Given what we have seen so far there are probably so many weaknesses in this application that the NSA barely even noticed the loss of this one. Since it didn't give them access to the content it was a minor exploit at best. A more likely response is:

To: security@snapchat.com
From: NSAops@nsa.gov

Subject: Latest Snapchat security update

Thanks for not really taking this seriously and just saying that you'll pay more attention next time when someone tells you that you have a issue. We were concerned that you might go back and find the really serious exploits we are using to capture all of the content that flows through your system. No worries then.

Thanks.

A Concerned NSA Analyst

I agree, but the rapid development life-cycle is not solely responsible. Even in this day and age, most developers still don't have a good working knowledge of application security. I feel like this is a systemic issue with the education process. Across the teaching spectrum from post-secondary education to "teach yourself" books to boot camp instruction, application security is barely given a mention. Most of the developers that I have hired that did know something about it came from larger development shops that taught application security in house, sent their developers to additional training or they learned it from their mentor. At least with a basic understanding of application security you have a second "hat" that you can put on and look at the application design from a different perspective. You have to be able to look at your application and ask yourself how you could exploit or break it. If you can't, hire or contract someone who can.

It was not the correct response. They just "hand waved" it off when they were informed of the issue, basically saying that they knew better than the researches that found the exploit. Turns out that they were wrong and paid the price.

I think it's a little too late to be closing the barn door now. The horses are all long gone. They had a major security breach and their chances of a sale or IPO have gone swirling down the toilet. The top Google search results will return news of this hack for years to come.

Unfortunately in this day and age of web application development the security aspects of many projects seem to be an afterthought if they are considered at all. Personally I hope that they and other developers learn from this and begin being more proactive in their security considerations, but I doubt it.

It's more of a "how do you boil a frog?" type of gradual decay. The question will be more of "Where were you when you realized that they had suspended the last of the Bill of Rights and the Constitution?". In either case the answer will likely be on the day that they come for you.

Make them line item accountable to the GAO. That should royally screw them all.

Timothy, Timothy, Timothy. When will you ever learn? "Ask Slashdot" posts belong in the "Ask Slashdot" section so that those of us who choose to filter out those stories can do so. It doesn't work though if you keep posting "Ask Slashdot" stories in other sections.

And since you can't prove a negative, your self sustaining paranoia will remain steadfastly intact. Might want to loosen your tin foil hat a bit. It's cutting off circulation to one or more organs.

You say that like it hasn't already happened. Many of the blog bots just happen to be organic in nature at the moment but most could be replaced by a short shell script.

Hopefully the revelations about what they have been up to will be enough to prevent them from ever being able to "eturn to the position that we had prior to his disclosures".

Timothy, Timothy, Timothy. When will you ever learn? "Ask Slashdot" posts belong in the "Ask Slashdot" section so that those of us who choose to filter out those stories can do so. It doesn't work though if you keep posting "Ask Slashdot" stories in other sections.

In this case it does because it makes PIN blocks encrypted using the same working key be completely different. This prevents someone from performing a chosen plaintext attack by setting their own PIN to be 0000 or 1234 and comparing the captured PIN block to others. More of a limited rainbow table I guess.

Take a look at DUKPT, short for Derived Unique Key Per Transaction, to better understand how a PIN pad can be loaded with a set of keys that the merchant does not know. Similarly many PIN pads support remote key loading where asymmetric encryption is used to send a random 'working' 3DES key to the terminal. That key will be periodically replaced with a new one. Again the merchant has no idea what key is being used by the terminal at any given time.