Newsletters

Select newsletters below and click the button to sign up!

Boston News NY News
DC News Internet Daily
SiliconValley News
InternetNews Business Report




Become a Marketplace Partner



Partner With Us















Internetnews Bloggers

Recent Entries

Archives

July 2009
Sun Mon Tue Wed Thu Fri Sat
      1 2 3 4
5 6 7 8 9 10 11
12 13 14 15 16 17 18
19 20 21 22 23 24 25
26 27 28 29 30 31  

Monthly Archives

Search The Blog

Netstat -vat by Sean Michael Kerner (bio)

A command line view of IT



Twitter hack was wrong - where have ethics gone?

twitter.jpg
From the 'shaking my head in disbelief' files:

Reports are out that a hacker broke into the personal files of Twitter employees by way of password guessing then sent those files to popular tech site TechCrunch where some of them have been published.

What's wrong with this picture?

If someone broke into your house, stole your bank statements, sent them to a media outlet and then were published, wouldn't the police be involved?

Was the information illegally obtained? If you access an email account that isn't yours (by brute force or otherwise) isn't that a crime?

Officially speaking Twitter has stated that:
"We are in touch with our legal counsel about what this theft means for Twitter, the hacker, and anyone who accepts and subsequently shares or publishes these stolen documents. We're not sure yet exactly what the implications are for folks who choose to get involved at this point but when we learn more and are able to share more, we will."

Now if the hacker had simply posted the information on some random web address - then directed media (TechCrunch or otherwise) to the site - that might be a different story. Then there is an arm's length (possibly) distance, the info is already public and the media still might have an ethical question - but at least they are not directly complicit in the distribution of data that could well have been obtained through illicit means.

The password guessing hack isn't a new approach though - remember Sarah Palin got nicked by the same approach - overall this incident underscores the need for stronger passwords.

It also underscores the need for some other mechanism beyond just passwords to secure sensitive data. There should be multiple layers of passwords and/or some form of two factor authentication to access sensitive data.

The fact that the password was easily guessable does not make the hack right - it just makes it easy. If you leave the keys in your car and the door open and someone steals your car - it's still a crime - though it is one that is preventable.

| Comments (1) | TrackBacks (0) | Share

0 TrackBacks

Listed below are links to blogs that reference this entry: Twitter hack was wrong - where have ethics gone?.

TrackBack URL for this entry: https://swarm.jupitermedia.com/mt-tb.cgi/8481

1 Comments

Sam Masiello said:


You are correct in stating that "The fact that the password was easily guessable does not make the hack right - it just makes it easy", however the problem here is that the problem goes well beyond passwords and password strength. Social networks have also made easy the ability to crack commonly used "Challenge Questions" as well because frequently your first pet's name, your school, and other sorts of information that go into comprising these questions is readily available online. Paris Hilton is another classic example of these types of challenge questions going terribly wrong as a security mechanism. You could give wrong answers to these questions, but then you are tasked with having to remember the wrong answers that you gave :)

Passwords generally exist to protect users from other users. Most hackers are using application level attacks now to compromise systems. If they have a password, it just provides a lower barrier of entry with which to compromise a system, but in many cases if you compromise an application level vulnerability you will end up with a more trusted level of access than if you compromise a more restricted user account.

Leave a comment