Ok, that makes much more sense! I’ve done a tiny bit of genealogy, so I knew about the exponential numbers, but I misunderstood the sharing. Yes, I know the feature was described as “with relatives” but I was thinking of “with person”. Yes, choosing to share with all relatives in one click would produce huge numbers.
As for where to place the blame, it’s tough. The vast majority of people have no concept of how this stuff works. In effect, everything from mere typing into a document to logging in to and using network resources is treated quite literally as magic, even if nobody would actually use that word.
That puts a high burden on services to protect people from this magical thinking. Maybe it’s an unreasonably high burden, but they have to at least make the attempt.
2FA (the real thing, not the SMS mess) is easy to set up on the server side. It’s easy enough to set up on the client side that if that’s too much for some fraction of your customer base, then you should probably treat that as a useful “filter” on your potential customers.
There are any number of “breached password” lists published by reputable companies and organizations. At least one of those companies (have I been pwned) makes their list available in machine readable formats. At this point, no reputable company who makes any claims to protection of privacy and security should be allowing passwords that show up on those lists. Account setup procedures have enough to do already that a client-side password check would be barely noticeable.
We know enough about human nature and human cognition to know that humans are horrifically bad at creating passwords on the fly. Some services, maybe most services, should prohibit users from ever setting their own passwords, using client-side scripting to generate random strings of characters. Those with password managers can simply log the assigned password. Those without can either write it in their address book or let their browser manage it. This has the added benefit of not needing to check a password against a published list of breached passwords.
My data will always be at risk of some kind of weak link that I have no control over. That makes it the responsibility of each online service to ensure that the weak links are as strong as possible. Rate limiting, enforcement of known good login policies and procedures, anomaly detection and blocking, etc should be standard practice.
You are right, and the company is definitely to blame. But, compared to how usually other breach happens, I don’t think this company was that much negligient - I mean, their only mistake was as far as I know that they did not force the users to use MFA. A mistake, sure, but not as grave as we usually see in data breaches.
My point was mostly that IMO we should in this case focus more on the users, because they are also at fault, but more importantly I think it’s a pretty impactful story - “few thousand people reuse passwords, so they caused millions of users data to be leaked” is a headline that teaches a lesson in security awarness, and I think would be better to focus on that, instead of on “A company didn’t force users to use MFA”, which is only framed as “company has been breached and blames users”. That will not teach anyone anything, unfortunately.
I’m not saying that the company shouldn’t also be blamed, because they did purposefully choose to prefer user experience and conversion rate (because bad UX hurts sales, as you’ve mentioned) instead of better security practices, I’m just trying to figure out how to get at least something good out of this incident - and “company blames users for them getting breached” isn’t going to teach anyone anything.
However, something good did come up out of it, at least for me - I’ve realized that it never occured to us to put “MFA is not enforced” into pentest findings, and this would make for a great case why to start doing it, so I’ve added it into our templates.
I agree with everything you’ve said. One thing that would go a long way to securing accounts would be legislation requiring all government services, banks, and credit unions to implement authenticator-based 2FA. At a minimum.
Those institutions are already very heavily regulated (at least here in Canada), so one more regulation would be meaningless.
With that in place, it would be trivial for everyone else to follow suit, since they’d know that approximately everyone has a second factor and knows how to use it.
Good for you in adding to your testing template. Security is a journey, not a destination, so keeping things up to date is important.
Ok, that makes much more sense! I’ve done a tiny bit of genealogy, so I knew about the exponential numbers, but I misunderstood the sharing. Yes, I know the feature was described as “with relatives” but I was thinking of “with person”. Yes, choosing to share with all relatives in one click would produce huge numbers.
As for where to place the blame, it’s tough. The vast majority of people have no concept of how this stuff works. In effect, everything from mere typing into a document to logging in to and using network resources is treated quite literally as magic, even if nobody would actually use that word.
That puts a high burden on services to protect people from this magical thinking. Maybe it’s an unreasonably high burden, but they have to at least make the attempt.
2FA (the real thing, not the SMS mess) is easy to set up on the server side. It’s easy enough to set up on the client side that if that’s too much for some fraction of your customer base, then you should probably treat that as a useful “filter” on your potential customers.
There are any number of “breached password” lists published by reputable companies and organizations. At least one of those companies (have I been pwned) makes their list available in machine readable formats. At this point, no reputable company who makes any claims to protection of privacy and security should be allowing passwords that show up on those lists. Account setup procedures have enough to do already that a client-side password check would be barely noticeable.
We know enough about human nature and human cognition to know that humans are horrifically bad at creating passwords on the fly. Some services, maybe most services, should prohibit users from ever setting their own passwords, using client-side scripting to generate random strings of characters. Those with password managers can simply log the assigned password. Those without can either write it in their address book or let their browser manage it. This has the added benefit of not needing to check a password against a published list of breached passwords.
My data will always be at risk of some kind of weak link that I have no control over. That makes it the responsibility of each online service to ensure that the weak links are as strong as possible. Rate limiting, enforcement of known good login policies and procedures, anomaly detection and blocking, etc should be standard practice.
You are right, and the company is definitely to blame. But, compared to how usually other breach happens, I don’t think this company was that much negligient - I mean, their only mistake was as far as I know that they did not force the users to use MFA. A mistake, sure, but not as grave as we usually see in data breaches.
My point was mostly that IMO we should in this case focus more on the users, because they are also at fault, but more importantly I think it’s a pretty impactful story - “few thousand people reuse passwords, so they caused millions of users data to be leaked” is a headline that teaches a lesson in security awarness, and I think would be better to focus on that, instead of on “A company didn’t force users to use MFA”, which is only framed as “company has been breached and blames users”. That will not teach anyone anything, unfortunately.
I’m not saying that the company shouldn’t also be blamed, because they did purposefully choose to prefer user experience and conversion rate (because bad UX hurts sales, as you’ve mentioned) instead of better security practices, I’m just trying to figure out how to get at least something good out of this incident - and “company blames users for them getting breached” isn’t going to teach anyone anything.
However, something good did come up out of it, at least for me - I’ve realized that it never occured to us to put “MFA is not enforced” into pentest findings, and this would make for a great case why to start doing it, so I’ve added it into our templates.
I agree with everything you’ve said. One thing that would go a long way to securing accounts would be legislation requiring all government services, banks, and credit unions to implement authenticator-based 2FA. At a minimum.
Those institutions are already very heavily regulated (at least here in Canada), so one more regulation would be meaningless.
With that in place, it would be trivial for everyone else to follow suit, since they’d know that approximately everyone has a second factor and knows how to use it.
Good for you in adding to your testing template. Security is a journey, not a destination, so keeping things up to date is important.