Hacker News Reader

Comment by nodesocket | Hacker News Reader

From what I read in the complaint, it wasn't as blatantly bone headed as other breaches. Seemed to be an IAM permission issue related to AWS WAF.

This argument is constantly made on HN and it is analogous to; you left your back door open at your house, and instead of arresting and prosecuting the robber, we are going to arrest you. Sure, I made a mistake and left my back door open, but that doesn't give the robber the right to break in and steal my stuff. It is lacking a moral compass and sense of right and wrong. There needs to be consequences for bad behavior.

View on HN

I think it's more like I left the back door of your house open, without ever having permission to access your house, and you got robbed because of that.

I admit the Equifax situation was worse. The people whose data was lost by Capitol One probably at least have some sort of business relationship with that company (for example, they may have applied for a credit card). I had no business relationship with Equifax at all, yet apparently information about me was leaked. I don't buy anything on credit, so I don't give a tinker's damn what my credit score is. Equifax provides no value to me whatsoever, yet I now have to worry about information they collected about me with no authorization from me. I'd like that company to be sued into bankruptcy.

The closest analogy would be that you gave me your house key so I could go in and water your plants while you’re on vacation (signing up for an account), but someone grabbed the key off my counter because I left my back door unlocked. The folks who had their information leaked in this instance had signed up for accounts with C1.

If I steal capital ones company vehicle and get in a head-on collision, capital ones insurance still pays the damage. I'm still criminally liable for unlawful entry, but C1s insurance covers the damage done by their vehicle. The same precedent needs to apply here. If I broke into a chemical plant and released harmful toxins into the air, the company is still civilly liable. In this case, the data is the toxin.

Reply on news.ycombinator.com