Hacker News Reader

Comment by jrockway | Hacker News Reader

> If these keys are so important, why are they not treated with similar security measures as CA keys?

No incentive, right? If you mess up as a CA, you go out of business because every browser drops you. But if you're an identity provider and you have an incident, maybe 1% of your customers opens an angry support ticket and you give them 5% off their bill next month. So why bother? Are YOU going to move your 100,000 employee organization off of Microsoft because of this? No? Then why would they care at all? They won the sale and you're stuck with what you get.

Here's a list of companies that have gone out of business because they didn't take information security seriously:

Here's a list of billionaires who had to sell their yachts because they didn't prioritize security over other concerns:

Yeah.

View on HN

I get what you’re saying, but there’s more nuance here. The smaller the business is, the likelier it is to fold within 1-1.5 years if a major compromise. I’m asserting that in the back of some FBI statistics published about BECs awhile back.

I would posit that your first list needs a conditional for “too big to fail”.

The US does not prioritize small business, or sole proprietorships.

Anyone even adjacent to business or finance during COVID could very clearly witness the wealth transfer, and the smaller competitors being swallowed.

Did you mean to reply to another comment? I don’t see the correlation between your comment and mine. I didn’t assert the US was small business friendly, just that smaller businesses are much more at risk than it seemed the parent comment acknowledged.

Which I think is an important point because by volume the majority of businesses in the US are small and mid-sized businesses.

>No incentive, right? If you mess up as a CA, you go out of business because every browser drops you.

Not going out of business is not the only possible incentive though. Security is a pretty key part of the sales pitch of every cloud provider: "We can do this better than your in-house team" they keep saying.

No one is going to move 100,000 employees off Microsoft over this, but what about signing up the next 100,000? Will it impact next quarter's growth figures?

And for the people directly responsible for security at Microsoft breaches like these may be a career risk or at least a huge embarrassment. There will be meetings. People will get blamed. Some will feel they haven't met their own professional standards.

There's no lack of incentives.

you claim that contracts at this level are executed on the basis of technical merit?

I'm not sure I would call it technical merit, but sentiment and reputation do play a role in negotiations. No cloud provider wants to be perceived as having a weakness in terms of security compared to its closest competitors.

There are debates about risks when large companies move to the cloud - in some industries more than in others. Opposing groups within companies as well as competitors' sales people will be looking for weak spots to make their case.

In isolation, incidents like this don't make a difference. If it looks like a pattern that would be bad for business though.

Does Microsoft have a reputation for good security, adequate security or poor security?

How has this affected sales over the years?

I believe they won the PC wars years ago and there has never been a good replacement system with enough customer incentive that met the same price point. It is this cow they continue to milk.

Reply on news.ycombinator.com