Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Exposed User Data, Feared Repercussions of Disclosing to Public

wsj.com

Post reply on HN
Print view View original

11–20 of 277 posts

Re: Google Exposed User Data, Feared Repercussions of Disclosing to Public

#11

Post by creaghpatr »

ucaetano wrote: post #4

Company finds a security vulnerability caused by a bug. Logs show that it has never been used by anyone. It patches the vulnerability. [Honest question] Should the company announce it publicly? PS: Keeping in mind that this is part of the Murdoch vs. Google war going on for about 10 years: https://www.npr.org/sections/money/2009/11/murdoch_vs_google... https://www.thedrum.com/news/2017/03/28/timing-everything-ru... h…

>PS: Keeping in mind that this is part of the Murdoch vs. Google war going on for about 10 years:

Changes the facts of the story 0%

Re: Google Exposed User Data, Feared Repercussions of Disclosing to Public

#12

Post by lostmsu »

hoos97 wrote: post #8
ucaetano wrote: post #4

Company finds a security vulnerability caused by a bug. Logs show that it has never been used by anyone. It patches the vulnerability. [Honest question] Should the company announce it publicly? PS: Keeping in mind that this is part of the Murdoch vs. Google war going on for about 10 years: https://www.npr.org/sections/money/2009/11/murdoch_vs_google... https://www.thedrum.com/news/2017/03/28/timing-everything-ru... h…

Yes, because when you go public with the issue you are able to control the narrative. Bad judgement to assume that these issues will never reach the public eye. Especially knowing that a patched was successfully applied...instead Google looks like it is having trouble living up to it's Don't Be Evil motto.

No, they would have to issue like 10 reports a day. Bugs that are never exploited in web sites are rarely published for multiple reasons. Definitely not something to blame Google for.

Re: Google Exposed User Data, Feared Repercussions of Disclosing to Public

#13

Post by Bucephalus355 »

Yes they should have announced it no matter what the logs said.

Depending on the logs is the worst idea ever in terms of breach determination. I don’t know how many times we’ve had 40 IoCs, but just because there isn’t a log file (often because no one splurged for the SIEM and the syslog collector broke beyond repair months ago) management acts like they’ve won the legal liability / cyber security lottery.

Obviously it’s not as black and white as that, but the burden of proof should be on the companies to show that no malicious use happened right after they go public with a breach.

Going public with this kind of information, even if nothing happened, could have driven much better behavior across the United States if not the world by setting the example. But Google chose the path of self-protection and short-term gain.

Re: Google Exposed User Data, Feared Repercussions of Disclosing to Public

#14

Post by tptacek »

ucaetano wrote: post #4

Company finds a security vulnerability caused by a bug. Logs show that it has never been used by anyone. It patches the vulnerability. [Honest question] Should the company announce it publicly? PS: Keeping in mind that this is part of the Murdoch vs. Google war going on for about 10 years: https://www.npr.org/sections/money/2009/11/murdoch_vs_google... https://www.thedrum.com/news/2017/03/28/timing-everything-ru... h…

I don't know if it should or it shouldn't, but it absolutely is not the norm for companies to announce those vulnerabilities publicly. Every year, most moderate-and-up-sized tech companies (really, a pretty big swathe of the Fortune 500 outside tech, as well) contract multiple penetration tests, and those tests turn up thousands upon thousands of sev:hi vulnerabilities, none of which are ever announced.

An obligation to announce findings would create a moral hazard as well, since the incentives would suddenly tilt sharply towards not looking for security vulnerabilities.

Re: Google Exposed User Data, Feared Repercussions of Disclosing to Public

#18

Post by ocdtrekkie »

ucaetano wrote: post #4

Company finds a security vulnerability caused by a bug. Logs show that it has never been used by anyone. It patches the vulnerability. [Honest question] Should the company announce it publicly? PS: Keeping in mind that this is part of the Murdoch vs. Google war going on for about 10 years: https://www.npr.org/sections/money/2009/11/murdoch_vs_google... https://www.thedrum.com/news/2017/03/28/timing-everything-ru... h…

Your statement: "Logs show that it has never been used by anyone."

The Wall Street Journal: "Because the company kept a limited set of activity logs, it was unable to determine which users were affected and what types of data may potentially have been improperly collected, the two people briefed on the matter said. The bug existed since 2015, and it is unclear whether a larger number of users may have been affected over that time."

Re: Google Exposed User Data, Feared Repercussions of Disclosing to Public

#19

Post by Schlaefer »

throwawaymath wrote: post #5
minimaxir wrote: post #3

The buried lede is that Google is shutting down Google+. (EDIT: for consumers: Google is keeping it as an enterprise product)

Technically it's shutting down all consumer functionality for Google+.

What does "consumer" mean in that context?

Re: Google Exposed User Data, Feared Repercussions of Disclosing to Public

#20

Post by thomastjeffery »

ucaetano wrote: post #4

Company finds a security vulnerability caused by a bug. Logs show that it has never been used by anyone. It patches the vulnerability. [Honest question] Should the company announce it publicly? PS: Keeping in mind that this is part of the Murdoch vs. Google war going on for about 10 years: https://www.npr.org/sections/money/2009/11/murdoch_vs_google... https://www.thedrum.com/news/2017/03/28/timing-everything-ru... h…

It is generally in the company's best interest to publicly disclose the vulnerability, and its effects.

The other parts to your question are:

1. Should the company be compelled to disclose the vulnerability?

I don't think that is reasonable. Enforcing this would be a nightmare anyway.

2. If they did not disclose the vulnerability, but it becomes public knowledge another way, should there be any recourse?

I think that should be decided and enforced by the users. Unfortunately, that is becoming steadily more difficult, as companies like Google grow, and there are fewer viable/available alternatives to their products.

3. Does a company have a moral imperative to share this information?

I think that the action to share such information takes a higher moral ground than to do otherwise.

Post reply on HN