4 ms·

> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that

by camus2 13y ago

> When are we going to see legislation enacted to take these people to task? And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...

bruceboughton 13y ago
Pro-active enforcement is not always necessary. The possibility of a large fine if found in breach of the law is usually enough for responsible companies to take the matter seriously. Of course, you also need guidelines for implementation.
markdown 13y ago
> And how would you enforce this ? ... mandated paid audits No, that would be quite silly and wouldn't work. It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behind bars for negligence. I'm dreaming of course. Steal a loaf of bread, life in jail without parole. Expose the private data of millions... have a strong whisky, put out a press release, head to the golf course.
- sdoering 13y ago
  Even more simpler: If "adequate" protections are missing: Pay every breached user $10. That way such a breach gets a hefty price-tag and devs/PMs could argue with management, that it is economically feasible to implement these measures. I know of a PM, that tells devs, that report security-problems inside his product, that they should not care, but instead finish "that news shiny little thing" and that that is their job in his opinion, not detect some strange security-problem.
  - shubb 13y ago
    Well, what would happen would be, any sane bushiness would take out insurance, and the insurance companies would mandate / audit security best practices. If a shop wants to insure it's stock, the insurance company tell them what they need. An alarm? Big metal shutters? A night guard. Depends what you are guarding. In practice, a password is pretty valuable. Not to the company, but the loss to the user can be pretty significant. In the UK, the Data Protection Act does allow fines against companies that fail to encrypt specific information (inc passwords). They handed out 2.5MM in fines last year, but I think they mostly go after people selling data, rather than just messing up and losing it. Recent UK fines: http://www.ico.org.uk/enforcement/fines http://www.ico.org.uk/enforcement/fines OH WOW they fined sony after the geohotz hack http://www.ico.org.uk/enforcement/~/media/documents/library/Data_Protection/Notices/sony_monetary_penalty_notice.ashx http://www.ico.org.uk/enforcement/~/media/documents/library/... (only £200'000, but still)
  - aestra 13y ago
    It would be next to impossible to track down the majority of users, and I doubt each user would like to fork over more personal info for just $10. Paid money would be very small vs amount of accounts.

by camus2 13y ago

bruceboughton 13y ago

Pro-active enforcement is not always necessary. The possibility of a large fine if found in breach of the law is usually enough for responsible companies to take the matter seriously. Of course, you also need guidelines for implementation.

markdown 13y ago

> And how would you enforce this ? ... mandated paid audits No, that would be quite silly and wouldn't work. It could simply be reactive rather than proactive. When an incident occurs where sensitive user data is exposed, simply launch an investigation into whether there were "adequate" protections in place. If it is found that sensitive data was stored unencrypted, for example, put the directors of the company behind bars for negligence. I'm dreaming of course. Steal a loaf of bread, life in jail without parole. Expose the private data of millions... have a strong whisky, put out a press release, head to the golf course.

sdoering 13y ago
Even more simpler: If "adequate" protections are missing: Pay every breached user $10. That way such a breach gets a hefty price-tag and devs/PMs could argue with management, that it is economically feasible to implement these measures. I know of a PM, that tells devs, that report security-problems inside his product, that they should not care, but instead finish "that news shiny little thing" and that that is their job in his opinion, not detect some strange security-problem.
- shubb 13y ago
  Well, what would happen would be, any sane bushiness would take out insurance, and the insurance companies would mandate / audit security best practices. If a shop wants to insure it's stock, the insurance company tell them what they need. An alarm? Big metal shutters? A night guard. Depends what you are guarding. In practice, a password is pretty valuable. Not to the company, but the loss to the user can be pretty significant. In the UK, the Data Protection Act does allow fines against companies that fail to encrypt specific information (inc passwords). They handed out 2.5MM in fines last year, but I think they mostly go after people selling data, rather than just messing up and losing it. Recent UK fines: http://www.ico.org.uk/enforcement/fines http://www.ico.org.uk/enforcement/fines OH WOW they fined sony after the geohotz hack http://www.ico.org.uk/enforcement/~/media/documents/library/Data_Protection/Notices/sony_monetary_penalty_notice.ashx http://www.ico.org.uk/enforcement/~/media/documents/library/... (only £200'000, but still)
- aestra 13y ago
  It would be next to impossible to track down the majority of users, and I doubt each user would like to fork over more personal info for just $10. Paid money would be very small vs amount of accounts.