Would you like to see your name, address, birth date and email on a public bill board? On the main street? What if the bill board is behind a big sign “don’t read this”?
If that worries you, why do you give your data to web sites of big companies? Many of them, even the big ones, show very little interest in keeping your contact detains secure. Many sites are still vulnerable to cross site scripting or SQL injections.
If anyone puts your life or privacy at risk, they are liable – except when web sites are involved. Even if they violate common sense and even the most basic rules of security, the worst that can happen is that they have to apologize. Pollute some fish? To Jail! Lose 300 million customer records? Oops, sorry about that.
Paul Venezia asked an interesting question: Should companies be accountable for the security risks they take? He says:
In the United States, at least, very specific laws govern patient information and how it is stored, accessed, and disseminated. HIPAA regulations were put into place to ensure that sensitive patient information isn’t distributed to just anyone — that is, only to the people who need that information. They also prevent health care providers from discussing any type of patient information with anyone else. They were explicitly designed to protect patients, and each patient must sign a waiver to authorize the release of that information to another person or party. Yet we have no regulations on the storage, access, and dissemination of sensitive user information on public websites — none. Thus, there’s almost no business case for providing any form of high-level security for customer accounts.
Interesting thought. I have two comments:
1. Not individual developers should be liable but the company which runs the site. It should be in their best interest to keep their data secure.
2. Today, it’s too complex to create secure web sites. Yesterday, I used renderSnake to create some HTML. If you supply a string value for output, the default is not to escape HTML special characters like <, > and &.
Creating a login component for a web site is pretty complex business and there is a no reasonable tutorial or template component which you could use that gets most security issues right like:
- Transmitting the password via HTTPS (encrypted) instead of using plain text (which anyone in the same LAN can read)
- Encrypting the password before it’s stored in the database
- Storing the password with a salt to make it harder to attack it with rainbow tables
- Escaping special characters in user names and password to prevent cross site scripting or SQL injection.
- Avoiding security questions like “Name of your cat?” More than 50 people know the name of my cat! The name might even be on the web somewhere (possibly next to a photo on Flickr) How secure is that?
These are the basic rules to make your web site safe against identity theft. It would be simple to create a law saying “if you violate the rules named once per year by a committee of experts, you’re liable for a hefty fine”. If that would happen, I’d support it.
Like this:
Like Loading...
7 Ways To Ruin A Technological Revolution
24. July, 2011“7 Ways To Ruin A Technological Revolution” is a Google Tech Talk by James Boyle in which he shows honest and sincere ways to stifle technological progress. And unlike him, I’m not ironic. A lot of stifling happens because we deem some things too dangerous. His 7 ways are:
Some thoughts on #4 (after 0:18:00): Our society is built on sharing. Or did you pay back the $200’000 which your parents invested in raising you? Countless hours wasted playing with you as toddler which they could have spent at work instead. All the money spent on clothes that you didn’t want to wear anyway. The water polluted washing them which could have been used to grow food for more money.
“It’s commercial use if you get for free what you otherwise would have to pay for.” (0:20:16) If companies and IP policy makers had their say, you’d have to pay your girlfriend for a date just like for a prostitute. What else is date than a perfect business opportunity wasted because of “anti-capitalistic” hormones – or so some people seem to think. While we’re at it, let’s ask money for Christmas presents, too! Talk to a friend? It’s Cheap Friday, so it’s only $25 instead of $50/hr.
Such a view of the world ignores the benefits of these actions. When an author writes a new book, how much money goes back to the people who invented the written word? The printing press or the Internet? Who taught the author to write? Who sparked new ideas in his mind? So we have to be unjust somewhere but are we unjust in the right place?
Or maybe I’m wrong. At the end of his speech around 0:35:50 he says something interesting: “It is scary to me that the technologies that would enable the Google equivalent in the next technological cycle are being developed under the conditions that I have described. Because you would have to be an insane optimist to think that none of that is going to get screwed up by the processes that I described and I’m far from being an optimist.”
It’s interesting because we don’t know what will work and what will fail. Maybe this kind of resistance is necessary to separate good ideas from bad ones: Only a really good idea can overcome these obstacles. It has to be overwhelming enough to change the world. Since we can’t tell which idea should win, this might be the only way to weed the bad ones out.
Scary thought: Maybe superior technology like the Amiga didn’t change the world because it didn’t have what it takes – whatever that might be. All I can say from this point in time: We don’t have an Amiga on every desk, we have a PC on every desk. Steve Jobs knows his stuff but there is no Apple computer on every desk either. But there is an iPhone on (almost) every desk. Not a Windows phone. So the formula is Windows + PC == success, not Microsoft == success.
That said, not all is lost. I haven’t put my hands on an Amiga computer for more than a decade but I use the skills every day that I acquired with its beautiful OS. Amiga is dead, today’s hackers have Linux.
I think the good news is that the bad guys eventually fail because there is no limit to their greed. Eventually, they manage to upset even their most die hard supporters. Sony harassed Georg Hotz. Nothing happened. Sony lost 300 million customer records. The US government shows up to ask some serious questions. And the Zurich insurance refuses to cover the damages. Hm…
Interesting links:
Share this:
Like this: