Live data from Hacker News

FBI raids dental software researcher who discovered patient data on FTP server

dailydot.com

131–140 of 171 posts

Re: FBI raids dental software researcher who discovered patient data on FTP server

#131
post #54

Earlier quoted context omitted.

> "Did you ever stop to think if maybe this information was public for a reason?" If it was meant to be public, then you shouldn't have gotten in trouble for pointing out its existence. I don't understand the twisted logic there.

This is public for the teachers, snooping this file is the same as rummaging through teacher's stuff!

Then why wasn't it protected by authentication available to teachers only?

Re: FBI raids dental software researcher who discovered patient data on FTP server

#132
post #123

Earlier quoted context omitted.

If the research says that then either: (1) The law enforcement decision makers are unaware of the research (which is unlikely), or (2) The stated motivation is not the actual motivation.

Or (3) they don't believe the research and trust their "instincts", right or wrong.

Or (4) they do believe the research, and they use it in their calculation that says that while they should err on the side of caution and should overdo force "a little bit" just in case, that they should be careful not go too far...

... which turns out to be the same calculation they used all along.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#133
post #100

Earlier quoted context omitted.

Two reasons perhaps. Publicity and safety of the officers. How do they know how this person is going to react (or anyone else in the house)? And the publicity is much greater with a greater show of force (hence a deterrent) as well with a shock and awe response.

Research on the subject says this is more dangerous for the cops then the calmer approaches. The irony is cops do this to protect themselves, and statistically speaking it has the exact opposite effect.

but they have cool toys and can pretend they are actual badasses when they raid your home and shoot your dog.. .even tho many of them cant qualify to get in the military ( too fat )

Re: FBI raids dental software researcher who discovered patient data on FTP server

#134
post #128
post #58

Earlier quoted context omitted.

Nonsense. It could be as a easy as printing fliers at home and dropping them in an appropriate space, or mailing letters with the return address the same as the mailing address, or using Tails 2.x to email hippa and the police using a throwaway address. But contacting them in person? NFW

Never print anything for anonymous purpose. All printers have a watermark.

[deleted]

Re: FBI raids dental software researcher who discovered patient data on FTP server

#135

Earlier quoted context omitted.

Patterson is not a dental clinic. Like Henry Schein which was also mentioned in TFA, it is a large dental supply company. One reason that dentistry is so expensive, is that assholes like these run an oligopoly of "specialty" dental supplies. It's not as bad as military procurement, but it's kind of like that. Dentists as a profession are risk-averse, and that includes the "risk" of purchasing dental equipment and sup…

> So, the chance of them going "out of business" is pretty slim. It's entirely possible that dentists unfortunate enough to have chosen Eaglesoft will get to pay some HIPAA fines, however. Will they? Since Eaglesoft claimed to provide encryption, and the practices relied on that claim, it seems unlikely that the practices are at fault; if they are subject to civil liability at all for inadvertent violations -- or eve…

HIPAA violations that are prosecuted are so rare they may as well not exist. I worked at a place that shared all the prod server/db passwords in a text file and they thought that was OK because they passed some half-ass audit. No one cared.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#136

It needs to be understood that if you react this way to responsible disclosure practices, your company & you personally will be subject to irresponsible disclosure practices.

Oh, I've already learned the lesson loud and clear. If I ever discover a vulnerability to disclose, I'm releasing it anonymously on pastebin sites while logged into Tor through a VPN from a free WiFi spot. And, of course, sign it with a new PGP key you've just created, so that if you ever need to release a follow-up with proof that it's you, or come forward as the author of the disclosure, you can.

Connect to the VPN after connecting to Tor. Putting the VPN in there can actually lessen anonymity due to a financial relationship. So make sure you procured that VPN anonymously, via Tor, with a crypto currency that you have mixed.

This is my plan too. Responsibly disclose anonymously. That should prevent our corporate lords from sending SWAT teams into our homes.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#137
post #97

Earlier quoted context omitted.

Remember clock Ahmed the clock kid? I had a situation almost exactly like his, except I made a working FM radio, could change stations and listen to local news and weather, I thought it was the coolest thing ever. The school did not, and the district superintendent agreed with them. Who knew that an FM Radio made out of a La Gloria Cubana cigar box-with labelling removed so as not to run afoul of any "tobacco paraphe…

It sounds like you weren't sufficiently brown to get media attention? "Public school bureaucracy run by bureaucrats" doesn't have the right mass appeal.

Ahmed: police called. handcuffed, questioned for 90 minutes, transported to juvenile jail, all without being able to see parents. plus racist comments.

iamdave: picked up from school by his dad, no police involved.

Not exactly the same situations. Both crappy situations, but Ahmed's treatment was an order of magnitude more inappropriate.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#138
post #97
post #55

Earlier quoted context omitted.

> I was nearly expelled for "hacking". They placed me on "academic probation" This reaction makes me very, very angry. I would love to push it back on them: it's unclear under what laws/regulations this would fall, but if you (as the student who found it) can get in trouble for finding this info, they can most certainly get in trouble for posting it in a location it can be found in. Further, because you were actually…

Remember clock Ahmed the clock kid? I had a situation almost exactly like his, except I made a working FM radio, could change stations and listen to local news and weather, I thought it was the coolest thing ever. The school did not, and the district superintendent agreed with them. Who knew that an FM Radio made out of a La Gloria Cubana cigar box-with labelling removed so as not to run afoul of any "tobacco paraphe…

Crystal radios were a school project taught in science class when I was in high school

Re: FBI raids dental software researcher who discovered patient data on FTP server

#139

Fun fact: Many financial institutions use the last 4 of your SSN as identity verification. If you're a business, it's the last 4 of your FEI/EIN. I know at least in FL, this is publicily available at sunbiz.org So with the account number printed at the bottom of your paycheck/stub and the FEI/EIN, you can often authenticate to a financial institution and obtain privileged information. I know this not because I was on…

My last bank had the username for online banking set to the account number, and the password set to the last 4 of SSN by default. The password was limited to 4 characters, but they did allow special characters.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#140
post #115

Earlier quoted context omitted.

Requiring the warrant to specify the level of force could be interesting. Are there good reasons why this could not be done?

At a federal level, this is mostly done. Before executing a search warrant, feds usually pull criminal background and check gun registries. Then look at the reason for a search warrant (drugs, guns, terrorism, etc.). In theory, they combine those things to decide whether to just knock on the door and walk in or bring SWAT along. This happens different between agencies and what parts of the country. But, codifying the…

It was FBI though, so it was at federal level?
Post reply on HN