by Anonymous Coward writes:
on Thursday October 08, 2015 @10:20AM (#50685839)
Am I the only one that doesn't understand what this poll means? I can interpret it as what companies do with our data as well as what we do with our data, and given the options I don't know whether it's asking what's the biggest factor currently or what should be the biggest factor in the future. I can also construe the 'data' part to mean things like credit card information and social security numbers (related to identity theft), or my buying/searching/whatever habits online, and my answer is different depending on which combination of interpretations I use...
Maybe my reading comprehension needs some work, but I think that this poll is a mess.
Agreed. A huge factor for my personal data protection is its vulnerability to access by deep-pocketed and technologically savy government organizations who think they' need to screen all data for possible threats without admitting so. And that's not reflected in any choices.
Given the options, I take the "factor" to mean "reason to be concerned over my own".
I think whoever wrote this poll didn't understand the words "biggest" and "factor". Before seeing the options, I was thinking RSA Inc and similar commercial factors, but the poll options made no sense in that context. I then thought he or she meant "most likely driver", but the poll options still made no sense. If that were the case, I'd have expected to see fear of governments or corporations as options. Perhaps he or she meant biggest pitfall?
Given the options, I take the "factor" to mean "reason to be concerned over my own".
Interesting. I took it to mean "what is the most important factor for ensuring our personal data protection?" Again, that was based more on the options than the question.
That both are reasonable interpretations means we can all agree...it's a terribly worded question.
ANYbody who uses Cortana (or Windows 10 for that matter) either doesn't care about their data/privacy thereof, or has bought into the "koolaide" that MS has their back... Frankly anything that MS puts out from here on out, is getting nowhere close to any of my computers. I spent a nearly 25 year career supporting MS products, but I'm done with them now, after seeing Windows 10....
I'm not sure what the poll is trying is trying to ask, but maybe they're asking for SOLUTIONS? Based on my 20 years of professional experience in information security, I can give a somewhat informed opinion on that.
For over 50 years, programmers have been trying to write software the works. It gets certain input and returns certain output. Garbage in, garbage out of course. If you throw improper and malformed input at it, that's your fault and there's no guarantee what you'll get back.
Me too. I can't vote.. Every option has multiple potential meanings. Grammar.. Grammar for Pollsters! That's why they used to teach it and you couldn't get out of K1-12 without it.... Cause and effect is your friend. Correlation is the enemy of reason!
... From a tall lamp post. In Public, for everyone to see.
It's high time that vigilantes take these Thieving bastards on. It's clear that Institutional Remedies not only don't work, "They" aren't even trying to apply them.
That's the one I chose, but if a company is loosey-goosey with their security, then there's nothing you can do in that case, but you can still prevent the spread of harm. Use unique passwords for each site, make up the answers for your security questions (but you have to remember them!), etc. I still keep all of my info old-school in a password-protected encrypted spreadsheet. I tried a password manager before, but many sites won't accept the software generated passwords because they have weird requirements. I also know my passwords for my important accounts and I always type them in, which helps me to remember them; I never have them stored automatically in the browser.
Pretty much this. I'm a pretty staunch Classic Libertarian and, frankly, the rights belong to the people - the individuals. That too means that the responsibilities lie with them too. Failure to do due diligence and use best practices is the fault of the end user and negligence is no excuse. At the same time, companies must be held accountable if they fail to do as they claimed they would do. If they say your shit is encrypted then it better be encrypted. Companies should have clear and public personal info
That's what I chose, but I'll qualify it: When people went for mobile platforms in a big way, they gave up a lot of control. "The cloud" became a normal thing.
So I think that is a big factor in privacy: The platforms and how mainframe-centric they are. I am still a big believer in the PC Revolution, and I think that improving endpoint security is the biggest contributor to privacy in the long run; PCs are still the best endpoints because they have options that (although still esoteric) are very secure and p
I notice that "government" is never mentioned as a potential problem, in spite of, for instance, the US Government's current efforts to "acquire" as much personal data as possible on...everyone.
Amen. The EU high court even ruled this week, in the Facebook data case, that the USA can not be considered a safe haven for data belonging to / produced by / pertaining to EU citizens.
Which I find amusing. Europe itself isn't a safe harbor for data being produced or pertaining to EU citizens. I'm not entirely certain why they actually give a shit why the US government wants it.
I'd be more upset about the loss of data privacy if I actually thought it was ever a real thing to begin with. The only reason we had privacy in the past is because no one could collect the data efficiently. Otherwise, it's pretty much been out there to collect.
If you're going to post your shit on Facebook, gue
Waking up to what? That big government collects data on everyone?
Here's the solution to big government collection of data... stop voting for big government.
You want government sponsored everything? They are going to want your data. Not you in particular, of course. Just everyone's data so they can find who they consider to be bad guys in there.
So, everyone's going to wake up politically? To what realization? Communism? Libertarianism? Anarchism?
The problem that we are fighting is not the root of the problem. Identity theft would be largely irrelevant if banks actually authenticated their users before issuing credit cards and loans to them. The fact that we have this silly model where you provide your social security number (or something similar in non-US countries) and you get a loan on the full faith and credit of the owner of the number is laughable.
In any other industry, you could not authenticate that the person is who they say they are by simply providing a number that gets passed around by everyone.
Banks that issue credit cards without strong validation of the person being who they claim to be should be 100% responsible for any damage or wasted time they cause to the victim. Victims should be allowed to recover a punitive fee for any time a bank allows someone to get money from the bank, under that user's credentials, by simply providing widely known information (like SSNs and birthdays).
The reason none of this happens is that banks calculate that they stand to gain a lot when credit is given fast and loose and without proper validation of the person being who they say they are. The banks understand that there is very little consequence on their behalf, compared to the great gains of enticing people to get credit on the spot by just filling out this little form. If the banks actually felt pain for not verifying the users are who they say they are, none of this would be an issue.
It's worse than that... anybody that knows your checking account number can do an electronic transfer out of your account, exactly as if you had written them a check, except no signature is required! When I complained about having this done to me, the back insisted they would only refund the fraudulent withdrawal if I closed the account so it wouldn't happen again. Problem was, there were dozens of automatic payments posting to that same account every month...
We also need to completely abandon the concept
Not just banks. Gateway computers shipped millions of dollars worth of computers on credit... credit applied to with an online form. Shipped to addresses that didn't need to match the one on the credit report. Apparently, their attitude was, "We don't care if you use somebody else's identity to buy merchandise, as long as we get paid!"
People are the weakest link in any security system. No technology can adequately compensate for human stupidity. The poll numbers bear this out, the biggest problem is "individuals". Yes, I do have several dozen online accounts, all using the same password, thank you very much! I also use the same password I started using in 1978 in a few cases... I'm sure none of the people that have seen it in that time remember it! (It's a standard dictionary word, by the way, but unusual in that it contains no vowels!) Wait... did I use that password on this account too?
The real problem with identity theft is that courts are granting judgements which absolutely should not be granted. Someone got a judgement against me for credit granted on the basis of a check cashing card with my social security number written on it, and not very well I might add.
Of course, another way to fix this problem (and all debt problems) would be to make all debt the responsibility of the lender. They can take risks, they can accept collateral, but the courts couldn't then be used to ruin people's lives in pursuit of profit. The guy who created this bogus debt in my name knew it was bogus, and his filing against my credit report was therefore fraudulent. But the court should have caught it, and they either don't care or want to enable this activity so that they can profit from the assorted fees and justification for their existence.
My point is that it's not in their job description.
They're job description is defined by law, it is in fact their job description to be responsible for the actions of ALL subordinates.
They make decisions. They don't manage.
...
You're an idiot.
Jailing the CEO over a data breach is as fucking stupid as jailing the Superintendent when the lunch lady undercooks the meat.
Right, its in no way the responsibility of the person above you to validate and ensure you're doing your job properly. They have no responsibilities at all. You can totally do what ever you want and they have nothing at all to say about it. You will in fact find, in your example, IT IS STILL the responsibility of the superintendent to ensure that the lunc
The CEO is legally responsible for the company he/she runs. THAT IS THE LAW. (I'm not referring to random sole proprietorships where stupid people call themselves a CEO, I'm talking about real corps where they actually have 'officers'.
BY DEFINITION HE IS RESPONSIBLE FOR THE ACTIONS OF HIS SUBORDINATES.
It is HIS responsibility to ensure that proper auditing is in place, this is THE LAW. Its negotiable, your opinion doesn't change you. You are simply 100% wrong in your silly little 'its not their respons
Steal something? Get a finger cut off. Kill Someone? Hang. Sex crime? Get your wankie cut off. And LLCs should be eliminated, all it does is protect the guilty.
It's hard to undo if there is a mistake anywhere in the justice system. No justice system ever in the history of humanity or in the future will ever be perfect and not make mistakes.
I don't fear getting my finger cut off for stealing something. I fear getting my finger cut off for being accused of stealing something I did not.
Was I the only one who read "Security Gaffes" as "Security Giraffes"? And what would a Data Security Giraffe be like? Would they be upside down giraffes since in CSci we always draw trees with the leaves at the bottom?
Companies' fear of large fines from regulators: incentivizes companies to skirt around regulation Companies' fear of class-action lawsuits: incentivizes lawyers to pursue cases without actually benefiting victims much Companies' fear of reputation loss: this is only the case if incidents are rare Harsher punishment for ID thieves: incentivizes thieves to hide better or not commit a crime Harsher penalties for individuals' security gaffes: how do you even propose to do this? Individuals' vigilance with passw
1 year for directors, 2 years for VPs, 3 years for presidents, 5 years for CxO (all felony in hard-time prisons), and close the company for any breach. Then, and only then, will the officers and shareholders take securing data seriously.
Machines certainly can solve problems, store information, correlate,
and play games -- but not with pleasure.
-- Leo Rosten
Huh? (Score:5, Insightful)
Am I the only one that doesn't understand what this poll means? I can interpret it as what companies do with our data as well as what we do with our data, and given the options I don't know whether it's asking what's the biggest factor currently or what should be the biggest factor in the future. I can also construe the 'data' part to mean things like credit card information and social security numbers (related to identity theft), or my buying/searching/whatever habits online, and my answer is different depending on which combination of interpretations I use...
Maybe my reading comprehension needs some work, but I think that this poll is a mess.
Re: (Score:1)
Agree. Useless poll, not worth my voting.
Re: (Score:2)
Agree. Useless poll, not worth my voting.
Are you implying that some Slashdot polls are not useless?
Re: (Score:3)
Re: (Score:2)
Agreed. A huge factor for my personal data protection is its vulnerability to access by deep-pocketed and technologically savy government organizations who think they' need to screen all data for possible threats without admitting so. And that's not reflected in any choices.
Re: (Score:2)
Given the options, I take the "factor" to mean "reason to be concerned over my own".
I think whoever wrote this poll didn't understand the words "biggest" and "factor". Before seeing the options, I was thinking RSA Inc and similar commercial factors, but the poll options made no sense in that context.
I then thought he or she meant "most likely driver", but the poll options still made no sense. If that were the case, I'd have expected to see fear of governments or corporations as options.
Perhaps he or she meant biggest pitfall?
I don't know. It's English as She is Spoke.
Re: (Score:2)
Interesting. I took it to mean "what is the most important factor for ensuring our personal data protection?" Again, that was based more on the options than the question.
That both are reasonable interpretations means we can all agree...it's a terribly worded question.
Re: (Score:3)
Cortana, Show me my most at-risk opportunities. Ok, that should do it.
Re: (Score:1)
Who's speaking to Cortana? The data thief or the owner of the data? The answer varies by speaker.
Agreed, not a well-worded poll.
Re: (Score:2)
ANYbody who uses Cortana (or Windows 10 for that matter) either doesn't care about their data/privacy thereof, or has bought into the "koolaide" that MS has their back... Frankly anything that MS puts out from here on out, is getting nowhere close to any of my computers. I spent a nearly 25 year career supporting MS products, but I'm done with them now, after seeing Windows 10....
Re: (Score:2)
Same here mate.
bad question. Solution- fundamental change to prog (Score:2)
I'm not sure what the poll is trying is trying to ask, but maybe they're asking for SOLUTIONS? Based on my 20 years of professional experience in information security, I can give a somewhat informed opinion on that.
For over 50 years, programmers have been trying to write software the works. It gets certain input and returns certain output. Garbage in, garbage out of course. If you throw improper and malformed input at it, that's your fault and there's no guarantee what you'll get back.
A fundamentally di
Re: (Score:3)
Re: (Score:2)
No, you're not the only one. I couldn't answer because I couldn't figure out what the retard was asking.
English, motherfucker. Do you speak it?
Re: (Score:1)
Re: (Score:1)
Me too. I can't vote.. Every option has multiple potential meanings. Grammar.. Grammar for Pollsters! That's why they used to teach it and you couldn't get out of K1-12 without it.... Cause and effect is your friend. Correlation is the enemy of reason!
And "get off my lawn!!!"
Is the damn coffee ready yet?!?! :)
A Short Drop... (Score:1)
... From a tall lamp post. In Public, for everyone to see.
It's high time that vigilantes take these Thieving bastards on.
It's clear that Institutional Remedies not only don't work, "They" aren't even trying to apply them.
Re: (Score:2)
Re: (Score:2)
ID theft for monetary gain = capital punishment crime. Include credit card/check fraud in that.
If someone uses a fake ID for other reasons it has to be on a case by case basis.
Individuals' vigilence (Score:3)
Re: (Score:1)
Pretty much this. I'm a pretty staunch Classic Libertarian and, frankly, the rights belong to the people - the individuals. That too means that the responsibilities lie with them too. Failure to do due diligence and use best practices is the fault of the end user and negligence is no excuse. At the same time, companies must be held accountable if they fail to do as they claimed they would do. If they say your shit is encrypted then it better be encrypted. Companies should have clear and public personal info
Re: (Score:2)
That's what I chose, but I'll qualify it: When people went for mobile platforms in a big way, they gave up a lot of control. "The cloud" became a normal thing.
So I think that is a big factor in privacy: The platforms and how mainframe-centric they are. I am still a big believer in the PC Revolution, and I think that improving endpoint security is the biggest contributor to privacy in the long run; PCs are still the best endpoints because they have options that (although still esoteric) are very secure and p
Interesting omission (Score:5, Interesting)
Re:Interesting omission (Score:4, Informative)
Re: (Score:3)
Which I find amusing. Europe itself isn't a safe harbor for data being produced or pertaining to EU citizens. I'm not entirely certain why they actually give a shit why the US government wants it.
I'd be more upset about the loss of data privacy if I actually thought it was ever a real thing to begin with. The only reason we had privacy in the past is because no one could collect the data efficiently. Otherwise, it's pretty much been out there to collect.
If you're going to post your shit on Facebook, gue
Re: (Score:2)
Re: (Score:2)
Waking up to what? That big government collects data on everyone?
Here's the solution to big government collection of data... stop voting for big government.
You want government sponsored everything? They are going to want your data. Not you in particular, of course. Just everyone's data so they can find who they consider to be bad guys in there.
So, everyone's going to wake up politically? To what realization? Communism? Libertarianism? Anarchism?
You're entirely mistaken. Everyone's already awake, th
Change the banks' definition of authentication (Score:5, Insightful)
The problem that we are fighting is not the root of the problem. Identity theft would be largely irrelevant if banks actually authenticated their users before issuing credit cards and loans to them. The fact that we have this silly model where you provide your social security number (or something similar in non-US countries) and you get a loan on the full faith and credit of the owner of the number is laughable.
In any other industry, you could not authenticate that the person is who they say they are by simply providing a number that gets passed around by everyone.
Banks that issue credit cards without strong validation of the person being who they claim to be should be 100% responsible for any damage or wasted time they cause to the victim. Victims should be allowed to recover a punitive fee for any time a bank allows someone to get money from the bank, under that user's credentials, by simply providing widely known information (like SSNs and birthdays).
The reason none of this happens is that banks calculate that they stand to gain a lot when credit is given fast and loose and without proper validation of the person being who they say they are. The banks understand that there is very little consequence on their behalf, compared to the great gains of enticing people to get credit on the spot by just filling out this little form. If the banks actually felt pain for not verifying the users are who they say they are, none of this would be an issue.
Re: (Score:2)
They also have lobbies and campaign contributions to keep things the way they are.
Re: (Score:2)
Re: (Score:2)
multi prong (Score:3)
Do both!
- Investigate and severely punish identity theft
- Huge fines to companies with lax security, and also allow private lawsuits
And the winner is... (Score:3)
Re: (Score:2)
Re: (Score:2)
Psst - Don't you mean no shit?
None of the above (Score:4, Interesting)
The real problem with identity theft is that courts are granting judgements which absolutely should not be granted. Someone got a judgement against me for credit granted on the basis of a check cashing card with my social security number written on it, and not very well I might add.
Of course, another way to fix this problem (and all debt problems) would be to make all debt the responsibility of the lender. They can take risks, they can accept collateral, but the courts couldn't then be used to ruin people's lives in pursuit of profit. The guy who created this bogus debt in my name knew it was bogus, and his filing against my credit report was therefore fraudulent. But the court should have caught it, and they either don't care or want to enable this activity so that they can profit from the assorted fees and justification for their existence.
Jail terms for CEO COO CFO of hacked company (Score:1)
Only jail clears the mind.
No bail.
Just jail.
Re: (Score:1)
My point is it works.
Your point is they are clueless.
Jail sharpens the mind.
Re: (Score:1)
My point is they signed documents indicating they are legally responsible for reported results, and thus should be in jail.
Excuses are just that.
Re: (Score:2)
My point is that it's not in their job description.
They're job description is defined by law, it is in fact their job description to be responsible for the actions of ALL subordinates.
They make decisions. They don't manage.
...
You're an idiot.
Jailing the CEO over a data breach is as fucking stupid as jailing the Superintendent when the lunch lady undercooks the meat.
Right, its in no way the responsibility of the person above you to validate and ensure you're doing your job properly. They have no responsibilities at all. You can totally do what ever you want and they have nothing at all to say about it. You will in fact find, in your example, IT IS STILL the responsibility of the superintendent to ensure that the lunc
Re: (Score:2)
The CEO is legally responsible for the company he/she runs. THAT IS THE LAW. (I'm not referring to random sole proprietorships where stupid people call themselves a CEO, I'm talking about real corps where they actually have 'officers'.
BY DEFINITION HE IS RESPONSIBLE FOR THE ACTIONS OF HIS SUBORDINATES.
It is HIS responsibility to ensure that proper auditing is in place, this is THE LAW. Its negotiable, your opinion doesn't change you. You are simply 100% wrong in your silly little 'its not their respons
The punishment should equal the crime... (Score:1)
Re: (Score:2)
Steal something. Get a finger cut off. That's bullshit.
You can steal an apple or you can steal a whole country.
Re: (Score:2)
Why? Afraid of what will happen to you?
Re: (Score:1)
It's hard to undo if there is a mistake anywhere in the justice system. No justice system ever in the history of humanity or in the future will ever be perfect and not make mistakes.
I don't fear getting my finger cut off for stealing something. I fear getting my finger cut off for being accused of stealing something I did not.
Let Customers Sue For Breaches! (Score:5, Interesting)
Make liability for data breaches something that cannot be waived by contract. Things would wake up very quick.
I have no personal data you insensitive clod (Score:3)
Pesonal data? I have no memory of that.
Security Giraffes? (Score:1)
Was I the only one who read "Security Gaffes" as "Security Giraffes"? And what would a Data Security Giraffe be like? Would they be upside down giraffes since in CSci we always draw trees with the leaves at the bottom?
Look at the incentives and likely outcomes (Score:2)
Companies' fear of class-action lawsuits: incentivizes lawyers to pursue cases without actually benefiting victims much
Companies' fear of reputation loss: this is only the case if incidents are rare
Harsher punishment for ID thieves: incentivizes thieves to hide better or not commit a crime
Harsher penalties for individuals' security gaffes: how do you even propose to do this?
Individuals' vigilance with passw
What about the option from the other poll? (Score:2)
That I won't get the reward [bbc.co.uk] you promised me.
Companies NEED your personal information (Score:2)
Cowboy Neal (Score:2)
I trust my data to cowboy neal
jail execs, close companies (Score:2)
1 year for directors, 2 years for VPs, 3 years for presidents, 5 years for CxO (all felony in hard-time prisons), and close the company for any breach. Then, and only then, will the officers and shareholders take securing data seriously.