/Data_Protection/Notices/sony_monetary_penalty_notice.ashx http://www.ico.org.uk/enforcement/~/media/documents/library/... (only £200'000, but still)
    - aestra 13y ago
      It would be next to impossible to track down the majority of users, and I doubt each user would like to fork over more personal info for just $10. Paid money would be very small vs amount of accounts.
danenania 13y ago
Yes, the government would surely do a great job legislating development standards. Just look how terrifically they've handled software patents.
- TomGullen 13y ago
  Free markets currently doing a pretty awful job of it as we keep learning. Perhaps some government legislation would help.
  - adventured 13y ago
    You can't legislate away stupid behavior. There will always be an endless parade of poor choices. If it's not 'this,' it's 'that' and then the next 'thing.' There is no scenario under which a government entity can enforce, keep up with, or properly control such.
    - markdown 13y ago
      That's like arguing that there shouldn't be penalties for drink driving (called DUI in the US) because people will always make poor choices. There needs to be a strong deterrent.
  - danenania 13y ago
    All legislation would do is put a big layer of ineffective bureaucracy between developers and getting work done. Get the government involved and it won't be long before you need to fill out 15 forms and hire a lawyer to put your weekend project online. Is that the kind of internet you want?
    - aestra 13y ago
      Yeah, all those building codes do is put a big layer of ineffective bureaucracy between the people who architect and do construction and getting work done. Yeah, all those sanitation codes do is put a big layer of ineffective bureaucracy between the people prepare food and getting work done.
possibilistic 13y ago
I agree that there should be legislation against saving plaintext passwords. Otherwise there is no repercussion for these kind of parties that put confidential information at risk. Honestly, people are not going to change their password habits, i.e. we can't expect users not to reuse the same password at different sites. Moreover, I would wager that most people trust that websites are inherently secure and that password-related functions are safe. The party to blame, then, is squarely the website that allows the leak of unhashed, unsalted passwords. I believe we should seek legislation similar to HIPAA wherein the damages are inversely proportional to the ignorance and mitigation preparedness of the party to blame. (Damages might also be directly proportional to number of accounts breached, but only after the former is considered.) As an example, imagine that a kid acting alone gets his forum or website broken into. There's probably not much that a teenager would have known about password security. Additionally, they probably weren't servicing millions of users as a part of a commercial service. You can apply this same kind of situational blamelessness to small businesses, clubs, churches, and so forth. If, however, a multi-million dollar company gets breached, it's a likely different story. Such a company has employed engineers that are familiar with such topics as scaling and cross-browser support. If these types of business concerns are known and handled, then it's almost a certainty that they also know about password hashing. (If not, I would bet that new legislation would result in widespread education on the issue.) If the cost of changes is estimated to be too high, we could even go as far as to lower or absolve damages if the 3rd party were to inform its users that its passwords were not hashed or not salted; a "use at your own risk" notice, if you will. I feel strongly that we need to do something drastic about unhashed/unsalted passwords. This is becoming absolutely ridiculous; it makes our profession look like a circus show, and all for something that can be easily avoided.

camus2 13y ago

> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...

bruceboughton 13y ago
Pro-active enforcement is not always necessary. The possibility of a large fine if found in breach of the law is usually enough for responsible companies to take the matter seriously. Of course, you also need guidelines for implementation.
markdown 13y ago
> And how would you enforce this ? ... mandated paid audits No, that would be quite silly and wouldn't work. It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behind bars for negligence. I'm dreaming of course. Steal a loaf of bread, life in jail without parole. Expose the private data of millions... have a strong whisky, put out a press release, head to the golf course.
- sdoering 13y ago
  Even more simpler: If "adequate" protections are missing: Pay every breached user $10. That way such a breach gets a hefty price-tag and devs/PMs could argue with management, that it is economically feasible to implement these measures. I know of a PM, that tells devs, that report security-problems inside his product, that they should not care, but instead finish "that news shiny little thing" and that that is their job in his opinion, not detect some strange security-problem.
  - shubb 13y ago
    Well, what would happen would be, any sane bushiness would take out insurance, and the insurance companies would mandate / audit security best practices. If a shop wants to insure it's stock, the insurance company tell them what they need. An alarm? Big metal shutters? A night guard. Depends what you are guarding. In practice, a password is pretty valuable. Not to the company, but the loss to the user can be pretty significant. In the UK, the Data Protection Act does allow fines against companies that fail to encrypt specific information (inc passwords). They handed out 2.5MM in fines last year, but I think they mostly go after people selling data, rather than just messing up and losing it. Recent UK fines: http://www.ico.org.uk/enforcement/fines http://www.ico.org.uk/enforcement/fines OH WOW they fined sony after the geohotz hack http://www.ico.org.uk/enforcement/~/media/documents/library/Data_Protection/Notices/sony_monetary_penalty_notice.ashx http://www.ico.org.uk/enforcement/~/media/documents/library/... (only £200'000, but still)
  - aestra 13y ago
    It would be next to impossible to track down the majority of users, and I doubt each user would like to fork over more personal info for just $10. Paid money would be very small vs amount of accounts.

danenania 13y ago

Yes, the government would surely do a great job legislating development standards. Just look how terrifically they've handled software patents.

TomGullen 13y ago
Free markets currently doing a pretty awful job of it as we keep learning. Perhaps some government legislation would help.
- adventured 13y ago
  You can't legislate away stupid behavior. There will always be an endless parade of poor choices. If it's not 'this,' it's 'that' and then the next 'thing.' There is no scenario under which a government entity can enforce, keep up with, or properly control such.
  - markdown 13y ago
    That's like arguing that there shouldn't be penalties for drink driving (called DUI in the US) because people will always make poor choices. There needs to be a strong deterrent.
- danenania 13y ago
  All legislation would do is put a big layer of ineffective bureaucracy between developers and getting work done. Get the government involved and it won't be long before you need to fill out 15 forms and hire a lawyer to put your weekend project online. Is that the kind of internet you want?
  - aestra 13y ago
    Yeah, all those building codes do is put a big layer of ineffective bureaucracy between the people who architect and do construction and getting work done. Yeah, all those sanitation codes do is put a big layer of ineffective bureaucracy between the people prepare food and getting work done.

possibilistic 13y ago

I agree that there should be legislation against saving plaintext passwords. Otherwise there is no repercussion for these kind of parties that put confidential information at risk. Honestly, people are not going to change their password habits, i.e. we can't expect users not to reuse the same password at different sites. Moreover, I would wager that most people trust that websites are inherently secure and that password-related functions are safe. The party to blame, then, is squarely the website that allows the leak of unhashed, unsalted passwords. I believe we should seek legislation similar to HIPAA wherein the damages are inversely proportional to the ignorance and mitigation preparedness of the party to blame. (Damages might also be directly proportional to number of accounts breached, but only after the former is considered.) As an example, imagine that a kid acting alone gets his forum or website broken into. There's probably not much that a teenager would have known about password security. Additionally, they probably weren't servicing millions of users as a part of a commercial service. You can apply this same kind of situational blamelessness to small businesses, clubs, churches, and so forth. If, however, a multi-million dollar company gets breached, it's a likely different story. Such a company has employed engineers that are familiar with such topics as scaling and cross-browser support. If these types of business concerns are known and handled, then it's almost a certainty that they also know about password hashing. (If not, I would bet that new legislation would result in widespread education on the issue.) If the cost of changes is estimated to be too high, we could even go as far as to lower or absolve damages if the 3rd party were to inform its users that its passwords were not hashed or not salted; a "use at your own risk" notice, if you will. I feel strongly that we need to do something drastic about unhashed/unsalted passwords. This is becoming absolutely ridiculous; it makes our profession look like a circus show, and all for something that can be easily avoided.