The privacy wars are about to get a whole lot worse • Hacker News Board

Re: The privacy wars are about to get a whole lot worse

#131

Post by dredmorbius » Thu, Sep 08, 2016, 1:00 AM UTC

ahartman00 wrote: post #114

krupan wrote: post #108

Earlier quoted context omitted.

I think I'm with Cory on this. It's negligence if you leak it. Period. Nobody is obligated to hoard and store a bunch of sensitive personal data from their customers.

In the specific hacks I was thinking of, they didnt hoard and store any info. Equipment was installed that siphoned credit card info from their payment systems. I cant think of a way to run a store without passing credit card info through your payment processing system to the banks.

Build a system that's not based off of shared secrets.

Now if only someone would invent a mechanism by which a public and a private key could somehow be combined and only the public part shared....

Re: The privacy wars are about to get a whole lot worse

#132

Post by dredmorbius » Thu, Sep 08, 2016, 1:05 AM UTC

StavrosK wrote: post #126

krupan wrote: post #116

Earlier quoted context omitted.

Agreed, credit cards are a ridiculous necessity. I think in this case the credit card companies should be liable. I am continually amazed by the simple solution bitcoin provides to this problem: instead of me giving you an account number that you (or anyone who gets the number) pull(s) money from, you give me a number that I push money to. It's going to be a long time before that kind of change in our payment systems…

> It's going to be a long time before that kind of change in our payment systems can be widely implemented. That's how bank transfers work, though.

SWIFT's had its own set of issues:

http://www.reuters.com/article/us-cyber-heist-swift-idUSKCN1...

http://nymag.com/daily/intelligencer/2016/06/the-hack-that-c...

Re: The privacy wars are about to get a whole lot worse

#133

Post by ahartman00 » Thu, Sep 08, 2016, 1:17 AM UTC

dredmorbius wrote: post #131

ahartman00 wrote: post #114

Earlier quoted context omitted.

In the specific hacks I was thinking of, they didnt hoard and store any info. Equipment was installed that siphoned credit card info from their payment systems. I cant think of a way to run a store without passing credit card info through your payment processing system to the banks.

Build a system that's not based off of shared secrets. Now if only someone would invent a mechanism by which a public and a private key could somehow be combined and only the public part shared....

Bitcoin has had its own issues:

http://bravenewcoin.com/news/blockchain-info-bug-exposes-use...

http://www.techworm.net/2016/02/researchers-find-a-easy-way-...

http://www.theverge.com/2016/8/2/12364122/bitfinex-theft-61-...

Re: The privacy wars are about to get a whole lot worse

#134

Post by skewart » Thu, Sep 08, 2016, 1:43 AM UTC

ahartman00 wrote: post #94

ryandrake wrote: post #76

> Eventually, some lawyer is going to convince a judge that, say, 1% the victims of a deep-pocketed company’s breach will end up losing their houses to identity thieves as a result of the data that the company has leaked, and that the damages should be equal to 1% of all the property owned by a 53 million (or 500 million!) customers whom the company has wronged. It will take down a Fortune 100 company, and transfer b…

"They're portraying the negligent company as the victim!" While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Saying "dont hire bad people" is easy, but how do you do that? And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was no…

> How do we decide when it is negligence, and when there was nothing that could be done?

As others have pointed out, that question is one that courts deal with every day in other industries.

IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professional have done in this case?" Would any reasonable contractor have interpreted those drawings to mean the joists should be spaced 24" apart? Or would a reasonable professional have interpreted it to be 20"?

The same standard could be applied to software engineering and data breaches. Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016?

I suspect as soon as any amount of precedent is set for lawsuits around "hacking" law firms will push open the floodgates and it will suddenly become very common.

In the construction industry the frequency of lawsuits has created a culture where people go to great lengths to reduce their risk of liability. Architects draw deliberately vague details around waterproofing and contractors push to have every detail for how to do things spelled out on paper, so they won't be on the hook if one of the steps in the process is wrong.

Re: The privacy wars are about to get a whole lot worse

#135

Post by skewart » Thu, Sep 08, 2016, 1:50 AM UTC

ryandrake wrote: post #76

> Eventually, some lawyer is going to convince a judge that, say, 1% the victims of a deep-pocketed company’s breach will end up losing their houses to identity thieves as a result of the data that the company has leaked, and that the damages should be equal to 1% of all the property owned by a 53 million (or 500 million!) customers whom the company has wronged. It will take down a Fortune 100 company, and transfer b…

> I can't sue Home Depot for giving up my credit card info to hackers unless I can prove that it led to someone running up my credit card bill.

It's funny how personal data is so clearly valuable - if it weren't companies wouldn't spend resources to hang on to it - and yet that value is so hard to define.

I wonder if it would be helpful if personal information were treated like some kind of intellectual property which could be licensed out, and there were some kind of market for doing so. If a company leaked my data I could sue them like a record company suing individuals who share music files.

Of course, any one individual might not be able to make much money by selling access to their data. It's just a thought.

Re: The privacy wars are about to get a whole lot worse

#136

Post by sooheon » Thu, Sep 08, 2016, 1:58 AM UTC

skewart wrote: post #134

ahartman00 wrote: post #94

Earlier quoted context omitted.

"They're portraying the negligent company as the victim!" While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Saying "dont hire bad people" is easy, but how do you do that? And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was no…

> How do we decide when it is negligence, and when there was nothing that could be done? As others have pointed out, that question is one that courts deal with every day in other industries. IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professi…

How do architects get away with vague details when lives can be on the line? If they design the building correctly, they should be pushing to make things as explicit as possible so that when contractors make a mistake it is clear where the fault is. It seems unprofessional that they'd be pushing in the other direction.

Re: The privacy wars are about to get a whole lot worse

#137

Post by ams6110 » Thu, Sep 08, 2016, 2:13 AM UTC

skewart wrote: post #134

ahartman00 wrote: post #94

Earlier quoted context omitted.

"They're portraying the negligent company as the victim!" While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Saying "dont hire bad people" is easy, but how do you do that? And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was no…

> How do we decide when it is negligence, and when there was nothing that could be done? As others have pointed out, that question is one that courts deal with every day in other industries. IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professi…

Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016

You are suggesting that a software engineer should be personally liable for the code he writes, just as a civil engineer is liable when he stamps a blueprint.

That would be quite a change for our profession.

Re: The privacy wars are about to get a whole lot worse

#138

Post by ams6110 » Thu, Sep 08, 2016, 2:17 AM UTC

CaptSpify wrote: post #104

ahartman00 wrote: post #94

Earlier quoted context omitted.

"They're portraying the negligent company as the victim!" While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Saying "dont hire bad people" is easy, but how do you do that? And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was no…

Do you regularly hire contractors and then never look over the work they do? Because I don't, and frankly, that's kind of idiotic. The data is your responsibility, not theirs. They also have no interest in the longevity of your company, why would you trust them without checking what they are doing? As a customer, I don't care how Home-Depot handed out my CC info, I care that they did. Sure some hacks happened despite…

Do you regularly hire contractors and then never look over the work they do?

Most people do this all the time. When you have your car serviced, do you look over the work? Some people do, sure -- those who know what to look for. Most people don't, because they have no basis upon which to judge the quality of the work.

Re: The privacy wars are about to get a whole lot worse

#139

Post by josephg » Thu, Sep 08, 2016, 2:41 AM UTC

ams6110 wrote: post #137

skewart wrote: post #134

Earlier quoted context omitted.

> How do we decide when it is negligence, and when there was nothing that could be done? As others have pointed out, that question is one that courts deal with every day in other industries. IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professi…

Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016 You are suggesting that a software engineer should be personally liable for the code he writes, just as a civil engineer is liable when he stamps a blueprint. That would be quite a change for our profession.

The reality is that today nobody is responsible for data security. Developers foist the risk onto consumers, who don't have any real choice in the matter, and don't even know what the real risk profile is that they (we) are agreeing to. If you accept that somebody, somewhere needs to be held responsible for data breaches, the most sensible party is us. We have all the domain knowledge and we're the only ones who can actually protect our user's data.

And I say this as someone who's spent time in consulting. The prices would necessarily go up in the face of litigation. But I think it would be well worth it - I'd love to be able to financially justify taking extra time to make the systems I build secure. (I make systems secure anyway of course, but I'm competing with companies packed full of General Assembly grads who don't know what a hashing function is yet.)

Re: The privacy wars are about to get a whole lot worse

#140

Post by ams6110 » Thu, Sep 08, 2016, 2:41 AM UTC

AlexandrB wrote: post #5

abstractbeliefs wrote: post #3

Earlier quoted context omitted.

Well, the most effective response is already here: don't use the service. While that can be a big ask for many services, we're also doing a great job of replicating the functionality of many closed services in an open way. As long as the FOSS/hobby tech world still cares, we'll keep biting away at the new markets closed services create.

> As long as the FOSS/hobby tech world still cares, we'll keep biting away at the new markets closed services create. I think nibbling away is more accurate. There are still no privacy-conscious alternatives to the big 3 social networks (Facebook/Twitter/LinkedIn) and none on the horizon. Yes technological alternatives exist, but not practical ones as I'm not likely to run into someone using Diaspora in real life. Th…

I fundamentally don't see how "social network" (especially the use cases covered by Facebook, LinkedIn, and Twitter) and "privacy" can ever exist together.