6 ms·
Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual
by joshenberg 5y ago
Quote from the St Louis Post Dispatch article is even more groan-worthy:
"In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.”
I guess webpages are kinda like encryption for idiots.
- dylan604 5y agoIf it is served via https, it is encrypted. Edit: sorry, forgot the /s
- anm89 5y agoif it's in plain text in the html served, it isn't
- dylan604 5y agoBut if you're an idiot to believe viewing source is hacking, then you're clearly the type that viewing the source is viewing encrypted data. The actual quote states that the data was first "unencrypted" before viewing the source. This is in fact correct if not poorly phrased, but who'd expect proper terms used when we're talking about "these" people?
- anm89 5y agoI get what the article says and what the county claims. That doesn't make what the parent said right.
- throwawaycuriou 5y agoexpand the lawsuit to Apple, Google, other heathen browser makers
- quantified 5y agoJust wait. I wouldn’t be surprised.
- codegeek 5y agoI knew u forgot the /s. If the Governor understood https and encryption, he wouldn't be penalizing the reporter for "View Source". Clearly he got caught at being incompetent and he is doubling down on "how dare you"
- MisterBastahrd 5y agoOh shit, I'm reading your encrypted message right now!
- badRNG 5y agoYou should consider responsibly disclosing this vulnerability rather than posting it here.
- buitreVirtual 5y agoDon't dare disclosing it in Missouri!
- willcipriano 5y agoIt's ok, the disclosure is also encrypted.
- navbaker 5y agoNo it's not, you forgot to wrap it in an "<encrypted>" tag.
- lapetitejort 5y agoDon't forget the </encrypted> tag or else the rest of the internet's traffic will be encrypted forever.
- NoGravitas 5y agoWhat a nefarious ransomware attack!
- iamcreasy 5y agoI didn't get the joke. Can anybody explain it?
- jayd16 5y agoHttps traffic is indeed encrypted, but its encrypted for you the user. Its like saying you stole documents from a sealed container when that container had your name on it, it was addressed to you, and you had the key.
- jmull 5y agoNot once it's loaded by the browser it's not.
- badRNG 5y agojesus christ...
- mikro2nd 5y agoyes...?
- dylan604 5y agoGet the Escalade
- birdyrooster 5y agoWith mustard and mayonnaise on the blades
- jimt1234 5y ago"unencrypted the source code" means they ran an unminify tool. Very advanced; criminal masterminds. /s
- meijer 5y agoProbably just "View Source".
- tomxor 5y agoProbably without comments stripped.
- deleted 5y ago[deleted]
- anm89 5y agoI sincerely doubt it was minified
- quantified 5y agoWhat meijer said ^^. It’s html, just view source. Now they’ll sue browser makers for distibuting hacking tools.
- klyrs 5y agoI can't wait to see the legislation that treats plaintext as encrypted, and goes on to criminalize all written and electronic communication.
- dylan604 5y agoWe must end all encryption --FBI
- idworks1 5y ago> echo json_encode($search_results); This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company was actually charging the clients. All the data was being returned in a json but the very little was being displayed. Looking at the story, this is more of a posture thing. I'm sure the Governor is surrounded with people who can tell him that no hacking took place, but why miss an opportunity to show you take the privacy of Missourians to heart.
- 0x262d 5y agowow, what fraction of websites leak data I want to look at? should I be poking at every non-tech-giant site I go to?
- photochemsyn 5y agoThe analogy is going up to a house and checking all the doors and windows to see if they are locked. That's rather like port scanning, a form of 'poking'. If you go to a state government web site and do that, even if you don't exfiltrate data or load it up with ransomware, it's definitely very shady behavior, although it seems there are no laws against it in the USA (some ISPs will ban users caught doing this however). Obviously if you broke into someone's house and then asked them to pay you for your 'vuln discovery', err... However, I think looking at HTML code on a public facing web page is not that. If you hang naked pictures of yourself on your front door, you don't get to complain when people take pictures of them. 1. https://www.calyptix.com/top-threats/port-scanning-legal-answers-companies/ https://www.calyptix.com/top-threats/port-scanning-legal-ans...
- ajmurmann 5y agoThe data was send to my browser. The more fitting analogy to me is that I get a letter and a huge pile of documents in a giant binder. Some of the documents are referenced in the letter. Now the sender gets upset because I started looking at the documents in the binder that weren't referenced in their cover letter.
- Buttons840 5y agoWill this definition of encryption hold for HIPAA cases in Missouri?
- MrPatan 5y agoYou left out the best bit: "through a multi-step process"
- airstrike 5y agoNice catch... Unbelievable. What isn't a multi-step process, really? The first thing I do in the morning is to make coffee and though I've distilled that process down to its bare minimum so I can do it while still half asleep, it is still very much a multi-step process...
- lethoso 5y agoTaking a shit is a multi step process! The absurdity of the phrase is boggling my mind.
- DebtDeflation 5y agoRight click. View Page Source. That's 2 steps. Hence, multi-step.
- dillondoyle 5y agoOption+Command+U :)
- shepherdjerred 5y agoThree steps! What hacker could envision such an elaborate plan?
- tentacleuno 5y agoDon't worry. A listener for contextmenu with a good ol' preventDefault() will stop those pesky hackers!
- eightails 5y agoCould do it in a single step with F12. I suppose then you still have to scroll/search to find the relevant nodes... "multi-step" indeed
- teawrecks 5y ago"Unencrypted" in this context means "did something we don't understand".
- websap 5y agoWe live in a world where everyone thinks they understand computers and have an expectation of security and privacy, but they don't realize how hard it is to build these systems correctly. The best security appears to be invisible to the consumer, but requires a lot of thought by the implementer. This is the same reason why I think most of the general public don't understand how much data social media apps can collect on them. I know a lot of average technology users, who allow every single permission whenever an App asks them, because they're like obviously its not going to do any harm. Without realizing how every action they take is recorded in a database somewhere, which will get compromised sometime in the future. I'm not a mobile developer, but it would be interesting if iOS provided a service that allowed data to never leave the phone and provided an API for Apps to get particular types of data and showed warning levels in the App, each time more sensitive data is accessed. The App store needs to be a place where if I download an App from, I need to have the peace of mind that it won't cause more harm than good.
- ajmurmann 5y ago> I'm not a mobile developer, but it would be interesting if iOS provided a service that allowed data to never leave the phone I'm not sure I follow. Do you mean the app wouldn't be allowed to send any data over the network? As soon as the app can send any data, it's trivial to hide in there whatever the app wants to send home.
- websap 5y agoMy idea is that Apple encourages Apps and features / adds badges for those apps that only store data locally. The local storage should be able to identify different types of data. They provide an API that allows data to be queried so that whenever an App queries some critically of confidential data it throws a big warning.
- ohazi 5y agoThe developer would just query the sensitive field either immediately or at a seemingly reasonable moment (along with dozens of other sensitive and non-sensitive fields), put everything into a blob, and then send it to the server as an opaque web request to some innocuous looking endpoint like POST /login. You either have to completely trust the developer today and forever after, or you need to make some fundamental advancements in homomorphic cryptography. "Secure data store that can be queried with a permissions box" doesn't work.
- ncr100 5y ago* https://oa.mo.gov/commissioners-office/news/state-missouri-addresses-data-vulnerability https://oa.mo.gov/commissioners-office/news/state-missouri-a... The State labeling a reporter as "a hacker". * https://dese.mo.gov/media/pdf/educator-data-incident-commissioner-letter https://dese.mo.gov/media/pdf/educator-data-incident-commiss... * https://twitter.com/mocommissioner https://twitter.com/mocommissioner State Education Commissioner refers to reporter only as a "individual". The Commissioner signs the letterhead "PhD". Sarcastically, I presume the PhD corresponds to the increase in level of correctness, from "hacker" to "individual".
- dillondoyle 5y agoHow relevant for education and today. The education commission should have "send a flu shot!" lmfao
- rbanffy 5y ago> I guess webpages are kinda like encryption for idiots. I prefer to call them muggles.
- mhandley 5y agoWhere "unencypted" means "turned the web page over, and read what was printed on the back of it". It seems stupid to us, but non-techies just won't understand unless we come up with reasonable analogies.
- ilaksh 5y agoI feel like not understanding basic things like that should get you fired. The Education Commissioner and Governor of the State of Missouri have demonstrated a lack of understanding of basic technologies. At this point, that means they lack core competencies to do their job, and should be fired.
- quantified 5y agoI would totally not expect an old white guy politician to be up on web protocols. No worries about that. He either has staffers who told him the real issues and he discounted them to score points, or hired incompetent staffers who gave him B.S., or he hasn’t found anyone to give him the real info. Those are the disqualifiers. Memories of Mitt Romney appearing to actually dig into tunneling and adhesives during an investigation of Big Dig flaws in Massachusetts. He might have been posturing but at least it was the right posture.
- chefandy 5y agoNothing, and I mean nothing could give me a grimmer impression of cops' abilities to deal with tech. I guess all of the technically capable cops are busy installing government surveillance systems. About 12 years ago, someone smashed the window of my car and grabbed my messenger bag, including my cheap prepaid smart phone and shitty laptop— I was a line cook at the time, and those were my most valuable possessions except my knives. Filed a report and moved on. Hours later, I later saw a picture of a person I didn't know standing next to a car with a visible license plate automatically auto-uploaded to my Facebook account from my stolen phone. I called up the detective assigned to the case, but as soon as I said "uploaded" he said I needed to talk to the "computer guy," who called me the next day. After— no shit— 15 minutes of back-and-forth, this expert absolutely could not understand that I wasn't trying to report the new crime of someone accessing my Facebook account without authorization. He had no clue how it possibly could have been related to a telephone. In 2009. Before I cooked, I'd worked in support from entry-level call centers to code level third-tier support. I am completely confident in my ability to explain WAY more complicated technical ideas to folks who've never used computers before... but I just had to give up. I didn't know what else to do. He was possibly the least technically capable person I've ever encountered and I used to help 90 year olds remove spyware from windows 98 machines. I said never mind and hung up the phone. Depressing.