"... Social Security numbers were contained in HTML source code of the pages." "Gov. Mike Parson was labeling the Post-Dispatch reporter a 'hacker' and vowing to seek criminal prosecution." L O L. Everyone who has hit F12 in a browser is now considered a hacker. I hope the prosecutors and law enforcement come to the right conclusion quickly and tell the governor no crime was committed. My experiences have left me wit…
"You can look like idiots now. Or you can try to keep from looking like idiots, and look like even bigger idiots very quickly. Your choice."
Being wary of the guy, sure. But it's a terrible response in general. The correct response is to take the site down ! Monitoring IP addresses? Really? First, it's trivial to just use a different IP address. Second, even if you could track people perfectly, which you can't, who the hell thinks it's okay for data to get leaked as long as you know who it gets leaked to?
It’s not a nice response, but IT needs to be able to answer questions about the extent of a given breach (what info was accessed by whom and when). This is a legal requirement in the case of health information. Ideally people could be courteous while fulfilling their legal obligations, but IT folks aren’t generally chosen for their public relations or customer service skills.
Yes, and they need to do that based on the forensic data available to them, even if the answer is “we don’t know, it could be everything.”. Asking the person who caused the breach to explain the extent of your data loss is not an acceptable, or reliable, practice.
If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?
Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?
A closer analogy might be if none of the apartments had doors, would you be allowed to step inside.
If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?
Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?
That's not even close to the same analogy though. This would be like knocking on the door, asking if you can come in, and the person living there letting you in. Then getting mad about it later even though they let you in.
FYI the "Governor" is Mike Parson "As governor, Parson signed a bill criminalizing abortion after eight weeks of pregnancy and opposed Medicaid expansion. He oversaw the state's response to the COVID-19 pandemic, where he issued a temporary stay-at-home order in April 2020, allowed schools districts to decide whether or not to close, and limited postal voting during the 2020 U.S. elections. Parson also oversaw Missou…
Soapbox much? The dude's clearly a moron but this isn't a thread about any of the topics mentioned in your quote. You're actively making HN a shittier place with comments like this.
If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?
Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?
More like - you go to supermarket bathroom, checking each stall and find one person is pooping without doors locked
Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.
"unencrypted the source code" means they ran an unminify tool. Very advanced; criminal masterminds. /s
> I don't think I can blame a politician for being technically illiterate, especially one that old. Given the impact of technology on society, we absolutely can and should blame politicians who are technically illiterate.
I don't blame a politician for being not tech savvy. I can and will blame them for not getting (And listening to!) a tech savvy advisor.
And maybe blame the highly partisan electorate too?
After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…
> After I shopped a few other companies to see how our plans compared Yeah once you start using a vulnerability maliciously to obtain confidential data for your own personal gain, even if its a stupid vulnerability, you're not really good-guy security researcher anymore. If all you did was the bare minimum to demonstrate the vuln exists, that's cool. If after you do that you continue to use it to obtain confidential…
Browsing the different plans is not malicious. Jesus.
And the details of different plans is not the kind of confidential info that innately deserves protection. Investigating or recording personal information would be bad, but they didn't do that.