Panerabread.com leaks millions of customer records • Hacker News Board

Re: Panerabread.com leaks millions of customer records

#81

Post by mschuster91 » Tue, Apr 03, 2018, 9:38 AM UTC

komali2 wrote: post #34

tyingq wrote: post #20

Earlier quoted context omitted.

"I’d prefer crippling fines" Probably won't happen until some Senator gets personally burned. Equifax hasn't suffered much, for example, and they released almost all of their info for every adult in the US that ever used a credit card or had a mortgage. I'm almost wishing some activist hacker would buy the data for the House and Senate reps and go to town...just to get their attention. Purchase pornhub accounts , sha…

My guess is that senators that have been burned have been done so secretly and are being blackmailed. The Equifax dump was apparently huge.

> My guess is that senators that have been burned have been done so secretly and are being blackmailed.

The whole bunch has been blackmailed for decades. Just not "ordinary" blackmailing, but threatening by big funders to cut said funding unless, for example, the politician keeps supporting NRA/BigAg/BigFinance-favorable policies...

Re: Panerabread.com leaks millions of customer records

#82

Post by detaro » Tue, Apr 03, 2018, 9:41 AM UTC

ethanwillis wrote: post #80

perl4ever wrote: post #71

Earlier quoted context omitted.

Well, at least they didn't leak their customers' HIV statuses, unlike the other security breach I read about yesterday...

Was that the Grindr one? That's a HIPAA violation.. big fines..

HIPAA only applies to health-care providers and related entities, not random other companies.

Re: Panerabread.com leaks millions of customer records

#83

Post by coldtea » Tue, Apr 03, 2018, 9:46 AM UTC

Buge wrote: post #77

RKearney wrote: post #66

Earlier quoted context omitted.

Aaron Swartz faced 35 years in prison for breaking and entering and unauthorized access of a computer network / hacking amongst other things. It's a shame it ended the way it did, but please don't downplay what he did and use his name to push an agenda.

> breaking and entering Is that true? It was an unlocked closet. The walls were covered in graffiti.

>Is that true? It was an unlocked closet. The walls were covered in graffiti.

So, if your house has the door ajar, and the walls are "covered in graffiti" it's open for all?

Re: Panerabread.com leaks millions of customer records

#84

Post by dx034 » Tue, Apr 03, 2018, 9:51 AM UTC

kevin_thibedeau wrote: post #48

Let me guess. They passed their PCI audits with flying colors.

To be fair, auditors can only check what they were hired to. PCI audits are better than having none at all but they clearly can't be the only audit.

Re: Panerabread.com leaks millions of customer records

#85

Post by Buge » Tue, Apr 03, 2018, 10:05 AM UTC

coldtea wrote: post #83

Buge wrote: post #77

Earlier quoted context omitted.

> breaking and entering Is that true? It was an unlocked closet. The walls were covered in graffiti.

> Is that true? It was an unlocked closet. The walls were covered in graffiti. So, if your house has the door ajar, and the walls are "covered in graffiti" it's open for all?

It wouldn't be breaking and entering.

And a house is different than a school. MIT has an open campus. MIT has a long history of celebrating students who transgress boundaries and go where it is unexpected[1]. I don't have a history of celebrating people who enter my house uninvited.

> Swartz had connections to [MIT]: "He was a regular visitor to the MIT campus and interacted with MIT people and groups both on campus and off. … He was a member of MIT's Free Culture Group, a regular visitor at MIT's Student Information Processing Board (SIPB), and an active participant in the annual MIT International Puzzle Mystery Hunt Competition. Aaron Swartz's father, Robert Swartz, was (and is) a consultant at the MIT Media Lab. Aaron frequently visited his father there, and his two younger brothers had been Media Lab interns." [2]

If a good friend of mine sees my house has the door ajar, and the walls are "covered in graffiti" it would be perfectly reasonable for him to check inside.

[1] https://en.wikipedia.org/wiki/Hacks_at_the_Massachusetts_Ins...

[2] http://swartz-report.mit.edu/faq.html

Re: Panerabread.com leaks millions of customer records

#86

Post by zimpenfish » Tue, Apr 03, 2018, 10:53 AM UTC

Buge wrote: post #85

coldtea wrote: post #83

Earlier quoted context omitted.

> Is that true? It was an unlocked closet. The walls were covered in graffiti. So, if your house has the door ajar, and the walls are "covered in graffiti" it's open for all?

It wouldn't be breaking and entering. And a house is different than a school. MIT has an open campus. MIT has a long history of celebrating students who transgress boundaries and go where it is unexpected[1]. I don't have a history of celebrating people who enter my house uninvited. > Swartz had connections to [MIT]: "He was a regular visitor to the MIT campus and interacted with MIT people and groups both on campus…

> It wouldn't be breaking and entering.

I think it would qualify for the UK equivalent.

https://en.wikipedia.org/wiki/Burglary_in_English_law#Elemen...

Re: Panerabread.com leaks millions of customer records

#87

Post by zimpenfish » Tue, Apr 03, 2018, 10:58 AM UTC

richsherwood wrote: post #61

1690v wrote: post #28

Earlier quoted context omitted.

That is a terrible idea. Imagine sentencing programmers to jail for security issues in their code.

Engineers in other disciplines are held liable for their mistakes. Imagine a civil engineer signing off on a building and then having it collapse. If it was found that the engineer was negligent then you can bet your ass there will be reprucussions. As an engineer, you are the top of your field and with that comes a professional responsibility that is important to fully realize. Mistakes are mistakes sure, but if tho…

> Engineers in other disciplines are held liable for their mistakes.

To be fair, they have several hundred (if not thousands of) years of trial and error, documentation, etc. behind them to (try and) help people avoid the mistakes.

Computer Science has barely 70 years of half-arsed fumbling about.

Re: Panerabread.com leaks millions of customer records

#88

Post by maxlybbert » Tue, Apr 03, 2018, 11:13 AM UTC

kevin_thibedeau wrote: post #48

Let me guess. They passed their PCI audits with flying colors.

I’m sure the only reason that only partial credit card numbers were stolen is that PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back).

Re: Panerabread.com leaks millions of customer records

#89

Post by arkades » Tue, Apr 03, 2018, 11:20 AM UTC

richsherwood wrote: post #61

1690v wrote: post #28

Earlier quoted context omitted.

That is a terrible idea. Imagine sentencing programmers to jail for security issues in their code.

Engineers in other disciplines are held liable for their mistakes. Imagine a civil engineer signing off on a building and then having it collapse. If it was found that the engineer was negligent then you can bet your ass there will be reprucussions. As an engineer, you are the top of your field and with that comes a professional responsibility that is important to fully realize. Mistakes are mistakes sure, but if tho…

> imagine a civil engineer

But there isn’t an equally trained engineer dedicating his energy to taking down the bridge - it only has to not collapse under normal usage.

When a bridge is intentionally destroyed by enemy action, it’s engineer is not held liable.

Re: Panerabread.com leaks millions of customer records

#90

Post by coldtea » Tue, Apr 03, 2018, 11:35 AM UTC

Buge wrote: post #85

coldtea wrote: post #83

Earlier quoted context omitted.

> Is that true? It was an unlocked closet. The walls were covered in graffiti. So, if your house has the door ajar, and the walls are "covered in graffiti" it's open for all?

It wouldn't be breaking and entering. And a house is different than a school. MIT has an open campus. MIT has a long history of celebrating students who transgress boundaries and go where it is unexpected[1]. I don't have a history of celebrating people who enter my house uninvited. > Swartz had connections to [MIT]: "He was a regular visitor to the MIT campus and interacted with MIT people and groups both on campus…

>MIT has a long history of celebrating students who transgress boundaries and go where it is unexpected[1]

Only when it's conservative enough and doesn't break the law too much. And not officially. In fact the very wikipedia link says:

"Although the practice is unsanctioned by the university, and students have sometimes been arraigned on trespassing charges for hacking, hacks have substantial significance to MIT's history and student culture".

>If a good friend of mine sees my house has the door ajar, and the walls are "covered in graffiti" it would be perfectly reasonable for him to check inside.

Not really. Especially if they know they're not welcomed if found inside, and they have no business there.