Righteous
A Hacker Has Wiped a Spyware Company’s Servers
51–60 of 120 posts
Re: A Hacker Has Wiped a Spyware Company’s Servers
#52Earlier quoted context omitted.
I wish they had done one more thing: notified everyone on whose devices this software was installed. If someone put this on my phone without my knowledge, I would want to know. (I would also almost certainly sue.)
Yes. I want to see that happen also. But I want to separate the part of me who wants to see fireworks from the "right thing to do" I think we need to think through the technicalities of notifying the hacked people, would they even know what to do with your email? Would they consider it spam or phishing and just delete it l? Assuming you're successful, what societal fallout could result? I don't know the answers to th…
> What's the intended outcome?
Punitive action against the company who collected the data and lost control of it.
Punitive penalties are typically just a monetary fine above and beyond damages, but exposing just how badly they screwed up to the public at large should provide a good financial penalty in addition to doing a public good (a reminder of how much "private" data is not actually private).
Re: A Hacker Has Wiped a Spyware Company’s Servers
#53I'm always amazed that people feel the need to utilize these products. People are aware that trust is the bedrock layer of relationships right? The minute someone installs this product, their relationship with the person they are monitoring is already over, they just don't know it yet.
I get what you are saying, but there can be legal/financial concerns attached to these things.
Monitoring usage of a corporate issue piece of equipment is very different than using it against a private individual without their knowledge
Re: A Hacker Has Wiped a Spyware Company’s Servers
#54Earlier quoted context omitted.
I recall that there are regulations about cars that make it more likely that a wide variety of owners will be able to maintain them successfully.
Really? That's interesting, can you elaborate?
The US regulates "wear bars" on tires, which make it a lot more obvious when tires need to be replaced.
I'm not saying that government regulation is needed, I'm just pointing out that the purpose of this tire feature is to make it more likely that people notice tire wear, and don't die from accidents involving bald tires.
Re: A Hacker Has Wiped a Spyware Company’s Servers
#55How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?
[deleted]
Re: A Hacker Has Wiped a Spyware Company’s Servers
#56Earlier quoted context omitted.
This is a common issue, and many apps do this mistake. Another common mistake is having /.git/ available on the domain itself, often with PHP sites or backend-less SPAs this is common, giving full access to the source, including those API keys. Even major sites do this – The Hill until recently had their git repo, including API tokens and access keys for everything, publicly available.
It should be mentioned that none of that should ever make its way into a Git repo in the first place. If a secret is committed to Git, it's compromised, period. Suck it up and generate a new secret.
only if your git is published.. I assume this is what you mean -
that said:
separate integration repo containing encrypted keys + separate, manual managment/configuration of the decryption process is fine for most cases.
but yes, bare and in mainline and published, I will agree this is terrible.
see also:
Re: A Hacker Has Wiped a Spyware Company’s Servers
#57Should expose the data online leaving the companies being sued for millions
Re: A Hacker Has Wiped a Spyware Company’s Servers
#58I'm always amazed that people feel the need to utilize these products. People are aware that trust is the bedrock layer of relationships right? The minute someone installs this product, their relationship with the person they are monitoring is already over, they just don't know it yet.
No, they are not aware that trust is the bedrock layer in a relationship. In the same way that people who verbally or physically abuse their spouses are unaware. They are filled with an all consuming jealousy that makes any violation of privacy seem justifiable to them. These are not people who are thinking rationally or sensibly.
Re: A Hacker Has Wiped a Spyware Company’s Servers
#59Earlier quoted context omitted.
We put thieves into prison because if theft were common it would increase distrust, society as a whole has an interest to fight theft, and we permit victims to sue the for restitution. In the same way society has a reason to put strict limits on surveillance. There's the other problem: what damages can someone with a spy app on their phone ask for? There is no monetery value, they can at most ask for relief, that's n…
> We put thieves in prison...In the same way society has a reason to put strict limits on surveillance On one hand, we have a stylised burglar. On the other, a stylised lockpicking tool maker. The former is illegal; the latter is more complicated. I am conservative about expanding the scope of the law. You criminalise surveillance apps in one decade and in the next, a security researcher disclosing a bug gets bitten.…
We've decided that privacy and freedom from surveillance is highly valued and deserving protection.
The target audience of that company is teenagers of helicopter parents. Whatever they have on their phones isn't privileged or valuable information, so the civil damages approach doesn't work too well. Some may have (against all advice) nudes on them, but I'd rather not wait until those are available to the public, and even then only those whose nudies escaped can sue.
The law needs to project the notion that privacy is valued, because it is highly valued. The only idea that I can come up with is to restrict availability of spyware. Others may have better suggestions.
Re: A Hacker Has Wiped a Spyware Company’s Servers
#60I'm torn by a lot of things here. The validity of the claims in the article, the correctness of the hacker to simply delete data, but also the "stalkerware" as described by the article. Surely there's got to be a better way of dealing with this atrocious software? How can it be legal in the first place?
I can't imagine it being legal under GDPR when that comes into force.