full-disclosure - Re: EE BrightBox router hacked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 16 Jan 2014 18:09:57 +0000
From: Dan Ballance <tzewang.dorje@...il.com>
To: noloader@...il.com
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: EE BrightBox router hacked - bares all if you
 ask nicely

Totally agree with the driving drunk analogy. I mean, we say that car
manufacturers and airplane companies have to run their systems to agreed
standards. And this is done in such a way that safety on the roads and in
skies improves. So why can it not be done for the IT industry? Nobody talks
about the car industry collapsing because they're being asked to meet basic
safety standards. Maybe it's convenient for some security professionals to
see things carry on as they are? I don't know.
On 16 Jan 2014 18:03, "Jeffrey Walton" <noloader@...il.com> wrote:

> On Thu, Jan 16, 2014 at 12:44 PM,  <Valdis.Kletnieks@...edu> wrote:
> > On Thu, 16 Jan 2014 11:30:18 +0000, Dan Ballance said:
> >
> >> So your point is that there should be legislation to require companies
> to
> >> adhere to certain security standards? I'd support that - particularly
> in an
> >> ISP market which is clearly defined by national boundaries and law.
> >
> > OK.. What standard do you want to hoist as a legal mandate?
> No standards are needed. Attach a nominal dollar amount to the data.
> That will unbalance the risk equations and the industry will act on
> its own.
>
> For example, if it takes 2 hours to reset  to all your passwords
> (password reuse is rampant), then allow a consumer to recover $250 for
> their time. If PII is lost allow them damages of 7 years of credit
> reporting (about $150) plus actual damages from any loss.
>
> Hell, I had to overnight a credit card last summer while on business
> that was cancelled due to a breach. That cost me $75.00. Perhaps
> triple damages are in order, too.
>
> > Bonus points for finding a standard that provides enough *actual*
> security
> > that it is worth doing...
> +1
>
> > ... but yet won't bankrupt the industry.
> Computing is a privilege, not a right.
>
> Should Sony continue to be allowed to compute when they suffered at
> least 50 incidents, including dataloss
> (http://attrition.org/security/rants/sony_aka_sownage.html)? Hell,
> Sony suffered 7 different incidents in one month
> (
> http://www.thetechherald.com/article.php/201121/7185/Seven-security-incidents-in-two-months-Sony-s-nightmare-grows
> ).
>
> How much time an aggravation have they caused to institutions and
> consumers?
>
> That's driving drunk on the information superhighway.
>
> Jeff
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/