Hacking into an insurance company by exploiting their premium calculator • Hacker News Board

Re: Hacking into an insurance company by exploiting their premium calculator

#101

Post by graemep » Thu, Jan 18, 2024, 3:19 PM UTC

TrickyRick wrote: post #99

graemep wrote: post #84

Earlier quoted context omitted.

Not really. That links to a list of all enforcement actions. If you search for "technical" you get "organisational and technical measures", and most are organisational rather than technical. If you search by the word "hack" which seems to be the seems to be the usual terminology used there for vulnerabilities being exploited. There are 18 of these of 2182 entries. Not even one per EU country since 2018. Given how com…

The search function isn't that good, "Insufficient technical and organisational measures to ensure information security" are basically all data leaks. Here's a few famous ones, most of which are of course a few years old since government agencies tend to move slow but more recent ones will get what's coming for them. https://www.theguardian.com/technology/2022/nov/28/meta-fine... https://ico.org.uk/media/action-weve-…

Yes, but, as I said, a lot of them are organisational data leaks due to people's actions, not due to technical flaws.

The news stores are more encouraging. Thanks.

Re: Hacking into an insurance company by exploiting their premium calculator

#102

Post by stcredzero » Thu, Jan 18, 2024, 4:27 PM UTC

rudasn wrote: post #98

reaperman wrote: post #95

Earlier quoted context omitted.

Yeah I'm not fucking around with that. Solid block of black removes the guesses. (Caveats for layered documents like PDFs).

I like to convert to transparent png, cut the area I need removed, use background color (eg black) to indicate that something was removed, and export to jpg.

Programs should have explicit "secure censor" operations.

Re: Hacking into an insurance company by exploiting their premium calculator

#103

Post by givehimagun » Thu, Jan 18, 2024, 4:35 PM UTC

zamadatix wrote: post #90

ramblenode wrote: post #86

Earlier quoted context omitted.

> This is what you get, ladies and gentlemen, without unions and labour right. Are you speaking of the EU? The US has at-will employment and most software developers are not unionized.

Is it legal to have a 90 day salary clawback (not a signing bonus clawback, just salary clawback for quitting) in the US?

No - employers are required to pay out paychecks as soon as employment is terminated and if they fail to honor that, they are heavy fines. Days worked is money earned.

Re: Hacking into an insurance company by exploiting their premium calculator

#104

Post by [deleted] » Thu, Jan 18, 2024, 4:46 PM UTC

kumarski wrote: post #57

India has bigger problems than data leakages. Persistent power being one of these. Can't wait til there's enough electricity in India to where hacks become a primary concern. They're laying down 100k kilometesr of fiber optic per a month and 350 5g cell sites per day.

[deleted]

Re: Hacking into an insurance company by exploiting their premium calculator

#105

Post by subtra3t » Thu, Jan 18, 2024, 5:55 PM UTC

system2 wrote: post #61

Indian developers don't care about security unless you explain how to build the software step by step. Many firms got burnt because of this. We stopped working with individuals and teams in 2018. They don't care about security.

I think you should rephrase your comment, your comment gives off the wrong impression in its current state.

Re: Hacking into an insurance company by exploiting their premium calculator

#106

Post by system2 » Thu, Jan 18, 2024, 6:19 PM UTC

subtra3t wrote: post #105

system2 wrote: post #61

Indian developers don't care about security unless you explain how to build the software step by step. Many firms got burnt because of this. We stopped working with individuals and teams in 2018. They don't care about security.

I think you should rephrase your comment, your comment gives off the wrong impression in its current state.

It is phrased as I believe it. I am not going to feel sympathetic towards Indian developers after they caused millions of dollars of damage to our businesses over the years. The great majority of them are very low-skilled and lie about their skills. When questioned they disappear. We even dealt with fake-named ones. Had some installing malicious scripts to random parts of the e-commerce systems.

I even had a conversation with one telling me "Americans can afford it, we don't feel bad hacking them". This came from a developer who worked with us for over 2 years.

This is not a subject like genders and pronouns or whatever makes sensitive people feel angry. I advise anyone I meet the same thing. Avoid at all costs. Maybe 1 in 20 are okay but I don't recommend rolling the dice for that single gem.

Re: Hacking into an insurance company by exploiting their premium calculator

#107

Post by albert180 » Thu, Jan 18, 2024, 9:11 PM UTC

cnewey wrote: post #66

anon456846 wrote: post #53

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Data_Protection_Commissioner#I...

> In January 2023, DPC was forced to increase the fine issued to Meta Platforms after a review by European Data Protection Board found that the initial fine was insufficient.[12] European Data Protection Board determined that DPC has failed to perform its enforcement responsibility with "due diligence". The critics have pointed out that 7 out of 8 decisions handed down by European Data Protection Board were against t…

Not very surprising. Ireland's entire economy is being based on being a cheap low tax mailbox provider for US Multinationals, trying to bend laws as much as possible in their favor just fits in there That's why there is a big push on minimum tax rates in the European Union, nobody wants that race to the bottom

Re: Hacking into an insurance company by exploiting their premium calculator

#108

Post by ramblenode » Fri, Jan 19, 2024, 1:34 AM UTC

zamadatix wrote: post #90

ramblenode wrote: post #86

Earlier quoted context omitted.

> This is what you get, ladies and gentlemen, without unions and labour right. Are you speaking of the EU? The US has at-will employment and most software developers are not unionized.

Is it legal to have a 90 day salary clawback (not a signing bonus clawback, just salary clawback for quitting) in the US?

Kind of, yes.

I'm aware of employment contracts that require you to pay back the cost of training if you leave the job before some specified time period (maybe 1 or 2 years).

Re: Hacking into an insurance company by exploiting their premium calculator

#109

Post by subtra3t » Fri, Jan 19, 2024, 10:57 AM UTC

system2 wrote: post #106

subtra3t wrote: post #105

Earlier quoted context omitted.

I think you should rephrase your comment, your comment gives off the wrong impression in its current state.

It is phrased as I believe it. I am not going to feel sympathetic towards Indian developers after they caused millions of dollars of damage to our businesses over the years. The great majority of them are very low-skilled and lie about their skills. When questioned they disappear. We even dealt with fake-named ones. Had some installing malicious scripts to random parts of the e-commerce systems. I even had a conversa…

This isn't about "sensitivity". This is about racism. Just because you had a bad experience with a few Indian developers doesn't mean that all of them are bad.

And where did that 5% chance come from? Any kind of data to back it up or is it just a number you pulled out from nowhere?

If your businesses don't know how to employ external contractors blame it on your managers. India is a massive country. Not every Indian developer is an incompetent buffoon, just like not every European/American is the next Fabric Bellard.

Re: Hacking into an insurance company by exploiting their premium calculator

#110

Post by system2 » Fri, Jan 19, 2024, 7:32 PM UTC

subtra3t wrote: post #109

system2 wrote: post #106

Earlier quoted context omitted.

It is phrased as I believe it. I am not going to feel sympathetic towards Indian developers after they caused millions of dollars of damage to our businesses over the years. The great majority of them are very low-skilled and lie about their skills. When questioned they disappear. We even dealt with fake-named ones. Had some installing malicious scripts to random parts of the e-commerce systems. I even had a conversa…

This isn't about "sensitivity". This is about racism. Just because you had a bad experience with a few Indian developers doesn't mean that all of them are bad. And where did that 5% chance come from? Any kind of data to back it up or is it just a number you pulled out from nowhere? If your businesses don't know how to employ external contractors blame it on your managers. India is a massive country. Not every Indian…

I am certain my observation is not different than other developers in the United States. I also work with Indian companies who happen to know other Indian developers and I hear the same quality issues from actual Indian people themselves. I am not talking about 1-2 developers out there. We tried over 50 over the years. Barely 1 or 2 worked out and eventually, they started working for other companies because loyalty doesn't exist.

It is not racism. Since we stopped working with them, we haven't had a single issue with our software development services. They simply do not understand business basics. They write code as if we ask ChatGPT. No second thought, no bug hunt. Just linear coding with no security in mind. They do not ask themselves "If I remove this code from here, would this other part break?". We worked more on fixing the issues they caused than we worked with them.

We won't make this mistake again. I am also very sure this is not only us. I heard it from many American developers. If you have some time, just read some horror stories on tech blogs and other forums. I understand things might be difficult in India that force people to lie about their skills to make money but now we rather pay double than deal with issues the cheap labor causes.