Earlier quoted context omitted.
I spend a considerable amount of time pentesting. I understand it very well
Not that. Break into it as a job. The talent pool is woefully underfilled.
Ah, gotcha. Sorry about that, misread it
Capital One’s breach was inevitable, because we did nothing after Equifax
141–150 of 161 posts
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#142Earlier quoted context omitted.
> When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents? July 1st, 2019 H.R. 3151 "Taxpayer First Act This bill revises provisions relating to the Internal Revenue Service (IRS), its customer service, enforcement procedures, cybersecurity and identity protection, management of information technology, and use of electronic systems." http…
What makes you say this bill is doing more than call for a minimalist response to tax return fraud (giving people “identity protection ID number” to use with ID theft cases and a single phone number to call about tax related identity theft) and make updates correcting obvious flaws in the tax code (aka keeping the lights on)? The provisions in this law will not make it less likely that someone will file a tax return…
I could quote from the bill, but the individual subsections all make material changes in the way the IRS runs.
Reducing everything to "creates a new department or abolishes an existing one" or "does nothing and just keeps the lights on" isn't a useful rubric.
Good law is acreted over time, in the same way bulletproof code is.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#143"we" did nothing?
I'm annoyed at the use of first person plural pronouns in such articles. It's particularly obnoxious in a story about identity theft which, as other posters on this thread have pointed out, is a linguistic con-job banks pull on customers.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#144Earlier quoted context omitted.
> "You exist first and foremost through the lens of the government. You are not permitted to live outside the bureaucratic abstraction of you." Aren't we already at that point?
Sort of, but generally not on the minute-to-minute basis that is being forced to carry government identification at all times. And in cases where that may de facto be the case, e.g. being a minority near a border, that's already abhorrent. That whole paradigm should be reversed rather than further generalized.
> being a minority near a border, that's already abhorrent.
That's abhorrent because they are targeted which force them to carry it.
Isn't driver license a government identification anyway? Sure no one is forced to have it, but that won't change much if everyone had it.
I'm not arguing about forcing carrying it either. Just about whether it would be bad if it existed.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#145Earlier quoted context omitted.
I agree that we've been given clear signals that losing consumer data won't result in any negative repercussions for your business from government. Unfortunately none of us are customers of equifax - the companies we share our data with are. And those companies don't care, and include every bank. For Capital One, or other companies with which we directly do business, I think there's likely to be more direct ramificat…
Wells Fargo did much worse with actually defrauding their customers, ruining some lives, and only got a slap on the wrist.
I, unfortunately, am forced to do business with Wells Fargo. I recently purchased a house using a different lender and they sold my mortgage to Wells Fargo. Nothing I can do about it. I now have to have a Wells Fargo account to pay my mortgage and am just dreading the day when they start adding features to it that I didn't sign up for. About a month after learning they'd be taking over our mortgage, they got slapped on the wrist for some sort of mortgage-related fraud. It's really infuriating. At some point I may refinance just to get it moved to a different bank, but it wouldn't make financial sense to do it just yet.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#146Earlier quoted context omitted.
What makes you say this bill is doing more than call for a minimalist response to tax return fraud (giving people “identity protection ID number” to use with ID theft cases and a single phone number to call about tax related identity theft) and make updates correcting obvious flaws in the tax code (aka keeping the lights on)? The provisions in this law will not make it less likely that someone will file a tax return…
I could quote from the bill, but the individual subsections all make material changes in the way the IRS runs. Reducing everything to "creates a new department or abolishes an existing one" or "does nothing and just keeps the lights on" isn't a useful rubric. Good law is acreted over time, in the same way bulletproof code is.
You are asking me to trust that the people making law now know what they are doing and are slowly moving things in the right direction instead of slowly in the wrong direction, while not contesting the claim that this law does nothing to accomplish its stated goal of reducing the public burden of tax return fraud.
US tax law has been dysfunctional and getting worse for decades, to me that says there are issues with how the system is designed and meaningful progress beyond “keeping the lights on” will require restructuring the law and the agency, not adding a new office here and giving taxpayers more notifications there. Those types of measures, as you correctly point out, have to be looked at as part of a larger plan for the organization that meaningfully addresses a problem, not in isolation. Except here we have a collection of measures that doesn’t coherently address a problem, so there is no way left to look at them except in isolation.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#147There is no reason to spend one dime on infosec after the big Equifax breach and the numerous Facebook hacks/intentional spreading of data. They already lost all the most important data for every American and both companies are doing far better than ever. Nobody went to jail, everyone gets to keep making money. You should worry about lightning strikes and like solar flares disrupting your business before you worry ab…
Part of this problem is that Congress has simply stopped functioning for the past ten years or so. They're pretty much just keeping the lights on while social conservatives refuse to compromise with anyone else. When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents?
The constituents of social conservatives favor this approach to governing. Those constituents don't want to punish corporations using the law because they view government regulations as bad for the economy.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#148Earlier quoted context omitted.
I could quote from the bill, but the individual subsections all make material changes in the way the IRS runs. Reducing everything to "creates a new department or abolishes an existing one" or "does nothing and just keeps the lights on" isn't a useful rubric. Good law is acreted over time, in the same way bulletproof code is.
You are asking me to trust that the people making law now know what they are doing and are slowly moving things in the right direction instead of slowly in the wrong direction, while not contesting the claim that this law does nothing to accomplish its stated goal of reducing the public burden of tax return fraud. US tax law has been dysfunctional and getting worse for decades, to me that says there are issues with h…
I was pointing out passed law that I consider answers "When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents?"
The law has many stated goals, as set forth in the quote I posted.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#149Earlier quoted context omitted.
The failure of Facebook might well be stimulative to employment and the economy. Imagine the wave of startups and new initiatives from other companies trying to compete in all the areas Facebook's in now. And unlike banks no significant part of the broader economy is at risk if facebook.com and instagram.com start 404ing forever tomorrow. A hiccup in the "influencer" economy, such as it is, which is negligible anyway…
That just sounds like breaking windows to ensure more work for glassmakers to me. You're also ignoring the value Facebook ads provide to every business who advertises on that platform.
The shattering noise is the sound of self breaking windows.
Re: Capital One’s breach was inevitable, because we did nothing after Equifax
#150Wasn't this a private S3 bucket and she somehow hacked permission access? Anyone know the full details of how this came to happen? As for mitigation, does S3 encryption happen at the user access level (GET) or S3 system level. Basically, does each GET call pass in the decryption key? This means an attacker needs another piece of information. More encryption wouldn't hurt here. This goes for Equifax too.
I'll preface this by saying that I haven't seen any official resources confirming that it was an S3 bucket issue (although the statement from hacker mentioned releasing "buckets" so it very well could be). S3 provides server side encryption that encrypts the files at rest. This is done entirely on the server side and does not require any additional keys from the client. However, it is possible to do your own file enc…
> it's possible a WAF issue allowed the remote attacker to query the internal endpoint from an external source
But then it's literally a configuration issue, right? WAF is just Rule -> Block/Allow. It doesn't proxy traffic or anything, it just attaches to a load balancer, API Gateway or CloudFront.
More puzzling, what is the WAF-Role they're talking about? WAF doesn't use IAM roles, so is this just a role they used to configure the WAF (and also had S3 permissions?)