21–30 of 490 posts
"We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do."
The "we didn't have to" is a little jarring given the scale of this.
// logger.log(request.payload);
We need a regulatory rulebook codified in law by congress that fines companies that make these "mistakes". Enough of a fine will force companies to take these "mistakes" seriously. In Yahoo's case, that might have forced Marissa to actually keep a cybersecurity team and not cut them when she knew the systems were in danger of being compromised. We aren't getting any jail time, but hefty fines that don't stifle growth…
"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?
The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.
“We are very sorry this happened,” the Twitter blog said.
How is something like this even possible? It just sounds so incompetent.
Over-zealous developers who think it's appropriate to log all function calls with parameters for trace level logs, or a framework with the same opinion automatically applies such tracing and logging over the whole code-base.
No-one notices because no-one uses trace level logging, until one day another developer is tearing their hair out because they can't reproduce a bug that is only occuring on live. It's an urgent bug that needs resolution asap. So this developer turns on the trace level logging and eventually finds and resolves their bug.
Being the careful person they are, they turn off the logging and go away happy.
Meanwhile they've unknowingly produced a few gigabytes of log outputs which happen to include plaintext passwords.
That's just one of many different scenarios where people acting in 'good faith' can still lead to bad outcomes. That is why a "PUNISH THEM!" attitude to this kind of incident is not helpful.
Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.
We need a regulatory rulebook codified in law by congress that fines companies that make these "mistakes". Enough of a fine will force companies to take these "mistakes" seriously. In Yahoo's case, that might have forced Marissa to actually keep a cybersecurity team and not cut them when she knew the systems were in danger of being compromised. We aren't getting any jail time, but hefty fines that don't stifle growth…
"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?
Section 508 of the Rehabilitation Act legislated that the government purchase accessible software.
HIPAA legislated that your medical data be kept secure.
Minnesota, Nevada, and Washington have enshrined some or all of PCI DSS into law: https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...
A little farther afield, seat belt technology has been legally mandated to be included in most automobiles sold in the United States since 1968: https://en.wikipedia.org/wiki/Seat_belt_laws_in_the_United_S...
We need a regulatory rulebook codified in law by congress that fines companies that make these "mistakes". Enough of a fine will force companies to take these "mistakes" seriously. In Yahoo's case, that might have forced Marissa to actually keep a cybersecurity team and not cut them when she knew the systems were in danger of being compromised. We aren't getting any jail time, but hefty fines that don't stifle growth…