Seems like they got punished for informing the government about the hack, obviously gives the next company that gets hacked a reason to try to hide it.
Knuddels: Chat platform must pay after hacker attack fine
91–100 of 125 posts
Re: Knuddels: Chat platform must pay after hacker attack fine
#92Earlier quoted context omitted.
Yes, I saw that elsewhere when I'd finished writing. More cooperative still would be doing the changes before you're caught. If you could skip your tax bill for a few years, but get a much smaller fine if you cooperated when caught then you'd be silly to actually pay. In short, in terms of pour encourage les autres this fails badly IMO.
> If you could skip your tax bill for a few years, but get a much smaller fine if you cooperated when caught then you'd be silly to actually pay. If you do the work ahead of time, you pay the cost of doing the work. If you wait for the fine, you pay the cost of doing the work plus the fine. It doesn't take a lot of fine to make doing the work to begin with worth it -- basically just accounting for chance of getting a…
Maybe, but there's much more work that needs doing to secure PII than just not having plaintext passwords. So, they can seemingly avoid doing all that work too, and maintaining those systems (with staffing costs). And you get a leg-up over the competition who can't use the cash that they put in to security.
That means those with poor security regimes may "win" because the costs of poor PII hygiene are externalised.
It would certainly be nice to imagine all the 2 million UK corporations are addressing PII security rather than hiding and hoping not to get a fine ...
Re: Knuddels: Chat platform must pay after hacker attack fine
#93Who gets the money, after those who administer it take there cut
The state, Baden-Württemberg.
Re: Knuddels: Chat platform must pay after hacker attack fine
#94Earlier quoted context omitted.
There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock). The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't…
I used the introductory example in response to the request of "extremely punitive" fines. Extreme fines lead to companies trying to be clever in hiding their faults. Moderate fines more likely lead to companies coming out by themselves. On the comparison with overweight trucks: I doubt anybody builds an insecure system to gain an economical benefit, not using state-of-the-art technology is a mistake/stupidity/careles…
>Moderate fines more likely lead to companies coming out by themselves.
I can't recall ever hearing of a company coming forward to declare they broke the law and so should pay a fine.
Could anyone give us a couple of high profile examples?
Do you have any support for your assertion that punitive fines don't stimulate regulatory compliance but small fines do?
Re: Knuddels: Chat platform must pay after hacker attack fine
#95Earlier quoted context omitted.
No. I've implemented precisely that and it doesn't prove what you think. What you do is have one single function create the user, pick a random password, set it in the database (which in my case uses a perfectly sensible hash) and send the user email. The cleartext password in the mail comes from the function's local string variable, not from the database. Whether doing this is a good idea is another question. IMO it…
>> No. I've implemented precisely that and it doesn't prove what you think. Well, the way I read the parent is that you can request a previously set password to be sent to your e-mail.
GP said … "sends you a welcome email with your password in plain text" … which seems clear enough.
Re: Knuddels: Chat platform must pay after hacker attack fine
#96Earlier quoted context omitted.
The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...
Why didn't they just hash all the words they type if you must(maybe bloom filter?)
You would have to hash every possible substring in a sentence.
Re: Knuddels: Chat platform must pay after hacker attack fine
#97Earlier quoted context omitted.
But which proves that access to the website codebase will grant you access to those passwords.
No. I've implemented precisely that and it doesn't prove what you think. What you do is have one single function create the user, pick a random password, set it in the database (which in my case uses a perfectly sensible hash) and send the user email. The cleartext password in the mail comes from the function's local string variable, not from the database. Whether doing this is a good idea is another question. IMO it…
How often do you purge your mailserver's logs (or if you use a mail API, how often do they purge their logs)? If it's "Never, I didn't think of that." then all your user's inital passwords are sitting there for the taking.
Of course, you may have a system that forces a password reset on login. That won't help the users who have never logged in. Those accounts are freely available to a hacker.
Plaintext passwords anywhere are a really bad idea.
Re: Knuddels: Chat platform must pay after hacker attack fine
#98According to the link: https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... They were doing this so they could filter out the passwords from chats (i.e. to make it so users can't give out their passwords to other users). Not saying this justifies it, but it's interesting.
hunter2
doesn't look like anything to me.
Re: Knuddels: Chat platform must pay after hacker attack fine
#99Seems like they got punished for informing the government about the hack, obviously gives the next company that gets hacked a reason to try to hide it.
The fine was set low for cooperating with the DPO. If you hide it and someone leaks it then the agency could ask for much more.
Re: Knuddels: Chat platform must pay after hacker attack fine
#100Earlier quoted context omitted.
I used the introductory example in response to the request of "extremely punitive" fines. Extreme fines lead to companies trying to be clever in hiding their faults. Moderate fines more likely lead to companies coming out by themselves. On the comparison with overweight trucks: I doubt anybody builds an insecure system to gain an economical benefit, not using state-of-the-art technology is a mistake/stupidity/careles…
>Moderate fines more likely lead to companies coming out by themselves. I can't recall ever hearing of a company coming forward to declare they broke the law and so should pay a fine. Could anyone give us a couple of high profile examples? Do you have any support for your assertion that punitive fines don't stimulate regulatory compliance but small fines do?
Yes. The case we are talking about.
"Das Unternehmen hatte sich am 08. September 2018 mit einer Datenpannenmeldung an den LfDI gewandt [...] Gegenüber dem LfDI legte das Unternehmen in vorbildlicher Weise sowohl Datenverarbeitungs- und Unternehmensstrukturen als auch eigene Versäumnisse offen." ("The company contacted the data protection agency on September 8th 2018[...] In exemplary manner they gave access to company and data management processes and highlighted their on omissions") https://www.baden-wuerttemberg.datenschutz.de/wp-content/upl...