Knuddels: Chat platform must pay after hacker attack fine

Post by SmellyGeekBoy » Thu, Nov 22, 2018, 3:23 PM UTC

claudius wrote: post #20

pmontra wrote: post #11

Attack, succeed and blackmail could become a business. "If you don't pay me X we'll report you under GDPR and you'll have to pay much more."

"If you don’t pay me X we’ll report you under criminal law and you’ll have to pay much more." "If you don’t pay me X we’ll report you under environmental protection law and you’ll have to pay much more." "If you don’t pay me X we’ll report you under labour regulations law and you’ll have to pay much more." How would GDPR be special?

Post by donatj » Thu, Nov 22, 2018, 3:23 PM UTC

heavenlyblue wrote: post #25

hnaj wrote: post #16

Earlier quoted context omitted.

I've looked at many of those Tumblr posts; most of them show that the website sends you a welcome email with your password in plain text, which is bad practice, but doesn't prove that the password is stored in plain text in the database.

But which proves that access to the website codebase will grant you access to those passwords.

Post by detaro » Thu, Nov 22, 2018, 3:25 PM UTC

pmontra wrote: post #11

Attack, succeed and blackmail could become a business. "If you don't pay me X we'll report you under GDPR and you'll have to pay much more."

Post by pbhjpbhj » Thu, Nov 22, 2018, 3:25 PM UTC

lorenzhs wrote: post #35

pbhjpbhj wrote: post #28

Earlier quoted context omitted.

€20k doesn't seem much to me. Cheaper than taking on a security consultant. Not that you need a security consultant to know passwords shouldn't be stored (at all, nevermind plaintext). If they're doing that then they're likely being sloppy elsewhere, and by only paying €20k across the last n years they might have saved a €million. If your company is in the same boat probably worth not bothering to get any security is…

Well, the fine is only 20k€ because they were very cooperative, quick to fix the worst issues, and promised to continue improving their security further. According to the Data Protection Officer's statement their total expenses were in the six figures. They also explicitly state that the fine wasn't higher as not to place a disproportionate burden on the company's finances, which probably means that they wouldn't hav…

Post by carlmr » Thu, Nov 22, 2018, 3:27 PM UTC

hnaj wrote: post #42

According to the link: https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... They were doing this so they could filter out the passwords from chats (i.e. to make it so users can't give out their passwords to other users). Not saying this justifies it, but it's interesting.