Online Cheating Site AshleyMadison Hacked • Hacker News Board

Re: Online Cheating Site AshleyMadison Hacked

#351

Post by MeNotMe » Tue, Jul 21, 2015, 7:09 AM UTC

someDevOrOther wrote: post #267

MeNotMe wrote: post #157

Two points: 1. Encrypt all database data, decrypt in application. 2. If you only do perimeter defense, you're doing it wrong.

Regarding the first point, how would that help? The password has to be stored in the clear on the server. If an adversary got control of the box, then the adversary would get the password. And secondly, how would you search a database full of encrypted data? Homomorphic encryption isn't ready for prime time as I understand it.

1. It's much easier to compromise a DB into a dump with injection, insufficient access control etc. than dump the db, find out it's encrypted, then hack the app servers and find a key somewhere in the binary.

2. You can use key distribution schemes to the app servers.

3. If you need to 'live' search in personal data you're doing it wrong. You can move search to a fulltext engine for the stuff you really need, which is more difficult to dump and reassemble. E.g. if you search for city, you only have primary keys and cities in one system.

4. You should also not keep profiles, personal data and other data on one server. Compromising one of the access paths will compromise all your data.

Re: Online Cheating Site AshleyMadison Hacked

#352

Post by jarman » Tue, Jul 21, 2015, 10:40 AM UTC

duncan_bayne wrote: post #297

jarman wrote: post #109

Earlier quoted context omitted.

I don't have problem with 'encourage and facilitate' - blame lies 100% on one committing adultery. But they deserve being hunted down by lynch mob of defrauded cheaters for that removal fee extortion.

How does that work? If I sell you a gun knowing you're going to commit murder with it, am I not also morally culpable?

Adultery is contract breach - you are not culpable unless you are part of that contract

Murder is rights violation - you are in 'contract' by being human in society - you always can be culpable

Re: Online Cheating Site AshleyMadison Hacked

#353

Post by minusSeven » Tue, Jul 21, 2015, 10:52 AM UTC

MertsA wrote: post #27

Not too surprising. Security in the past has been worse than abysmal on that site. I had a friend that jokingly made an account and sent me a link to his profile. However, that link was also his entire session. Once in the profile section it would let you change the password without knowing the current password. And the last kicker, the change password box had asterisks in it on page load and a quick "view source" re…

That was hilarious. Hacking this site shouldn't even be news then.

Re: Online Cheating Site AshleyMadison Hacked

#354

Post by vidarh » Tue, Jul 21, 2015, 11:33 AM UTC

wutbrodo wrote: post #276

Flimm wrote: post #265

Earlier quoted context omitted.

Style of marriage, religion, drugs and cheating all do affect other people's life, even harm, to varying degrees and definitions. There is no freedom that doesn't affect anyone else's life.

Right, up to and including eating a slice of cheesecake, which is why your definition is useless. What we're discussing here is things that are harmful to others _per se_. Theft, violating agreements (like cheating), etc are obviously examples of this. Religion, drug use, open marriages are obviously not. The distinction here is kot

Whenever someone claims something is "obvious" alarm bells goes off for me.

For starters, cars are obviously harmful: People get killed in car accidents.

So clearly, it is insufficient that something causes harm for us to consider them as harmful enough to argue against them on principle - at least for the vast majority of us.

Are you going to argue that violating agreements is always harmful? Almost always?

How do quantify that harm? Why? Do you have any basis for assuming there aren't people out there that e.g. just don't care? (because there certainly are)

At the same time you claim drug use in the other category, despite the large number of deaths tied to drug use. Religion has been the catalyst for massive amounts of deaths too. To some of us religion are "obviously" harmful to others _per se_. So clearly your "obvious" statements are not objectively obvious.

It becomes very hard to take your argument seriously when your "obviousness" criteria are so obviously subjective and used to avoid having to justify your claims.

Re: Online Cheating Site AshleyMadison Hacked

#355

Post by coldcode » Tue, Jul 21, 2015, 11:55 AM UTC

dreamfactory2 wrote: post #281

mikegioia wrote: post #200

Earlier quoted context omitted.

This is insane, you're saying Ashley Madison should be prosecuted for having their data hacked? Do you have any idea what that means for the rest of the world's websites? And to even make a claim that this is somehow worse than the massively private information the Feds lost is laughable. Do you know what data AM had on its users? Do you think it's even remotely close to the data the Feds had on every single public s…

What's wrong with the idea of having limits on data collection and regulations around their storage? You can't prosecute someone for being the victim of hackers but you can (and should) for not applying reasonable efforts in safeguarding data or storing more than they should.

In this case apparently they failed to even encrypt the data. If you open your garage door and leave all your house doors wide open and get robbed I don't think your insurance company will pay you anything.

Re: Online Cheating Site AshleyMadison Hacked

#356

Post by duncan_bayne » Tue, Jul 21, 2015, 12:25 PM UTC

jarman wrote: post #352

duncan_bayne wrote: post #297

Earlier quoted context omitted.

How does that work? If I sell you a gun knowing you're going to commit murder with it, am I not also morally culpable?

Adultery is contract breach - you are not culpable unless you are part of that contract Murder is rights violation - you are in 'contract' by being human in society - you always can be culpable

I think you may be confusing morally culpability with legal culpability.

If you encourage someone to commit adultery, you are morally culpable, just as if you encourage someone to commit murder, you are morally culpable. The only difference is that, in the case of murder, you are also legally culpable.

Re: Online Cheating Site AshleyMadison Hacked

#357

Post by jarman » Tue, Jul 21, 2015, 1:39 PM UTC

duncan_bayne wrote: post #356

jarman wrote: post #352

Earlier quoted context omitted.

Adultery is contract breach - you are not culpable unless you are part of that contract Murder is rights violation - you are in 'contract' by being human in society - you always can be culpable

I think you may be confusing morally culpability with legal culpability. If you encourage someone to commit adultery, you are morally culpable, just as if you encourage someone to commit murder, you are morally culpable. The only difference is that, in the case of murder, you are also legally culpable.

No, I am not, I was talking purely from morality standpoint.

>If you encourage someone to commit adultery, you are morally culpable

Apparently we just happen to have different views. For me, adultery encouragement is unsympathetic act, but does not fit criteria for being amoral.

Re: Online Cheating Site AshleyMadison Hacked

#358

Post by dimino » Tue, Jul 21, 2015, 2:03 PM UTC

tptacek wrote: post #338

dimino wrote: post #323

Earlier quoted context omitted.

Maybe, maybe not -- I'd love to discuss it. More importantly, I wanted to reframe your comment in a way that was productive. Instead of "Nobody has a right to private criminality.", it seems more conversational to say "Nobody has a right to private amorality."

Clearly the disagreement here is that I do think people have a right to privacy w/r/t/ amorality.

But not criminality? That's a baffling stance that entirely ignores the source and designated purpose of law.

Re: Online Cheating Site AshleyMadison Hacked

#359

Post by tptacek » Tue, Jul 21, 2015, 2:37 PM UTC

dimino wrote: post #358

tptacek wrote: post #338

Earlier quoted context omitted.

Clearly the disagreement here is that I do think people have a right to privacy w/r/t/ amorality.

But not criminality? That's a baffling stance that entirely ignores the source and designated purpose of law.

If you think the law is best seen as a mechanism for enforcing a common morality, then that's another thing we simply disagree about.

Re: Online Cheating Site AshleyMadison Hacked

#360

Post by dimino » Tue, Jul 21, 2015, 3:51 PM UTC

tptacek wrote: post #359

dimino wrote: post #358

Earlier quoted context omitted.

But not criminality? That's a baffling stance that entirely ignores the source and designated purpose of law.

If you think the law is best seen as a mechanism for enforcing a common morality, then that's another thing we simply disagree about.

Luckily I don't, so we don't have to go there.