this post was submitted on 16 Sep 2024
228 points (98.7% liked)
Technology
59148 readers
2533 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Seems like a paltry amount, given what savvy social engineers could do with that data.
If you don't use proper security practices, you should be on the hook for prison time at a minimum.
It should be $0 because this was a credential stuffing attack (Using breached passwords people reused), and affected people who knowingly shared their data with other people.
23&me didn't leak data, they didn't have any database breaches, their infrastructure wasn't compromised due to negligence...etc The majority share of negligence is in the users here.
Yes, they should have MFA, but also no, most sites and services don't force you to use MFA to begin with, and that's not a regulatory requirement anyways.
This is, for the most part, the fault of the folks using terrible security practices such as refusing passwords and sharing their data with other users. And this is a shitty precedent to set where the technical reasons for this event are thrown out the window in favor of the politics of it.
Who would you jail? How would you decide whos responsible? You can't jail the entire company.
But with a sufficient size fine you can make everyone at the company regret that decision, directly or indirectly.
Who would I jail? The C-officers. Your shit show, your responsibility. If you can't trust your employees, figure out why or do the work yourself.
I've always been hugely in favor of it. It's the one change that could maybe justify their gargantuan salaries -- if your company causes harm and suffering, the leaders absolutely need to be put on the hook.
You punish everyone in proportion to their responsibility
But they're not suggesting they be punished at all...
So all the people who actually make the decisions walk away scot-free?
I didn't say that. However, if delegation is too risky, do the work yourself.