3 ms·

There is no evidence for anything in the news reports. It looks like the BSI is just phishing for active mail accounts. Looks like the german goverment will nev

by mzehrer 13y ago

There is no evidence for anything in the news reports. It looks like the BSI is just phishing for active mail accounts. Looks like the german goverment will never understand that security == transparency.

morsch 13y ago
The article is light on the details. Apparently, the addresses were gathered from defunct botnets. You're right that there's no evidence for this, though I'm not sure what kind of evidence you expect. I think the idea that this is the BSI gathering active email accounts is pretty preposterous.
- mzehrer 13y ago
  Both ideas are founded on the same amount of evidence... the BSI should be open about it's sources. But they just decuded to scare people.
epaga 13y ago
I'd disagree that security == transparency. You can not have security without transparency, but you can certainly have transparency without security. As for the idea that they are "phishing for active mail accounts", I find that pretty far-fetched to be honest. What use would a vast list of email addresses of normal people be of use to them? To spam them?
- ams6110 13y ago
  You can have transparency without security, but at least you then know you don't have security, and can act accordingly.
PeterWhittaker 13y ago
I'm not sure how to read security == transparency. Now bear in mind that I tend to favour radical transparency, e.g., in government reporting and accountability, provided that it does not override personal privacy, i.e., data is anonymized, masked, etc.... But there are many cases where transparency != security, or perhaps a better way of putting it would be transparency XOR security. For example, witness protection programs, police informants, classified military and intelligence information, etc. In all of these cases, there should be a certain transparency of program governance and policy, with ZERO transparency of program procedure and information details: If you have no need to know, you get to know exactly and perfectly nothing, lest people die. Like it or not, there are times when transparency is the enemy of security. The trick is documenting those cases well and implementing appropriate policy, governance, and oversight. It's quite a trick.

by mzehrer 13y ago

morsch 13y ago

The article is light on the details. Apparently, the addresses were gathered from defunct botnets. You're right that there's no evidence for this, though I'm not sure what kind of evidence you expect. I think the idea that this is the BSI gathering active email accounts is pretty preposterous.

mzehrer 13y ago
Both ideas are founded on the same amount of evidence... the BSI should be open about it's sources. But they just decuded to scare people.

epaga 13y ago

I'd disagree that security == transparency. You can not have security without transparency, but you can certainly have transparency without security. As for the idea that they are "phishing for active mail accounts", I find that pretty far-fetched to be honest. What use would a vast list of email addresses of normal people be of use to them? To spam them?

ams6110 13y ago
You can have transparency without security, but at least you then know you don't have security, and can act accordingly.

PeterWhittaker 13y ago

I'm not sure how to read security == transparency. Now bear in mind that I tend to favour radical transparency, e.g., in government reporting and accountability, provided that it does not override personal privacy, i.e., data is anonymized, masked, etc.... But there are many cases where transparency != security, or perhaps a better way of putting it would be transparency XOR security. For example, witness protection programs, police informants, classified military and intelligence information, etc. In all of these cases, there should be a certain transparency of program governance and policy, with ZERO transparency of program procedure and information details: If you have no need to know, you get to know exactly and perfectly nothing, lest people die. Like it or not, there are times when transparency is the enemy of security. The trick is documenting those cases well and implementing appropriate policy, governance, and oversight. It's quite a trick.