Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EasyJet admits a cyber-attack has affected approximately nine million customers

bbc.co.uk

Post reply on HN
Print view View original

121–130 of 164 posts

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#121

Post by laydn »

guptaneil wrote: post #118
morsch wrote: post #19

Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…

This is how I’m building my startup[1]. All data stays with the customer and we actively don’t want it, because that’s how I wish all my products worked. I suspect you will see more startups who treat data more respectfully in the future, as the next wave of founders have experienced the consequences of unrestricted data collection. Having said that, I also think a large part of the problem is that treating data like…

Exactly. A lot of businesses MUST keep the data.

Imagine EasyJet putting the burden of keeping all your transaction logs on you: "Passenger assumes responsibility of downloading this electronically signed package and keep it for 2 years"

On a completely tangential note: How does your product work with pets?

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#123

Post by borplk »

Sosh101 wrote: post #103
leejo wrote: post #68

I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.

Doesn't a max length suggest that they are storing passwords rather than hashes?

It doesn't necessarily mean that.

A limit always exists. If you don't enforce it yourself you will find out when someone decides to send you 64GB of data to hash as their password. So always better enforce the limit yourself.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#125

Post by Aeolun »

nogabebop23 wrote: post #86
brnt wrote: post #64

The number one reason I do not keep CC info, and why I don't fill out details wherever I can. I don't trust your security.

good luck buying a plane ticket from easyjet without giving them your CC info

Just don’t buy from easyjet period. Nothing but bad experiences with them (sample size 1).

Who the hell makes ‘boarding time’ the same as ‘airplane leaves gate’ time :S

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#126

Post by anon73044 »

jakub_g wrote: post #110
derwiki wrote: post #104

Earlier quoted context omitted.

I remember reading that a somewhat-legitimate reason for blocking special characters is that it's a signal for keyloggers that the typed string might be a password. After briefly searching Google, I couldn't find anything to support that theory though.

It's an interesting point, but I think when the user has a keylogger, they've already lost. I'd rather have websites disallow passwords shorter than ~10 chars which are trivially brute-force'able in case of a leak. If special chars can be a signal for keyloggers, so are strings > 10 chars, and strings which are not all-lowercase/all-uppercase/first-capital. Basically to mislead the keylogger in this way, the user wou…

I jokingly like the idea of using utf-8 emojis in a password. They're available on nearly all phones and web browsers, common enough to not be susceptible to those sort of keyloggers and don't show up in any of the largest dictionaries/rainbow tables.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#127

Post by doublerabbit »

leejo wrote: post #68

I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.

> must not include the special characters # & + or space.

This annoys me the most, my password contains some of those characters.

Why is this even a restriction or is just poorly developed code?

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#128

Post by guptaneil »

laydn wrote: post #121
guptaneil wrote: post #118

Earlier quoted context omitted.

This is how I’m building my startup[1]. All data stays with the customer and we actively don’t want it, because that’s how I wish all my products worked. I suspect you will see more startups who treat data more respectfully in the future, as the next wave of founders have experienced the consequences of unrestricted data collection. Having said that, I also think a large part of the problem is that treating data like…

Exactly. A lot of businesses MUST keep the data. Imagine EasyJet putting the burden of keeping all your transaction logs on you: "Passenger assumes responsibility of downloading this electronically signed package and keep it for 2 years" On a completely tangential note: How does your product work with pets?

Ha, that makes me wonder if we could have a future standardized protocol where your browser handles the responsibility of storing a signed package of data, and sending it back to the company when needed. Basically treat each package of data like a product that might need to be RMA'd if there's an issue. Obvious first question is what happens when you switch browsers/devices.

Regarding pets: it'll depend on the size of your pet. For most people, the sensors properly ignore pets, but they can be confused by large dogs. You can adjust the sensitivity of the sensor, so it's generally only an issue if you have both large dogs and small children, and only want to count one of them. We're working on a software update that should help that scenario too. Feel free to send me more questions at neil@hiome.com :)

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#129

Post by dethos »

Both the BBC article and the incident notice (shared in other comments) contain very few details about the "highly sophisticated cyber-attack".

When such details are omitted I tend to suspect that "highly sophisticated" is sugarcoating some kind of negligence or bad security practices.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#130

Post by cjrp »

dethos wrote: post #129

Both the BBC article and the incident notice (shared in other comments) contain very few details about the "highly sophisticated cyber-attack". When such details are omitted I tend to suspect that "highly sophisticated" is sugarcoating some kind of negligence or bad security practices.

Ditto. What if "highly sophisticated" actually means "stumbled upon easyjet.com/backups/latest_db_dump_w_passwords-SENSITIVE.sql"
Post reply on HN