You’d have to have the data breach also be the cause of them losing massive amounts of wealth, which probably isn’t going to happen.
demesisx@infosec.pub
on 23 Jan 2024 21:15
nextcollapse
I have a solution:
governments should heavily fine companies that are subject to data breaches.
If it cost them real money (proportional to their market cap, the amount of customers affected, and/or the severity of the breach) to allow a data breach, I’m betting they’d shore up those holes REALLLLLLLLLL QUICK.
Sanctus@lemmy.world
on 23 Jan 2024 21:30
nextcollapse
This is always the answer. “How do we solve x in y industry?” Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.
sundray@lemmus.org
on 23 Jan 2024 21:53
nextcollapse
That, or threaten to nationalize their industry. Corporations *hate * that.
fraksken@infosec.pub
on 25 Jan 2024 11:25
collapse
Internet is also communication.
works great in North Korea.
drahardja@lemmy.world
on 24 Jan 2024 00:16
nextcollapse
“Externalities” are just expenses that corporations incur that have to be paid by the public.
Make externalities losses again.
eltimablo@kbin.social
on 24 Jan 2024 16:24
collapse
It'll also screw over anyone trying to break into the market, ensuring that the big tech companies remain unchallenged indefinitely.
demesisx@infosec.pub
on 24 Jan 2024 17:52
collapse
Disagree if you add the three different factors that I added to account for this in my original comment:
As I wrote in my edit, I think the size of fine should be dependent on:
size of company
the reasonable expectation of security (which would partially attempt to decrease fines for unfixable breaches)
the number of unique users affected
theneverfox@pawb.social
on 25 Jan 2024 04:38
collapse
I think that’s a great starting point for effective legislation.
I also think this could easily be twisted to become yet another artificial barrier to entry.
I don’t know what to do with that knowledge…I think you’re correct, but I also think there’s no way to pass such a law with its spirit intact today
demesisx@infosec.pub
on 25 Jan 2024 14:43
collapse
I’ll put the ball in your court.
I’ve completely and irreparably broken up with electoral politics in the United States ever since my tax money started being spent solely on austerity and genocide. It’s about as likely for this to be introduced as a bill as it is for a third party to win a presidential election…ie IMPOSSIBLE.
bleistift2@feddit.de
on 23 Jan 2024 21:32
nextcollapse
Article 82, paragraph 1 of the GDPR:
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Paragraph 2:
Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation
Article 24, paragraph 1:
**[T]he controller shall **implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.
Article 5, paragraph 1f:
Personal data shall be: […] processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss,
Article 83, paragraphs 2 and 5:
Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;
Article 4, paragraph 7:
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data
I got lost in the comments… why did you paste that here? To show that it is possible to make the data controller liable for breaches?
bleistift2@feddit.de
on 24 Jan 2024 15:42
collapse
Exactly. This is supposed to show that what @demesisx@infosec.pub demands is already law in the EU.
Semi-Hemi-Demigod@kbin.social
on 23 Jan 2024 21:56
nextcollapse
Nah, throw the board members in prison. If the punishment for crime is a fine then it's legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person's data they allowed to be leaked.
If they get all the money because they're ultimately responsible, we should make them ultimately responsible.
wikibot@lemmy.world
on 23 Jan 2024 21:56
nextcollapse
Here’s the summary for the wikipedia article you mentioned in your comment:
Nutraloaf (also known as meal loaf, prison loaf, disciplinary loaf, food loaf, lockup loaf, confinement loaf, seg loaf, grue or special management meal) is food served in prisons in the United States (and formerly in Canada) to inmates who have misbehaved, abused food, or have inflicted harm upon themselves or others. It is similar to meatloaf in texture, but has a wider variety of ingredients. Prison loaf is usually bland, even unpleasant, but prison wardens argue that nutraloaf provides enough nutrition to keep prisoners healthy without requiring eating utensils.
demesisx@infosec.pub
on 23 Jan 2024 21:57
nextcollapse
HELL YEAH, comrade! 🌹
I was just working inside of the confines of shitliberalism because it’s seemingly all we have in the United Corporations that run America.
BlackSkinnedJew@lemmynsfw.com
on 23 Jan 2024 23:01
collapse
Hail Comrade!! 🙏🤞
KpntAutismus@lemmy.world
on 23 Jan 2024 22:43
collapse
if it means prison time for a middle/lower class person, it should mean prison time for everyone who is responsible for basically publishing logins and personal data.
no more geeting off scott free because you run a company. you’re a prisoner like everyone else now.
altima_neo@lemmy.zip
on 23 Jan 2024 22:50
nextcollapse
They’re too busy proposing legislation to create back doors that completely circumvent security in the first place.
WHYAREWEALLCAPS@kbin.social
on 23 Jan 2024 23:53
collapse
Yeah, people shouldn't look to their government to protect them from this. Hell, I'd be willing to bet no small amount of taxes go to purchasing the leaked info at places like the CIA, NSA, and FBI.
Nommer@sh.itjust.works
on 24 Jan 2024 00:26
nextcollapse
They won’t because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It’s broken by design.
The EU has proven time and again that fines can hurt.
neidu2@feddit.nl
on 24 Jan 2024 01:00
nextcollapse
As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.
Corkyskog@sh.itjust.works
on 24 Jan 2024 13:47
collapse
Are these leaks even being reported by companies? Every article I have seen so far has just been compiling information off the new leaked data set someone picked up off the dark web or something.
Kiernian@lemmy.world
on 24 Jan 2024 20:18
collapse
They weren’t, which is why the SEC updated 17 CFR Parts 229, 232, 239, 240, and 249.
As of December 18th of last year, publicly traded companies are now required to disclose breaches. (soz, material cybersecurity incidents).
Prior to that, they could …basically… just effectively sweep everything under the rug “like it never happened” minus a little handwaving and paper shuffling and nobody would find out about it until the information got sold and went public.
I’ll have to go looking but I would be SERIOUSLY surprised if the disclosures apply to credit card companies (the MOST breached, historically) because I’m not sure what exactly qualifies someone as an asset-backed issuer, but it’s at least a really good step for the REST of things.
eltimablo@kbin.social
on 24 Jan 2024 16:23
collapse
This is the stupidest idea I've ever heard. You don't fine a bank for getting robbed. This reeks of frontend engineer idiocy, which is ironically the exact type of idiocy that tends to cause breaches like this.
demesisx@infosec.pub
on 24 Jan 2024 16:27
collapse
Every time some corporatist replies to me, they’re always kbin.
Your analogy falls apart with even a cursory thought about the differences between banks (which are required to be insured against loss which would make a customer whole again without any negative effects) and corporations that just throw all of their customers’ data onto a portal that lacks basic protection. Once that personal data is compromised, there’s no way to repay the customer and no amount of fines will EVER right that wrong. In a properly-regulated, just society, a bank would ABSOLUTELY be fined back to the Stone Age if they left their customers’ cash in the middle of a town square, for example.
Be better, you corporate cuck.
eltimablo@kbin.social
on 24 Jan 2024 16:30
collapse
Ok then, how about considering that this will only serve to benefit the big tech companies because they're the ones that can afford the fines? A breach is usually enough to make a smaller company go out of business already between cleanup and lawsuits. Why make it easier for the big tech companies to maintain power?
demesisx@infosec.pub
on 24 Jan 2024 16:31
collapse
Did you even read my comment? I specifically mentioned that the size of the fine could be tied to their market cap.
If you work in cyber security, you’d know that there are best practices in place for cybersecurity and it is a WELL UNDERSTOOD FIELD. The main advice everyone gives is to never roll your own cryptography…and that is EXACTLY what many of the hacked companies did.
Taking a shortcut and hiring shitty devs who just use some random NPM package for security and call it a day is exactly why there are so many breaches. Just as bridges need to be built to withstand double or triple their weight, there should be STANDARDS in place that if violated are subject to fines.
Companies like Google would basically have to build SUPER SECURE technologies lest they be bankrupted by a breach.
In conclusion, please try to remove your tongue from your exploitive employer’s back side.
eltimablo@kbin.social
on 24 Jan 2024 16:35
collapse
I did miss that, but again, it's additional fines on top of an almost guaranteed lawsuit for something that may not even be their fault. If they got owned by a Heartbleed exploit back when it was first announced and a fix wasn't available yet, should a company be responsible for that? What about when they get hit by a vuln that's been stockpiled for a couple years and purposely has no fix due to interference from bad actors? There are a lot of situations where fining someone for getting breached doesn't make sense.
demesisx@infosec.pub
on 24 Jan 2024 16:37
collapse
You make great points but my final point is this: if a company simply cannot guarantee protection of user data, it shouldn’t be trusted with user data in the first place.
eltimablo@kbin.social
on 24 Jan 2024 16:40
collapse
And I'll counter with this: no system is perfect, especially when major parts are made by non-employees. Mistakes can and do happen because corporations, regardless of size, are made up of humans, and humans are really good at fucking up.
demesisx@infosec.pub
on 24 Jan 2024 16:42
collapse
I’m not trying to get the last word, I swear! 🤣
Go back to my bridge analogy and test that against what you just said.
Your comment equates to: “oh well, that bridge falling killed thousands of people. At least we were able to allow them to fail in the crucible of the free market!”
eltimablo@kbin.social
on 24 Jan 2024 16:50
collapse
Your bridge analogy falls apart because there already are standards (FIPS, among others) that are shockingly insecure despite having been updated relatively recently, and yet we still have breaches. If the standards were effective, places like AmerisourceBergen, the country's largest pharmaceutical distributor, wouldn't be supplementing them with additional safeguards. No standard is going to work perfectly, or even particularly well, for everyone. Bridges still fall down.
EDIT: Alternatively, there would need to be a provision that allows companies to sue the government if they get breached while following their standards, since it was the government that said they were safe.
demesisx@infosec.pub
on 24 Jan 2024 16:59
collapse
Anyone who says, “think of the corporations” before they think of the people being PERMANENTLY compromised is a lost soul indeed. You are blaming the inadequacy of standards rather than the demagogues working for the corporations that enabled these lax standards. Of course there are going to be 0 day exploits that no one could protect for but that is a red herring. That’s something that could easily come out and be considered when that company is brought in front of a civil court to decide the fines, obviously!
I think we’re too dissimilar for this conversation to bear any fruit. Thanks for the well constructed devil’s advocate stance but you certainly haven’t convinced me.
eltimablo@kbin.social
on 24 Jan 2024 17:11
collapse
When you say "corporations," it seems like you're exclusively counting companies like Google, Meta, etc, whereas I'm also including the mom and pop, 15-person operations that would be impacted by the same regulations you suggest. Those underdogs are the ones I want to protect, since they're the only chance the world has at dethroning the incumbents and ensuring that the big guys don't outlive their usefulness.
demesisx@infosec.pub
on 24 Jan 2024 17:20
nextcollapse
I’m not.
And what I proposed (see my revised original comment) actually protects those companies because it takes into account:
the amount of users infected
the general standards that were or were not followed by that theoretical startup rag tag team of hacks which would help paint a picture for regulators of the severity of the violation and codifying the ever-evolving concept of what is “reasonably secure”.
the market cap of said theoretical hacked corporation.
eltimablo@kbin.social
on 24 Jan 2024 17:40
collapse
See, I figure all of those things would be accounted for in whatever civil suit gets brought against the company. Frankly, I think that's much more fair to companies both big and small because it involves a group of people working together to figure how much of a fine to levy in each individual instance, rather than having a blanket policy that may or may not account for edge cases. If the company is huge and the fuckup egregious, then the jury is (theoretically) going to throw the book at them.
At the very least, I'd want a jury in between the company and whichever government body is fining them, because regulatory bodies are prime targets for corporate shills to take over and it's harder for that to run rampant if you have a bunch of regular jackoffs acting as gatekeepers.
There's also the issue of ongoing compliance for small companies. Cybersecurity engineers are not cheap, and being all but required by law to employ one could (1) drive small companies out of business (180k a year may be cheap for Facebook, but it's definitely not for Joe Buttsniffer and Sons Catering), and (2) cause market saturation so bad that the average salary makes nobody want to do the job anymore.
demesisx@infosec.pub
on 24 Jan 2024 17:45
collapse
Agreed. Corporate regulatory capture was a 100% success in the United States. It has been that way since at least Reagan. It always comes back to government corruption and what I see in these kinds of civil suits against corporations that were breached is a gentle slap (actually more of a caress!) on the wrist (and a wink and a nod when the cameras turn off) between the demagogues and the corporations that own them.
eltimablo@kbin.social
on 24 Jan 2024 17:46
collapse
Yeah it really comes back to "fines are only for poor people." Google can just count the fines as the cost of doing business while simultaneously leveraging their dominance to force other companies to break regulations in order to work with them.
demesisx@infosec.pub
on 24 Jan 2024 17:48
collapse
It’s VERY similar to how we (in the US) allow Congress to decide the rules that THEY THEMSELVES have to follow when you have the legalized bribery that is known as lobbying in the US.
eltimablo@kbin.social
on 24 Jan 2024 17:49
collapse
You know what I bet we both agree on? Limited liability in general being a shit idea.
demesisx@infosec.pub
on 24 Jan 2024 17:26
collapse
I just realized you’re the Tesla guy from yesterday. I’m glad we could have a more mature discussion on this topic and I’m glad I didn’t block you. 🤣
eltimablo@kbin.social
on 24 Jan 2024 17:52
collapse
NGL, my first comment was partially meant to see if you actually had blocked me lol
demesisx@infosec.pub
on 24 Jan 2024 17:55
collapse
😃
Wholesome AF. Sorry about yesterday. That was a SUPER immature discussion after a while.
I wouldn’t consider you my best friend or anything but I’m glad I didn’t put in blinders to someone critical of my ideas. Cheers, fellow fediverse user. After all, you don’t seem like a dummy; just a person with different perspective than me.
eltimablo@kbin.social
on 24 Jan 2024 19:40
collapse
Hey man, it happens. I could tell that you had some valid arguments in there, I was just trying to get you to express them. I definitely didn't help by joining in the immaturity either.
Side note, I'm legit starting to hate my Tesla anyway, but I wasn't about to admit that yesterday lol. There are absolutely a lot of valid criticisms of them, I just think the majority are overblown, especially as they relate to FSD. I'm in the beta and it's basically the only reason I still have the damn thing.
Anyway, I'm sorry too. I probably should have just walked away when things got heated, but there was a part of me that was secretly hoping to see how long we'd keep going back and forth calling each other assholes because I thought it would be funny.
Numberone@startrek.website
on 24 Jan 2024 20:14
nextcollapse
Just want to say that I appreciate how you two ended up haha. It was a wide eyed “Woah” from me at the beginning there (both), but I do love that you guys talked it out and ended up all civil and complimentary. There’s hope for us all to understand each other is my takeaway. Thanks to both of you for showing us the way.
demesisx@infosec.pub
on 24 Jan 2024 23:47
collapse
This interaction definitely improved my day even more than our interaction yesterday perhaps soured my day. Thanks for that!
This fediverse thing is really nice sometimes. I look forward to some really good discussions. I promise to try to keep my cool. If I call you a name, you should know that it is with a smirk and only meant as a soft, subtle jab. :)
FenrirIII@lemmy.world
on 23 Jan 2024 21:37
nextcollapse
My data has been stolen so often I have free monitoring for the rest of my life.
PlasmaDistortion@lemm.ee
on 23 Jan 2024 22:44
collapse
And everyone should just assume that every account they have will be hacked. Because it already is, they just haven’t found out yet (assume breach).
Hyperreality@kbin.social
on 23 Jan 2024 22:10
nextcollapse
I honestly wonder if my data wouldn't be safer on some sites, if I skipped two-factor authentication and a recovery email, and simply used my date of birth as a password. At least then, they'd wouldn't be able to leak the phone number or email adress, because I was never forced to give it to them.
It's even more annoying, because you can't easily avoid many of these companies. Eg. for jobs it's really hard to get around using linkedin. I mean, I refuse out of principe and have for years, so my data's a decade out of data, but it's obviously cost me opportunities.
There are almost certainly pictures of me floating around social media, taken without my permission, but tagged by facebook or google just in case I had any fucking privacy. And now thanks to some phones. they also have our finger prints and retinal scans, which will inevitably get leaked sooner rather than later. I pity the poor chumps whose DNA was leaked, that's even worse. Most of that will probably be leaked sooner or later, if it hasn't already, because it turns out a subcontractor used the youtube comment section to communicate between departments.
If I had the technical ability, I would design a two-factor authentication system based on rectal scans.
"Here at OmniCorp we believe all our customers our unique, that's why we believe in securing your data by linking your DNA, phonenumber, social security number, retinal scan and finger print, with a picture of your anus. Bend Over. The Future's Now."
theodewere@kbin.social
on 23 Jan 2024 22:25
nextcollapse
Tencent tops the chart, with 1.5 billion records leaked, followed by Weibo at 504 million and MySpace at 360 million.
MySpace in the news as Top Western Leaker
Kazumara@feddit.de
on 23 Jan 2024 23:02
nextcollapse
That seems weird, it’s called mother of all breaches, but isn’t the result of any one breach. It’s just data collection from ordinary breaches with perhaps some credential stuffing in the mix.
We just need a free dart monkey or two, it’ll be fine.
Mojojojo1993@lemmy.world
on 24 Jan 2024 02:08
nextcollapse
I think it’s gotten to the point that we. (Collective)
Have to start using alias. I know proton for a price gives fake mobile and email address.
I have started using a 5th email to sign up to things. Have an extra number as well. It’s beyond a joke really.
Tried to sign up for a budget app and it requires email phone and address.
No. No you don’t require any of that. You want that to sell. And you’ve likely got inadequate protection.
Nobody but my bank job and maybe a few places require all my info.
XTornado@lemmy.ml
on 24 Jan 2024 09:59
nextcollapse
Oh proton gives mobile too… Ya know I didn’t feel like paying for the mail thing as I can have my domain and relay easily but the mobile thing I didn’t know.
But I will be honest I didn’t see it mentioned on the web, it’s already a thing?
AProfessional@lemmy.world
on 24 Jan 2024 12:40
nextcollapse
They only generate email addresses.
reagansrottencorpse@lemmy.world
on 24 Jan 2024 15:50
nextcollapse
Could you use Google voice to generate a dumby phone line ? There are probably better non-google options now though.
Kiernian@lemmy.world
on 24 Jan 2024 20:06
collapse
The problem here is that all of the registration information that is listed for a number (OCN, LATA, etc) allows them to track back what TYPE of number it is based on what ILEC/CLEC it’s registered with and how it’s registered.
This means when I put my google voice number into some things, they can come back and yell that it’s not a mobile phone, or that it’s a virtual number, or whatever and disallow it.
I used it in college and never had any problems, it seems to have feature parity with Excel. I used Excel professionally for a while and some of the workflows are a little different, but on the whole it’s really intuitive and easy to use. I’m sure there are other FOSS budgeting solutions, but Calc works so well for me I don’t see myself using anything else.
kent_eh@lemmy.ca
on 24 Jan 2024 02:47
nextcollapse
I’ve always thought LinkedIn is nothing more than a massive treasure trove of personal information just waiting to be harvested by thieves wanting the entire life and work history of millions of upwardly mobile career focused people.
LinkedIn is trying to encourage people to use it as a social networking site.
Lutra@lemmy.world
on 24 Jan 2024 02:59
nextcollapse
“The MOAB contains 26 billion records over 3,800 folders, with each folder corresponding to a separate data breach. While this doesn’t mean that the difference between the two automatically translates to previously unpublished data, billions of new records point to a very high probability, the MOAB contains never seen before information.” Totaling 12TB.
Kind of worrying when their source is a “data breach information website” that does advertorials for “the most safe password manager” NordPass. 🤮 The internet of today has become a pile of absolute shit.
interdimensionalmeme@lemmy.ml
on 24 Jan 2024 11:09
nextcollapse
We should make a new internet in the dark web, but only invite cool people. No billionaires, narcs nor finks allowed !
Tikiporch@lemmy.world
on 24 Jan 2024 12:57
nextcollapse
No narcs or finks? What about patsies or stoolies? Can we at least have phonies?
yuriy@lemmy.world
on 24 Jan 2024 16:54
nextcollapse
I’ll give you one chump and half a busta, but that’s all you’re getting!
littlebluespark@lemmy.world
on 25 Jan 2024 18:23
collapse
Best I can do is two scrubs and whatever’s left of our collective hope for the species.
Zuberi@lemmy.dbzer0.com
on 24 Jan 2024 08:58
nextcollapse
Definitely recommend a password vault to anyone that doesn’t already use one. After this next hack leaks, I imagine you’ll get at least a couple of attempts on your email/phone.
4grams@awful.systems
on 24 Jan 2024 19:50
nextcollapse
I had an identity theft a few years back, still cleaning up from it. At the time I had the typical set of standard passwords that I would use. I thought they were ok since they were pretty random but I had one for Financial, one for Web Services, etc. so of course when the creds leaked, I suddenly had a bunch of credit card bills I never signed up for…
Since then, every password is unique, my default is 31 characters, and 2-factor for everything possible. Unfortunately I initially settled on LastPass, figured that they had hopefully learned their lesson from their breach years ago. Then it happened again recently and I moved to Bitwarden so that I can eventually migrate to a self-hosted solution.
I’ve been trying to get my family on board for years but it’s still too complex. Non-technical folk still will take the path of least resistance, even when the dangers are right in front of their face. We need something better.
WindyRebel@lemmy.world
on 25 Jan 2024 01:13
collapse
Who do you recommend?
StrawberryPigtails@lemmy.sdf.org
on 25 Jan 2024 02:00
collapse
Keepass is probably the most secure, but was a pain for multi device / multi OS users last time I used it.
Currently I use Bitwarden. You can either use their backend or you can self host. Cross platform, multi device support, 2FA support.
WindyRebel@lemmy.world
on 25 Jan 2024 02:23
nextcollapse
Thoughts on 1Password?
StrawberryPigtails@lemmy.sdf.org
on 25 Jan 2024 04:29
nextcollapse
I don’t know much about them to be honest, and what little I have heard sounded like it was paid for. My knee jerk reaction is to avoid them. Maybe they’re decent, maybe not. Couldn’t say.
SkaveRat@discuss.tchncs.de
on 25 Jan 2024 04:52
collapse
They are okay, but I had massive problems with their browser plugin after a while and moved to bitwarden
I use Keepass with Syncthing as the sync backend. Syncthing comes as a Docker container these days and sets up in seconds, I like how it doesn’t rely on a central server and gives you some redundancy.
Also, Keepassxc is a rewrite with better integration, true cross platform support and more features, keepassxc.org
restingboredface@sh.itjust.works
on 25 Jan 2024 15:00
collapse
They said this about the equivalent breach, and yet here we are.
threaded - newest
Not until a politician or billionaire is harmed by these breaches will we see some action.
They’ll get justice, you’ll get a check in the mail for 3 dollars, after some lawyers win a class action lawsuit.
I don’t think so.
Trump himself was victim of credential stuffing. And he’s not the only politician or billionaire who has suffered stolen accounts of something.
You’d have to have the data breach also be the cause of them losing massive amounts of wealth, which probably isn’t going to happen.
I have a solution:
governments should heavily fine companies that are subject to data breaches.
If it cost them real money (proportional to their market cap, the amount of customers affected, and/or the severity of the breach) to allow a data breach, I’m betting they’d shore up those holes REALLLLLLLLLL QUICK.
This is always the answer. “How do we solve x in y industry?” Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.
That, or threaten to nationalize their industry. Corporations *hate * that.
Communications should always be nationalized. It was a mistake letting corporations gatekeep phones and internet.
Infastructure should be nationalized as a whole (roads, rails, water, heating, electricity, waste disposal and so on)
How about Intel?
Obviously a typo, nice one
Internet is also communication. works great in North Korea.
“Externalities” are just expenses that corporations incur that have to be paid by the public.
Make externalities losses again.
It'll also screw over anyone trying to break into the market, ensuring that the big tech companies remain unchallenged indefinitely.
Disagree if you add the three different factors that I added to account for this in my original comment:
As I wrote in my edit, I think the size of fine should be dependent on:
size of company
the reasonable expectation of security (which would partially attempt to decrease fines for unfixable breaches)
the number of unique users affected
I think that’s a great starting point for effective legislation.
I also think this could easily be twisted to become yet another artificial barrier to entry.
I don’t know what to do with that knowledge…I think you’re correct, but I also think there’s no way to pass such a law with its spirit intact today
I’ll put the ball in your court.
I’ve completely and irreparably broken up with electoral politics in the United States ever since my tax money started being spent solely on austerity and genocide. It’s about as likely for this to be introduced as a bill as it is for a third party to win a presidential election…ie IMPOSSIBLE.
Article 82, paragraph 1 of the GDPR:
Paragraph 2:
Article 24, paragraph 1:
Article 5, paragraph 1f:
Article 83, paragraphs 2 and 5:
Article 4, paragraph 7:
(All quotes are excepts, emphasis mine
gdpr-info.eu
I think we can both guess why these companies never really face penalties that hurt them materially despite this being codified into law in the EU…
I got lost in the comments… why did you paste that here? To show that it is possible to make the data controller liable for breaches?
Exactly. This is supposed to show that what @demesisx@infosec.pub demands is already law in the EU.
Nah, throw the board members in prison. If the punishment for crime is a fine then it's legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person's data they allowed to be leaked.
If they get all the money because they're ultimately responsible, we should make them ultimately responsible.
Here’s the summary for the wikipedia article you mentioned in your comment:
Nutraloaf (also known as meal loaf, prison loaf, disciplinary loaf, food loaf, lockup loaf, confinement loaf, seg loaf, grue or special management meal) is food served in prisons in the United States (and formerly in Canada) to inmates who have misbehaved, abused food, or have inflicted harm upon themselves or others. It is similar to meatloaf in texture, but has a wider variety of ingredients. Prison loaf is usually bland, even unpleasant, but prison wardens argue that nutraloaf provides enough nutrition to keep prisoners healthy without requiring eating utensils.
^to^ ^opt^ ^out^^,^ ^pm^ ^me^ ^‘optout’.^ ^article^ ^|^ ^about^
HELL YEAH, comrade! 🌹
I was just working inside of the confines of shitliberalism because it’s seemingly all we have in the United Corporations that run America.
Hail Comrade!! 🙏🤞
if it means prison time for a middle/lower class person, it should mean prison time for everyone who is responsible for basically publishing logins and personal data.
no more geeting off scott free because you run a company. you’re a prisoner like everyone else now.
They’re too busy proposing legislation to create back doors that completely circumvent security in the first place.
Yeah, people shouldn't look to their government to protect them from this. Hell, I'd be willing to bet no small amount of taxes go to purchasing the leaked info at places like the CIA, NSA, and FBI.
They won’t because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It’s broken by design.
The EU has proven time and again that fines can hurt.
As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.
Are these leaks even being reported by companies? Every article I have seen so far has just been compiling information off the new leaked data set someone picked up off the dark web or something.
They weren’t, which is why the SEC updated 17 CFR Parts 229, 232, 239, 240, and 249.
www.sec.gov/files/rules/final/2023/33-11216.pdf
As of December 18th of last year, publicly traded companies are now required to disclose breaches. (soz, material cybersecurity incidents).
Prior to that, they could …basically… just effectively sweep everything under the rug “like it never happened” minus a little handwaving and paper shuffling and nobody would find out about it until the information got sold and went public.
I’ll have to go looking but I would be SERIOUSLY surprised if the disclosures apply to credit card companies (the MOST breached, historically) because I’m not sure what exactly qualifies someone as an asset-backed issuer, but it’s at least a really good step for the REST of things.
This is the stupidest idea I've ever heard. You don't fine a bank for getting robbed. This reeks of frontend engineer idiocy, which is ironically the exact type of idiocy that tends to cause breaches like this.
Every time some corporatist replies to me, they’re always kbin.
Your analogy falls apart with even a cursory thought about the differences between banks (which are required to be insured against loss which would make a customer whole again without any negative effects) and corporations that just throw all of their customers’ data onto a portal that lacks basic protection. Once that personal data is compromised, there’s no way to repay the customer and no amount of fines will EVER right that wrong. In a properly-regulated, just society, a bank would ABSOLUTELY be fined back to the Stone Age if they left their customers’ cash in the middle of a town square, for example.
Be better, you corporate cuck.
Ok then, how about considering that this will only serve to benefit the big tech companies because they're the ones that can afford the fines? A breach is usually enough to make a smaller company go out of business already between cleanup and lawsuits. Why make it easier for the big tech companies to maintain power?
Did you even read my comment? I specifically mentioned that the size of the fine could be tied to their market cap.
If you work in cyber security, you’d know that there are best practices in place for cybersecurity and it is a WELL UNDERSTOOD FIELD. The main advice everyone gives is to never roll your own cryptography…and that is EXACTLY what many of the hacked companies did.
Taking a shortcut and hiring shitty devs who just use some random NPM package for security and call it a day is exactly why there are so many breaches. Just as bridges need to be built to withstand double or triple their weight, there should be STANDARDS in place that if violated are subject to fines.
Companies like Google would basically have to build SUPER SECURE technologies lest they be bankrupted by a breach.
In conclusion, please try to remove your tongue from your exploitive employer’s back side.
I did miss that, but again, it's additional fines on top of an almost guaranteed lawsuit for something that may not even be their fault. If they got owned by a Heartbleed exploit back when it was first announced and a fix wasn't available yet, should a company be responsible for that? What about when they get hit by a vuln that's been stockpiled for a couple years and purposely has no fix due to interference from bad actors? There are a lot of situations where fining someone for getting breached doesn't make sense.
You make great points but my final point is this: if a company simply cannot guarantee protection of user data, it shouldn’t be trusted with user data in the first place.
And I'll counter with this: no system is perfect, especially when major parts are made by non-employees. Mistakes can and do happen because corporations, regardless of size, are made up of humans, and humans are really good at fucking up.
I’m not trying to get the last word, I swear! 🤣
Go back to my bridge analogy and test that against what you just said.
Your comment equates to: “oh well, that bridge falling killed thousands of people. At least we were able to allow them to fail in the crucible of the free market!”
Your bridge analogy falls apart because there already are standards (FIPS, among others) that are shockingly insecure despite having been updated relatively recently, and yet we still have breaches. If the standards were effective, places like AmerisourceBergen, the country's largest pharmaceutical distributor, wouldn't be supplementing them with additional safeguards. No standard is going to work perfectly, or even particularly well, for everyone. Bridges still fall down.
EDIT: Alternatively, there would need to be a provision that allows companies to sue the government if they get breached while following their standards, since it was the government that said they were safe.
Anyone who says, “think of the corporations” before they think of the people being PERMANENTLY compromised is a lost soul indeed. You are blaming the inadequacy of standards rather than the demagogues working for the corporations that enabled these lax standards. Of course there are going to be 0 day exploits that no one could protect for but that is a red herring. That’s something that could easily come out and be considered when that company is brought in front of a civil court to decide the fines, obviously!
I think we’re too dissimilar for this conversation to bear any fruit. Thanks for the well constructed devil’s advocate stance but you certainly haven’t convinced me.
When you say "corporations," it seems like you're exclusively counting companies like Google, Meta, etc, whereas I'm also including the mom and pop, 15-person operations that would be impacted by the same regulations you suggest. Those underdogs are the ones I want to protect, since they're the only chance the world has at dethroning the incumbents and ensuring that the big guys don't outlive their usefulness.
I’m not.
And what I proposed (see my revised original comment) actually protects those companies because it takes into account:
See, I figure all of those things would be accounted for in whatever civil suit gets brought against the company. Frankly, I think that's much more fair to companies both big and small because it involves a group of people working together to figure how much of a fine to levy in each individual instance, rather than having a blanket policy that may or may not account for edge cases. If the company is huge and the fuckup egregious, then the jury is (theoretically) going to throw the book at them.
At the very least, I'd want a jury in between the company and whichever government body is fining them, because regulatory bodies are prime targets for corporate shills to take over and it's harder for that to run rampant if you have a bunch of regular jackoffs acting as gatekeepers.
There's also the issue of ongoing compliance for small companies. Cybersecurity engineers are not cheap, and being all but required by law to employ one could (1) drive small companies out of business (180k a year may be cheap for Facebook, but it's definitely not for Joe Buttsniffer and Sons Catering), and (2) cause market saturation so bad that the average salary makes nobody want to do the job anymore.
Agreed. Corporate regulatory capture was a 100% success in the United States. It has been that way since at least Reagan. It always comes back to government corruption and what I see in these kinds of civil suits against corporations that were breached is a gentle slap (actually more of a caress!) on the wrist (and a wink and a nod when the cameras turn off) between the demagogues and the corporations that own them.
Yeah it really comes back to "fines are only for poor people." Google can just count the fines as the cost of doing business while simultaneously leveraging their dominance to force other companies to break regulations in order to work with them.
It’s VERY similar to how we (in the US) allow Congress to decide the rules that THEY THEMSELVES have to follow when you have the legalized bribery that is known as lobbying in the US.
You know what I bet we both agree on? Limited liability in general being a shit idea.
I just realized you’re the Tesla guy from yesterday. I’m glad we could have a more mature discussion on this topic and I’m glad I didn’t block you. 🤣
NGL, my first comment was partially meant to see if you actually had blocked me lol
😃 Wholesome AF. Sorry about yesterday. That was a SUPER immature discussion after a while.
I wouldn’t consider you my best friend or anything but I’m glad I didn’t put in blinders to someone critical of my ideas. Cheers, fellow fediverse user. After all, you don’t seem like a dummy; just a person with different perspective than me.
Hey man, it happens. I could tell that you had some valid arguments in there, I was just trying to get you to express them. I definitely didn't help by joining in the immaturity either.
Side note, I'm legit starting to hate my Tesla anyway, but I wasn't about to admit that yesterday lol. There are absolutely a lot of valid criticisms of them, I just think the majority are overblown, especially as they relate to FSD. I'm in the beta and it's basically the only reason I still have the damn thing.
Anyway, I'm sorry too. I probably should have just walked away when things got heated, but there was a part of me that was secretly hoping to see how long we'd keep going back and forth calling each other assholes because I thought it would be funny.
Just want to say that I appreciate how you two ended up haha. It was a wide eyed “Woah” from me at the beginning there (both), but I do love that you guys talked it out and ended up all civil and complimentary. There’s hope for us all to understand each other is my takeaway. Thanks to both of you for showing us the way.
This interaction definitely improved my day even more than our interaction yesterday perhaps soured my day. Thanks for that!
This fediverse thing is really nice sometimes. I look forward to some really good discussions. I promise to try to keep my cool. If I call you a name, you should know that it is with a smirk and only meant as a soft, subtle jab. :)
My data has been stolen so often I have free monitoring for the rest of my life.
And everyone should just assume that every account they have will be hacked. Because it already is, they just haven’t found out yet (assume breach).
I honestly wonder if my data wouldn't be safer on some sites, if I skipped two-factor authentication and a recovery email, and simply used my date of birth as a password. At least then, they'd wouldn't be able to leak the phone number or email adress, because I was never forced to give it to them.
It's even more annoying, because you can't easily avoid many of these companies. Eg. for jobs it's really hard to get around using linkedin. I mean, I refuse out of principe and have for years, so my data's a decade out of data, but it's obviously cost me opportunities.
There are almost certainly pictures of me floating around social media, taken without my permission, but tagged by facebook or google just in case I had any fucking privacy. And now thanks to some phones. they also have our finger prints and retinal scans, which will inevitably get leaked sooner rather than later. I pity the poor chumps whose DNA was leaked, that's even worse. Most of that will probably be leaked sooner or later, if it hasn't already, because it turns out a subcontractor used the youtube comment section to communicate between departments.
If I had the technical ability, I would design a two-factor authentication system based on rectal scans.
"Here at OmniCorp we believe all our customers our unique, that's why we believe in securing your data by linking your DNA, phonenumber, social security number, retinal scan and finger print, with a picture of your anus. Bend Over. The Future's Now."
“hop up here on the table so I can scan that ass”
MySpace in the news as Top Western Leaker
That seems weird, it’s called mother of all breaches, but isn’t the result of any one breach. It’s just data collection from ordinary breaches with perhaps some credential stuffing in the mix.
We just need a free dart monkey or two, it’ll be fine.
I think it’s gotten to the point that we. (Collective) Have to start using alias. I know proton for a price gives fake mobile and email address.
I have started using a 5th email to sign up to things. Have an extra number as well. It’s beyond a joke really.
Tried to sign up for a budget app and it requires email phone and address.
No. No you don’t require any of that. You want that to sell. And you’ve likely got inadequate protection.
Nobody but my bank job and maybe a few places require all my info.
Oh proton gives mobile too… Ya know I didn’t feel like paying for the mail thing as I can have my domain and relay easily but the mobile thing I didn’t know.
But I will be honest I didn’t see it mentioned on the web, it’s already a thing?
They only generate email addresses.
Could you use Google voice to generate a dumby phone line ? There are probably better non-google options now though.
The problem here is that all of the registration information that is listed for a number (OCN, LATA, etc) allows them to track back what TYPE of number it is based on what ILEC/CLEC it’s registered with and how it’s registered.
This means when I put my google voice number into some things, they can come back and yell that it’s not a mobile phone, or that it’s a virtual number, or whatever and disallow it.
alcazarnetworks.com/data_services_lnp_lrn.php
protonvpn.com/…/protect-your-privacy-with-second-…
But could this also bypass dumb VoIP requirements for things like SMS 2FA?
I’ve tried using my Google Voice similarly but I’m faced with “I’m sorry but this number cannot be used for this.”
Am I blind or are none of these actually offered by Proton themselves?
Why do you not just use OpenOffice Calc for your budgeting?
What’s that ? Just excel spreadsheet?
Yeah except it’s fully FOSS. If you set up nextcloud there’s even a web app for it that’s pretty good.
Will need to check It out. Will it play nice with other applications ?
I used it in college and never had any problems, it seems to have feature parity with Excel. I used Excel professionally for a while and some of the workflows are a little different, but on the whole it’s really intuitive and easy to use. I’m sure there are other FOSS budgeting solutions, but Calc works so well for me I don’t see myself using anything else.
I’ve always thought LinkedIn is nothing more than a massive treasure trove of personal information just waiting to be harvested by thieves wanting the entire life and work history of millions of upwardly mobile career focused people.
Work History ok… But entire life… I guess people that used like it’s Facebook maybe? 🤔
LinkedIn is trying to encourage people to use it as a social networking site.
“The MOAB contains 26 billion records over 3,800 folders, with each folder corresponding to a separate data breach. While this doesn’t mean that the difference between the two automatically translates to previously unpublished data, billions of new records point to a very high probability, the MOAB contains never seen before information.” Totaling 12TB.
Kind of worrying when their source is a “data breach information website” that does advertorials for “the most safe password manager” NordPass. 🤮 The internet of today has become a pile of absolute shit.
We should make a new internet in the dark web, but only invite cool people. No billionaires, narcs nor finks allowed !
No narcs or finks? What about patsies or stoolies? Can we at least have phonies?
I’ll give you one chump and half a busta, but that’s all you’re getting!
Best I can do is two scrubs and whatever’s left of our collective hope for the species.
I don’t want no scrubs
What about phonie bronies?
Absolutely not !
<img alt="letterkenny dark web meme image" src="https://lemmy.ml/pictrs/image/ee35a8be-62b0-4f83-83c2-faba0d8df362.jpeg">
<img alt="" src="https://lemmy.ca/pictrs/image/9dd8ebf6-d9ca-4fd7-9e40-891a28050c31.gif">
Yes: -coolsters -rad dudes -rockin chicks -chill peeps
No: -bilionaires -narcs -finks -Howard (yes you, Howard)
Howard is the worst, after Bill Gates
<img alt="" src="https://lemmy.world/pictrs/image/5d9e65b3-dd66-4121-8626-a62f43894834.png">
Definitely recommend a password vault to anyone that doesn’t already use one. After this next hack leaks, I imagine you’ll get at least a couple of attempts on your email/phone.
I had an identity theft a few years back, still cleaning up from it. At the time I had the typical set of standard passwords that I would use. I thought they were ok since they were pretty random but I had one for Financial, one for Web Services, etc. so of course when the creds leaked, I suddenly had a bunch of credit card bills I never signed up for…
Since then, every password is unique, my default is 31 characters, and 2-factor for everything possible. Unfortunately I initially settled on LastPass, figured that they had hopefully learned their lesson from their breach years ago. Then it happened again recently and I moved to Bitwarden so that I can eventually migrate to a self-hosted solution.
I’ve been trying to get my family on board for years but it’s still too complex. Non-technical folk still will take the path of least resistance, even when the dangers are right in front of their face. We need something better.
Who do you recommend?
Keepass is probably the most secure, but was a pain for multi device / multi OS users last time I used it.
Currently I use Bitwarden. You can either use their backend or you can self host. Cross platform, multi device support, 2FA support.
Thoughts on 1Password?
I don’t know much about them to be honest, and what little I have heard sounded like it was paid for. My knee jerk reaction is to avoid them. Maybe they’re decent, maybe not. Couldn’t say.
They are okay, but I had massive problems with their browser plugin after a while and moved to bitwarden
I use Keepass with Syncthing as the sync backend. Syncthing comes as a Docker container these days and sets up in seconds, I like how it doesn’t rely on a central server and gives you some redundancy.
Also, Keepassxc is a rewrite with better integration, true cross platform support and more features, keepassxc.org
They said this about the equivalent breach, and yet here we are.