Earlier quoted context omitted.
Why not ask them?
I'm not sure to which part you're referring...ask them what?
I believe he's suggesting that since you don't collect any more data than necessary, you ask the users how they use your app instead.
EasyJet admits a cyber-attack has affected approximately nine million customers
151–160 of 164 posts
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#152Earlier quoted context omitted.
Still better than my bank (one of Spain's biggest) that requires your password to be 8 (not less, not more) digits.
HSBC in France have the same, it's a huge motivator for me to switch away.
May I know why? It's a problem if there is no 2FA but I doubt HSBC won't have 2FA and this password requirements.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#153Earlier quoted context omitted.
HSBC in France have the same, it's a huge motivator for me to switch away.
May I know why? It's a problem if there is no 2FA but I doubt HSBC won't have 2FA and this password requirements.
The bank I'm using has 2FA for all actions performed in the website, so that's my guess as to why they don't prioritize fixing the lame password requirement.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#154Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#155Earlier quoted context omitted.
May I know why? It's a problem if there is no 2FA but I doubt HSBC won't have 2FA and this password requirements.
The bank I'm using has 2FA for all actions performed in the website, so that's my guess as to why they don't prioritize fixing the lame password requirement.
Exactly. 2FA is much more important than complicated password (not that I'm advocating to have a guessable one here), altogether providing acceptable level of security.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#156Having worked with EJ I just wanted to point out their system are insanely fragile. They never notified us about breaking changes and the system itself would go down multiple times. There was no CS when something goes wrong. And this was their B2B api. And from talking to ppl who were working in EJ a lot of things were being done on excel spreadsheets and emailed across. Just wanted to give this info as a sort of ref…
Interesting to hear, although a lot of companies still rely on emailing documents to each other. A few years ago I interviewed with a consultancy that provided a lot of development work for easyJet. They were operating under an old model of both work organisation and technology and not very keen to change. Interview went OK until I met the company CTO, who's personality left a lot to be desired. We ended up having a…
I think I even know the person you are talking about and yeah... :D I do feel that there is a culture in these big OLD (=old ibm mentality) where there is no need to innovate and it always costs a lot to do things right. The only reason they do is because some engineers are really pushing for it and making it happen.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#157Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#158Earlier quoted context omitted.
Yes, there are many criminal ways to make money. It would be nothing new. For example, burning your house or failing business down to make a claim is probably as old as insurance.
Insurance claims are not an entitlement provided by government.
So? It's still criminal. There are plenty of things that are provided by the government that are criminally gamed by a few that still provide a net benefit.
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#159The CEO says " it has become clear that owing to Covid-19 there is heightened concern about personal data being used for online scams" Am I missing something here? This doesn't make sense really.
This statement is too funny. For those looking for the quote in the article, you will find it in the duplicate HN post's [0] article [1], of which its comments were merged into this thread.
[0] https://news.ycombinator.com/item?id=23233619
[1] https://www.theguardian.com/business/2020/may/19/easyjet-cyb...
Re: EasyJet admits a cyber-attack has affected approximately nine million customers
#160Earlier quoted context omitted.
No, https encrypts the URL as well (although the domain itself can be leaked via DNS). But in most respects query params are no different to the body security wise. The main difference is that if you bookmark it, you may end up storing your sensitive data in your bookmarks.
I had no clue the URL was encrypted too. So how does DNS work? Or does it send through plaintext the name of the server, and the rest of the URL has to be encrypted by the endpoint.
The domain name is not encrypted, but the path and querystring are.
So, a spy watching your https traffic knows that you're interacting with news.ycombinator.com (and possibly other things), but they don't know anything that goes after the `/`: which thread, whether you're POSTing or GETting, or of course any of the content.