[deleted]
Yahoo installed a backdoor for the NSA behind the back of the security team
31–40 of 302 posts
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#32I know this is from October, but it warrants re-reading now.
Today, Yahoo announced a hack of 1B accounts. They say they don't know who it is, but we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it.
Previously, Yahoo willingly assisted an attacker in compromising 1B accounts. In this case, they did not disclose the attack publicly, or even to their own chief information security officer, because in that instance the attacker was the US government itself.
US intelligence activities are actively harmful to American commercial interests because they destroy trust, particularly from customers elsewhere in the world.
[1] http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-...
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#33I would be surprised if anyone was using Yahoo for anything but a spam account when this occurred.
I guess a really good indicator that things were not right was when the CSO left the company with no real reason. He was like I want no part of this shit.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#34Whelp. Yahoo is officially over today. It was quite a fall.
Do you think? Seems to me people are getting used to accounts being hacked, it's not such a big deal any more, in fact it may be even an expectation. And as for government NSA hacking, well that's just old news and a given isn't it?
Here is some news which is probably new. Rambus has an NSA backdoor in their crypto.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#35I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…
The people who do this aren't wilful engineers.
Source: I'm a former member of Yahoo's Paranoid team.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#36Seriously, why the title change? Sometimes the title tells you nothing - wouldn't it be reasonable HN policy to allow the title if it's an accurate summary of the first paragraph?
"Yesterday morning, Reuters dropped a news story revealing that Yahoo installed a backdoor on their own infrastructure in 2015 in compliance with a secret order from either the FBI or the NSA"
Edit: Looks like it's changed back now - great. For a brief period the title was set to "Surveillance, whistleblowing, and security engineering".
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#37I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…
I don't know how common this is in general, but an ethics course was a required part of the engineering core curricula at my school (Case Western Reserve). Ultimately, though, an ethics course isn't going to make people stand up for their ethics. A professional organization along the lines of the American Medical Association (at least in terms of political strength) that stands up for its members and censures those w…
I agree, I'm not sure that an ethics course will make people behave ethically.
As part of my former life, I had to take an Ethics course for my accounting license. It focused on topics like conflicts of interest. Even though many professional (licensed) accountants have taken the ethics course and passed an ethics exam, it doesn't mean that much. Ultimately, behaving ethically will come down the individual's morals.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#38Earlier quoted context omitted.
When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.
People have the option to quit. The company is legally bound to obey, but individual employees can chose for themselves whether they want to be a party to it. Yahoo may still be court ordered to implement it, just hopefully not with their best and brightest developers. I also have a theory that a lot of the recent terrible news coming out of Yahoo is due to staff complying with the letter of the legal order but not t…
Unfortunately it's not that simple. More often than not, someone high up will find someone low whose continued stay in the country is highly dependent on them keeping this job.
While I've never had to make such a choice, I can tell you that my personal attitude towards what I would and wouldn't do changed the day this restriction was removed.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#39Whelp. Yahoo is officially over today. It was quite a fall.
Do you think? Seems to me people are getting used to accounts being hacked, it's not such a big deal any more, in fact it may be even an expectation. And as for government NSA hacking, well that's just old news and a given isn't it?
...lol?
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#40I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…
At my school (Northern Arizona University), CS students are required to do exactly this.