6 ms·

German officials confirm 18 million emails and passwords stolen

42 points by icholboy 12y ago

icholboy 12y ago
Sorry, I meant to submit the new data theft in Germany which happens only 3 months after the one posted: http://www.dw.de/german-officials-confirm-18-million-emails-and-passwords-stolen/a-17542815 http://www.dw.de/german-officials-confirm-18-million-emails-...
3rd3 12y ago
I wonder why internet companies don’t have contingency plans in place for data theft. I would be glad to be able to check whether my account is affected and to receive an email with instructions immediately. Instead it’s always a big surprise and it takes weeks until details are published…
- jimktrains2 12y ago
  I wonder why internet companies don't just do the right thing and use good hashes (or better methods like SRP, but that requires client updates) so that none of this would even mater
  - mildtrepidation 12y ago
    Because they don't start out with well-designed systems (that costs money), and they don't want to upgrade their systems to be good (that costs money). It's very simple, but it's only obvious after you've seen it happen too many times.
sentenza 12y ago
You non-Germans don't know how mind-boggeling insane this whole story is. There is a governmental agency, the BSI, whose job is to be on top of everything regarding security in information systems. They tell us that millions of email accounts are compromised. What they don't tell us is _which_ accounts are compromised or even what service provider these accounts are with. Maybe the key information here is that the info was leaked in a database hack at a big consumer software company. Who knows? Nobody! That's who. Because they refuse to give any details that would actually be useful to end-users. Now _everybody_ who has an email account is scared that their account is compromised. Do you know what the punchline here is? They said they would give more details, but not before Monday. It might not be obvious to non-Germans, but this little detail reeks of a kind of bureaucratic weirdness that is as German as Beer: I bet they will only release more info on Monday because the person in charge doesen't come into the office before Monday. Sorry if this was a bit ranty, but the whole thing is just so stupid.
- ciex 12y ago
  The article says the info was released on Thursday, so there's still Friday in between. Maybe someone at that big consumer software company wanted some time to prepare a defense? Maybe law enforcement wants to procure movement in some hacker groups they are tracking, by keeping them from knowing whether they've been busted? Maybe the BSI really doesn't know where the addresses are coming from? There are so many options here.
- sibbl 12y ago
  What are you complaining about? There was a leak some months ago and the BSI kept the information about the leak secret until they had set up a system to inform people. Lots of people complained that they didn't publish the information earlier. Now they are doing, what I think is the correct way. Now they have time to discuss how to tell the people whose data has leaked which they surely will do.
  - kryptiskt 12y ago
    Too bad cybercriminals aren't awaiting the orderly notification of people before they use the information to do harm. The leak certainly isn't secret to the perpetrators.
- jboynyc 12y ago
  I concur. Another result of informing the public in this manner is that reporting on the leak is murky and alarmist. Yesterday I watched the Tagesschau, a highly-regarded public TV news program, and their report on this story was so short on information that all it could do -- whether consciously or not -- was to vaguely convey how dangerous cyberspace is. They even had the visuals of numbers flying through space for lack of actual informative content. In a country that's already often backwards when it comes to digital communication technologies, this kind of reporting is completely unhelpful.
  - eik3_de 12y ago
    wait, no shot of a blinking switch port led?
ChrisArchitect 12y ago
is there an alternative source for this story like from Spiegel or something other than dw.de?
- aw3c2 12y ago
  For what it's worth, DW is Germany's "International public broadcaster" so it is a reputable news source. If you want it on SPON ("blood, tits and murica"), here you go: http://www.spiegel.de/netzwelt/netzpolitik/e-mail-passwoerter-gestohlen-18-millionen-datensaetze-a-962419.html http://www.spiegel.de/netzwelt/netzpolitik/e-mail-passwoerte...
- OGC 12y ago
  Here is heise's take on it: http://www.heise.de/newsticker/meldung/Erneuter-Datenklau-BSI-will-Nutzer-mit-Hochdruck-informieren-2163706.html http://www.heise.de/newsticker/meldung/Erneuter-Datenklau-BS...

42 points by icholboy 12y ago

Sorry, I meant to submit the new data theft in Germany which happens only 3 months after the one posted: http://www.dw.de/german-officials-confirm-18-million-emails-and-passwords-stolen/a-17542815 http://www.dw.de/german-officials-confirm-18-million-emails-...

3rd3 12y ago

I wonder why internet companies don’t have contingency plans in place for data theft. I would be glad to be able to check whether my account is affected and to receive an email with instructions immediately. Instead it’s always a big surprise and it takes weeks until details are published…

jimktrains2 12y ago
I wonder why internet companies don't just do the right thing and use good hashes (or better methods like SRP, but that requires client updates) so that none of this would even mater
- mildtrepidation 12y ago
  Because they don't start out with well-designed systems (that costs money), and they don't want to upgrade their systems to be good (that costs money). It's very simple, but it's only obvious after you've seen it happen too many times.

sentenza 12y ago

You non-Germans don't know how mind-boggeling insane this whole story is. There is a governmental agency, the BSI, whose job is to be on top of everything regarding security in information systems. They tell us that millions of email accounts are compromised. What they don't tell us is _which_ accounts are compromised or even what service provider these accounts are with. Maybe the key information here is that the info was leaked in a database hack at a big consumer software company. Who knows? Nobody! That's who. Because they refuse to give any details that would actually be useful to end-users. Now _everybody_ who has an email account is scared that their account is compromised. Do you know what the punchline here is? They said they would give more details, but not before Monday. It might not be obvious to non-Germans, but this little detail reeks of a kind of bureaucratic weirdness that is as German as Beer: I bet they will only release more info on Monday because the person in charge doesen't come into the office before Monday. Sorry if this was a bit ranty, but the whole thing is just so stupid.

ciex 12y ago
The article says the info was released on Thursday, so there's still Friday in between. Maybe someone at that big consumer software company wanted some time to prepare a defense? Maybe law enforcement wants to procure movement in some hacker groups they are tracking, by keeping them from knowing whether they've been busted? Maybe the BSI really doesn't know where the addresses are coming from? There are so many options here.
sibbl 12y ago
What are you complaining about? There was a leak some months ago and the BSI kept the information about the leak secret until they had set up a system to inform people. Lots of people complained that they didn't publish the information earlier. Now they are doing, what I think is the correct way. Now they have time to discuss how to tell the people whose data has leaked which they surely will do.
- kryptiskt 12y ago
  Too bad cybercriminals aren't awaiting the orderly notification of people before they use the information to do harm. The leak certainly isn't secret to the perpetrators.
jboynyc 12y ago
I concur. Another result of informing the public in this manner is that reporting on the leak is murky and alarmist. Yesterday I watched the Tagesschau, a highly-regarded public TV news program, and their report on this story was so short on information that all it could do -- whether consciously or not -- was to vaguely convey how dangerous cyberspace is. They even had the visuals of numbers flying through space for lack of actual informative content. In a country that's already often backwards when it comes to digital communication technologies, this kind of reporting is completely unhelpful.
- eik3_de 12y ago
  wait, no shot of a blinking switch port led?

ChrisArchitect 12y ago

is there an alternative source for this story like from Spiegel or something other than dw.de?

aw3c2 12y ago
For what it's worth, DW is Germany's "International public broadcaster" so it is a reputable news source. If you want it on SPON ("blood, tits and murica"), here you go: http://www.spiegel.de/netzwelt/netzpolitik/e-mail-passwoerter-gestohlen-18-millionen-datensaetze-a-962419.html http://www.spiegel.de/netzwelt/netzpolitik/e-mail-passwoerte...
OGC 12y ago
Here is heise's take on it: http://www.heise.de/newsticker/meldung/Erneuter-Datenklau-BSI-will-Nutzer-mit-Hochdruck-informieren-2163706.html http://www.heise.de/newsticker/meldung/Erneuter-Datenklau-BS...