1,282 karma · joined July 25, 2012
https://www.bloomberg.com/features/2016-venezuela-cafe-con-l...
But note I think you mean the $12 price but that’s only available from the 28th Feb. To buy today it is $11,500 (unless as others have pointed out you got it as part of the trademark sunrise period)
Remember GDPR is specifically concerned with "A personal data breach" The original breach that led to the password being leaked was likely also a personal data breach (unless the only thing the hackers managed to access was the username/password database - and even then email address can constitute personal data in some cases), but there is definitely a personal data breach as a result of the credential stuffing attack (in the Deliveroo case, more than likely full home address, possibly other addresses too like work, possibly name, some level of credit card data, order history, etc.).
>> b) the credential stuffing attack itself is authorized access (because from the site's perspective, the user provided the correct username and password), not unauthorized access.
It's certainly authenticated access, but I think you'll struggle to convince a lawyer that it was authorised.
Look, I am not a laywer, and I am happy for someone to correct me here, but this is the wording of the law:
"A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data."
Is there anything in that sentence that means a successful credential stuffing attack would not fit the criteria?
"establish the likelihood and severity of the resulting risk to people’s rights and freedoms. If it’s likely that there will be a risk then you must notify the ICO;"
So if it's a small irrelevant website, there isn't likely to be a high or severe risk to that "breach", so they should be ok.
In terms of options, I think there are more, mostly around sites getting more sophisticated at defending against credential stuffing attacks - treat logins as more suspicious if they are from a new device, new ip, use a password that you know is in a breach list (have i been pwned), etc. and put in place a 2nd factor like email confirmation of the login even if they haven't turned on 2FA. Or at least restrict access to sensitive parts of your site if the login was suspicious until you can verify it was an authentic login.
But even so I struggle to think of a definition where accessing someone else’s account without their permission or authority wouldn’t be classed as unauthorised.
It will ultimately come down to a test case, but as I said before, you will be hard pressed to find a lawyer who would tell a company that they definitely won’t be liable.
"A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data."
The key part being "unauthorised disclosure of, or access to, personal data."
So does credential stuffing qualify - In my opinion yes, as it is unauthorised access to personal data.
They then go on to say "When a personal data breach has occurred, you need to establish the likelihood and severity of the resulting risk to people’s rights and freedoms. If it’s likely that there will be a risk then you must notify the ICO;"
And again, the ability to place orders and deliver them to a new address charging the existing credit card I think qualifies as a severe and likely risk.
https://ico.org.uk/for-organisations/guide-to-data-protectio...
Edited to add: In the absence of any legal precedent I’d challenge you to find any lawyer who’d confidently say that credential stuffing definitely doesn’t meet the criteria.
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE"Would a 'reasonable' person be surprised if you told them about how you were using the data?"
We need a solution that is actually usable by the masses that maintains a reasonable level of security.
Setup an email account and lock it down - strong unique password, enforced 2 factor, etc.
Then on every site just email a magic login link.
The user only has to remember 1 password, they don't have to figure out how to use (and trust) a password manager, they don't have to worry about a breach on one site leading to all their accounts being compromised, and they don't have to worry about whether some site has correctly implemented 2 factor, or has side channel attack vectors to gain control of their account.
I actually attempt to do this where I can (set a randomly generated string as your password and use the reset password route to get a magic login link). The main problem I run into is where I want to be logged in to the site and their mobile app and they log out all devices when the password is reset.
The biggest problem (and it is a big problem) is that if they lose control of their email account or their email provider is breached, then they lose access to everything. But right now that's already true (due to the reset password route on many sites).
They don't support the gmail alias issue though (https://haveibeenpwned.uservoice.com/forums/275398-general/s...)
“Flat White opened its doors in 2005 because it was nigh impossible to get a flat white; the strong, delicious creamy coffee of our namesake. London lacked a strong independent café/coffee culture so we set out to be beacon & inspiration for other people who loved coffee, independent spirit and good old-fashioned hospitality. Flash forward and over ten years on London is thriving with many varied and different coffee offerings- a vibrant and exciting scene of excellence and commitment to excellence.”
And to add some more context. A New Zealander I know wrote a London coffee map app around 2010 to teach himself iOS app development. He curated the list of coffee shops he added to the map (they had to serve a proper flat white) and at time of release he’d added over 150 coffee shops.
In 2007 and then again in 2009 the world barista champions hailed from London.
All this should give you an idea of how quickly the London artisan coffee scene exploded in the late “noughties”.
So if you’re claiming to be a coffee nerd who couldn’t find a flat white in London in 2014, I’m going to say you didn’t look very hard.
Note: Not one chain ever featured on that app. I only mentioned Starbucks above to illustrate how ubiquitous the Flat White was at that time (2010) that Starbucks felt they had to add it to their menu to stay relevant/competitive.
I think they did their risk assessment.
On first visiting the site you are presented with the option to "Consent" or view more Options (where you can Opt Out of all - except you can't really because some require Opting Out on the specific Advertisers site). But if you do choose to Opt Out all, they will then show you the initial Option box on every visit to the site, where you have to go through the More Options route every time. And if you ever accidentally click I Consent, then they opt you back in to everything again and then never show you that option box ever again.
Note: I just picked on Mashable, but there are many, many sites following this same dark pattern.