Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTC takes action against GoDaddy for alleged lax data security

ftc.gov

Post reply on HN
Print view View original

81–90 of 181 posts

Re: FTC takes action against GoDaddy for alleged lax data security

#81

Post by stackskipton »

reaperducer wrote: post #41
stackskipton wrote: post #6

Earlier quoted context omitted.

>If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this o…

As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected. We get training on it every six months.

Except Change Healthcare got hacked, lost a ton of records and they are still operating. So those fines must be, could be up to xx,000 per person affected but in actuality, those affected will get Arbys coupon and C Suite will lose a week of yacht time.

Re: FTC takes action against GoDaddy for alleged lax data security

#82

Post by transcriptase »

reaperman wrote: post #65
ziddoap wrote: post #61

Earlier quoted context omitted.

Not the person you are replying to, but I work in security and have spent ~5 years of my career helping various companies set up and maintain security awareness programs. There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house secu…

As a technically-minded person, I've found both KnowBe4 and ProofPoint trainings to be very lacking/boring/superficial.

One way to relieve the boredom is to count the number of times you see the people in videos typing away on desktops/monitors with no cables plugged into them.

Re: FTC takes action against GoDaddy for alleged lax data security

#83

Post by overstay8930 »

ziddoap wrote: post #5

It's amazing that (approximately) no one cares about stuff like this. GoDaddy was severely breached several times over several years, yet they still rake in billions of revenue from their millions of customers. Now they have to pay someone to fill out a biennial checklist and... promise to not lie. Awesome. If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, off…

Most companies are way too incompetent to even know how to secure their own data because it is just too expensive to actually hire someone that knows what they're doing - so most of the "cybersecurity" industry is just grifters talking about buzzwords and building dashboards to show how good they are at patching CVEs.

I have had to tell multiple cybersecurity vendors that brag about working with huge companies and governments that we cannot work with them because of how poor their own cybersecurity practices are (i.e. not using secure compute/hardware crypto when dealing with our private keys).

These are companies that should know better, I have had to stop ADP professional services more than once from disabling certificate validation on critical pipelines pertaining to confidential employee and customer information. I do not want to imagine what happens at 99% of companies with cybersecurity teams that don't even know what certificate validation is.

Re: FTC takes action against GoDaddy for alleged lax data security

#84

Post by mrguyorama »

insane_dreamer wrote: post #50
zelphirkalt wrote: post #22

Earlier quoted context omitted.

Is the US turning into "fourth Reich"?

Luckily we have enough remaining guardrails that it's unlikely to happen within the next 4 years. But we're getting closer, that's for sure. And the Supreme Court's disastrous decision on presidential immunity is allowing Trump to play Generalissimo.

What guardrails are you talking about? Even ignoring the presidential immunity ruling that explicitly makes him Fuhrer, if Trump has ICE arrest all brown people tomorrow, what exactly is going to stop him? The courts? A judge can say whatever the hell they want from their bench, it won't stop an ICE agent from physically forcing you onto a C130 and taking you wherever.

Trump already "deported" legal american citizens his first term. Trump supporters openly insist on "deporting" a legal american citizen who dared to tell Trump that he's a meany.

The Constitution is just a piece of paper. None of the people in the Trump admin care about it or respect it. It will not save us. The guardrails are all gone.

Re: FTC takes action against GoDaddy for alleged lax data security

#85

Post by theoreticalmal »

infogulch wrote: post #60
reaperducer wrote: post #41

Earlier quoted context omitted.

As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected. We get training on it every six months.

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.

Then I (a normal user) find myself in the position of my data being stolen/mishandled AND have to either pay for it via increase fees, or my healthcare provider goes belly-up and I have to find a new one.

Re: FTC takes action against GoDaddy for alleged lax data security

#86

Post by philipov »

kstrauser wrote: post #46
stackskipton wrote: post #6

Earlier quoted context omitted.

>If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this o…

> As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Honestly, I'm more afraid of reputational loss than government fines. Our customers don't have to use our product. They do because they trust us. Lose that trust and it's awfully hard to get it back.

Creating lock-in which prevents customers from having an alternative is a more effective use of money, because it "solves" not just the threat of reputation loss due to security failures, but many others at the same time.

Re: FTC takes action against GoDaddy for alleged lax data security

#87

Post by dustywusty »

ziddoap wrote: post #5

It's amazing that (approximately) no one cares about stuff like this. GoDaddy was severely breached several times over several years, yet they still rake in billions of revenue from their millions of customers. Now they have to pay someone to fill out a biennial checklist and... promise to not lie. Awesome. If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, off…

The sad truth is that for the most part, the web hosting industry has normalized a fairly lax approach to security, and sees settlements like this, and even breaches, as a cost of doing business. Look at Wordpress maintenance, for example.

It's a tough business hosting arbitrary UGC, and doing it well costs a lot of time effort and money (ask me how I know). But I fully agree: treating this as just another line-item cost is absurd.

Re: FTC takes action against GoDaddy for alleged lax data security

#88

Post by insane_dreamer »

mrguyorama wrote: post #84
insane_dreamer wrote: post #50

Earlier quoted context omitted.

Luckily we have enough remaining guardrails that it's unlikely to happen within the next 4 years. But we're getting closer, that's for sure. And the Supreme Court's disastrous decision on presidential immunity is allowing Trump to play Generalissimo.

What guardrails are you talking about? Even ignoring the presidential immunity ruling that explicitly makes him Fuhrer, if Trump has ICE arrest all brown people tomorrow, what exactly is going to stop him? The courts? A judge can say whatever the hell they want from their bench, it won't stop an ICE agent from physically forcing you onto a C130 and taking you wherever. Trump already "deported" legal american citizens…

I guess I've still been somewhat hopeful that the Legislative and Judicial branches will do their job and curb the worst of Trump's excesses or power grabs. But you're right that it's not looking good so far with the GOP Senate seeming to allow anything Trump wants so far. Hesgeth's confirmation was a really bad sign.

And you're right, ICE could well be on its way to turning into the Stasi.

Re: FTC takes action against GoDaddy for alleged lax data security

#89

Post by [deleted] »

ziddoap wrote: post #5

It's amazing that (approximately) no one cares about stuff like this. GoDaddy was severely breached several times over several years, yet they still rake in billions of revenue from their millions of customers. Now they have to pay someone to fill out a biennial checklist and... promise to not lie. Awesome. If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, off…

[deleted]

Re: FTC takes action against GoDaddy for alleged lax data security

#90

Post by infogulch »

reaperducer wrote: post #74
infogulch wrote: post #60

Earlier quoted context omitted.

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"

Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.
Post reply on HN