Earlier quoted context omitted.
Was that the Grindr one? That's a HIPAA violation.. big fines..
HIPAA only applies to health-care providers and related entities, not random other companies.
A fixable oversight, I hope.
Panerabread.com leaks millions of customer records
101–110 of 153 posts
Re: Panerabread.com leaks millions of customer records
#102Re: Panerabread.com leaks millions of customer records
#103Earlier quoted context omitted.
Don’t forget, “We’re sorry,” “We’ll do better,” and my personal favorite, “Trust us!” I’d prefer crippling fines.
"I’d prefer crippling fines" Probably won't happen until some Senator gets personally burned. Equifax hasn't suffered much, for example, and they released almost all of their info for every adult in the US that ever used a credit card or had a mortgage. I'm almost wishing some activist hacker would buy the data for the House and Senate reps and go to town...just to get their attention. Purchase pornhub accounts , sha…
I know HIBP's Troy HUnt has very carefully detailed his ethical and moral tradeoffs in what he does, and I appreciate that as a benchmark.
But I so want to lose my mind, start getting these breach db's and start emailing Congresscritters with "This email was hacked, you're screwed, we're screwed, and here's legit links to help fix our lives back up... (eff.org) (hibp) etc"
And now I'm on the watch list for when someone crazier than me actually does this. Sigh.
Re: Panerabread.com leaks millions of customer records
#104The standard "we take security very seriously" is starting to ring a bit hollow.
Companies that actually take it seriously don't have data breaches.
Re: Panerabread.com leaks millions of customer records
#105Maybe someone could go in to business and provide services that would help companies prevent these things from happening?
Because that would cause Panera a lot of money and the alternative (this) will likely cost them very little money. The choice then becomes clear: it's cheaper to tweet out an "oops" apology than to actually prevent it.
They don't care that your information got leaked, that doesn't enter into the calculation (unless it costs them money, which it doesn't).
Re: Panerabread.com leaks millions of customer records
#106Earlier quoted context omitted.
Not protected, simply not pursued, although it’s usually outright fraud that is the target of most prosecutions. Watching the SEC closely to see how many ICOs they prosecute. Also was helpful to see someone involved with their breech response who attempted to profit from non public material information prosecuted (although that’s tangential to the breach itself). Someone relatively important is going to have to get b…
You misunderstand my point. Are there examples of other sorts of engineers being brought up on charges? It only happens in the most egregious of negligence cases as it is and even then convictions are rare. I'm saying your impression that software engineering is protected is wrong, because no engineers (to any normal approximate) are brought up on criminal charges.
Lawsuits are commonplace in civil/geotechnical engineering because faulty work has life and death consequences for the general public. To be a certified professional engineer and sign-off on design plans in California you need to pass an exam, after which could result in issues of liability. This law practice defends professionals that may be in a dispute [0]. Here's a breakdown of why engineers might get sued [1]. Here's a case where a company was held liable for damages associated with a construction project [2].
The title 'software engineer' without any notion of liability is an exercise in stroking ones ego.
[0] https://mylicenseattorney.com/california-board-for-professio...
[1] https://design.insureon.com/news/3-reasons-engineers-get-sue...
[2] http://caselaw.findlaw.com/ca-supreme-court/1671856.html
Re: Panerabread.com leaks millions of customer records
#107Earlier quoted context omitted.
That is a terrible idea. Imagine sentencing programmers to jail for security issues in their code.
Why is a software developer an engineer when it fluffs their ego, but not an engineer when regulation and consequences for failures are necessary? Yes, if the security failure is grossly negligent, you should face criminal proceedings. As a C level executive, you are responsible for your chain of command.
it's unfortunate but leaks and breaches happen in programs (which a website is). it's coding, it isn't perfection and no one should go to jail or be ridiculed because they unintentionally introduced a bug that caused whatever problem arise (WE HAVE ALL DONE IT). This is why it is ideally best to have some sort of peer review and/or buddies reviewing our code for things we don't see before they are pushed into production, however unfortunately, this doesn't happen in all cases.
the only crime was not fixing the problem and keeping it a secret AFTER IT HAD BEEN DISCOVERED. in this case, it wasn't the mistake that was the crime, it was the cover up.
Re: Panerabread.com leaks millions of customer records
#108Earlier quoted context omitted.
I’m sure the only reason that only partial credit card numbers were stolen is that PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back).
> PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back) How about impossible. Storing the CVV number is 100% not allowed. Even storing complete cards numbers is only allowed under very specific conditions. Any deviation opens them up to liability for related fraud.
Even storing complete cards numbers is only allowed under very specific conditions.
We encrypt these at the app, even before putting them into the DB, yada yada. The PCI auditor actually made us restore the DB from backup onto another server and show them the data, to prove that some magical process in the backup program didn't cause them to come un-encrypted. They also wanted us to change all corporate email addresses to random characters, ostensibly to prevent spearfishing (we declined to take this suggestion). My point is that they go to crazy lengths to ensure you're doing this stuff right.
Re: Panerabread.com leaks millions of customer records
#109Earlier quoted context omitted.
I’m sure the only reason that only partial credit card numbers were stolen is that PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back).
> PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back) How about impossible. Storing the CVV number is 100% not allowed. Even storing complete cards numbers is only allowed under very specific conditions. Any deviation opens them up to liability for related fraud.
Thank you. I didn’t remember the details and went with “hard” because whenever I say “impossible” somebody will come up with some exception to the rule.
Re: Panerabread.com leaks millions of customer records
#110Earlier quoted context omitted.
You misunderstand my point. Are there examples of other sorts of engineers being brought up on charges? It only happens in the most egregious of negligence cases as it is and even then convictions are rare. I'm saying your impression that software engineering is protected is wrong, because no engineers (to any normal approximate) are brought up on criminal charges.
Lawsuits are commonplace in civil/geotechnical engineering because faulty work has life and death consequences for the general public. To be a certified professional engineer and sign-off on design plans in California you need to pass an exam, after which could result in issues of liability. This law practice defends professionals that may be in a dispute [0]. Here's a breakdown of why engineers might get sued [1]. H…
He said “criminal” charges. That is a very high bar.
Software engineers can be held liable in civil suits, as can other engineers even if there is no professional accreditation body for their industry.
It is less common in software than civil engineering for a few reasons, one of which is that customers literally have no problem signing away their liability. No one would sign a contract from a bridge designer that said “this might fall over in a stiff breeze” but that happens all the time with software.