Make company liable for damages when breached.
If you want companies to care about security then you need to make it affect their bottom line.
This wasn't the work of some super hacker. They literally just posted the info in public.
If you want companies to care about security then you need to make it affect their bottom line.
This wasn't the work of some super hacker. They literally just posted the info in public.
Its not like anyone intentionally posts their entire DB to the internet.
Without personal and professional consequences, the default 1 year of credit monitoring for weak security is just the cost of doing business.
By all accounts this app has no security professionals involved with it.
Its not like there was some incompetent cyber security expert saying its ok to skip ACLs in firebase.
You could: - make Software Engineer a protected title that requires formal engineering education and mentorship as well as membership to your country's professional engineering body (Canada already does this) - make collecting and storing PII illegal unless done by a certified Software Engineer - add legal responsibility to certified Software Engineers. If a beach like this happens they lose their license or go to jail. And you easily know who is responsible for it because it's the PEng's name on the project - magically, nobody wants to collect PII insecurely anymore or hire vibe coders or give idiots access to push insecure stuff - bonus: being a certified Software Engineer now boosts your salary by 5x and the only people that will do it actually know WTF they are doing instead of cowboys, and that company will never hire a cowboy because of liability. The entire Internet is now more secure, more profitable for professionals, and dumb AI junk goes in the trash
Like this
Many non-certified people call themselves "software engineers" with no consequence.
My SSN / private information has been leaked 10+ now. I had identify fraud once, resulting in ~8 hours of phone calls to various banks resulting in everything being removed.
What are my damages?
This won't be enough, you have to make PEOPLE liable for breach.
Making a corporation being liable is useless, it's a legal Person and it can simply declare bankruptcy and move on.
> We can reduce the latency of discovery and resolution by adding software protocols.
Can we? What does this even mean?
[Edit: i guess you mean the things in your parent comment about requiring including some sort of canary token in the DB. I'm skeptical about that as it assumes certain db structure and is difficult to verify compliance.
More importantly i don't really see how it would have stopped this specific situation. It seems like the leak was published to 4chan pretty immediately. More generally how do you discover if the token is leaked, in general? Its not like the hackers are going to self-report.]
My bigger concern though is how you translate that into discovering such breaches. Are you just googling for your token once a day? This breach was fairly public but lots of breaches are either sold or shared privately. By the time its public enough to show up in a google search usually everyone already knows the who and what of the breach. I think it would be unusual for the contents of the breach to be publicly shared without identifying where the contents came from.
jfif is just an example. any file format or metadata could be used as a signature depending on the storage type.
Yes dark web scanners are a thing, but just because something exists does not mean it would work for a specific situation. I'm doubtful they would work most of the time.
That is why Tea did not operate in Europe.