Who Hacked Ashley Madison?
krebsonsecurity.com
krebsonsecurity.com
This reads like a scene straight out of Hackers or some other campy tech movie. Life imitates art.
they showed up to my place once. the guy said to contact him after i graduated if i was looking for work, lol.
for what it's worth, they had binders and binders full of efnet logs.
The FBI visited once, my dad freaked out and told me before he answered the door.
Turns out someone was exposing themselves to kids on Halloween.
Strange how different - and how similar! - the scene is today. Good memories, except that law enforcement back then was a lot less scary...
I'm guessing the navy wasn't so kind :/
I also worked for the Systems administrator who was in charge of the machine in the Prince Philip hack.
I'd be interested in reading whatever academic writing that was, if you find it.
I do raise the trickster there. You can find a pdf of it out there too if you google for it.
>...this morning, as she began her day, she discovered that a bizarre specter had hijacked her computer. The screen glowed with a blood-red skeleton baring its fangs, and the words “Hacked By #GOP.”
[0] http://www.vanityfair.com/hollywood/2015/02/sony-hacking-set...
Other than that, another idiot who is actively trying to get some attention, by doing illegal things online, nothing new, nothing special.
The one positive thing this hack has done is really give serious ammo to the battle for online privacy, because the demographic hit by this hack is the most politically & economically powerful demographic in the world....
How?
> because the demographic hit by this hack is the most politically & economically powerful demographic in the world....
They're saying that because those affected have the ability to actualize change, it's more likely that some action will be taken to further online privacy.
"But if they realize that your dick is American, they do try to forget that they saw your dick."
It's the ultimate hack, because it's in plain sight and somehow no-one cares.
But run your own private email server in your home to prevent warrantless abuse and everyone loses their damn minds.
Playing the shades of grey game is a great wait to force dissent in an area that should incite cooperation.
One is a lazy, immoral company started on a whim that took off and "surprise" they ran their business in a lazy immoral way.
The other is government sanctioned, taxpayer funded, broadly used abuse of police powers without oversight, based on a law that is 30 years old.
Offline backups are, however, pretty hard to steal (unless you're stealing the physical tapes).
So... immediately, maybe. Completely, no fucking way.
The cheating cheaters (who likely never got the opportunity to cheat) have been named and shamed, and because of those asserting that it's acceptable to do this if it strokes their personal moral vendetta, then this type of chilling privacy violation is on its way to being normalized.
Pretending otherwise is delusional, and having morals isn't a bad thing.
Is doxxing always unethical?
Who are you, or anyone else, to question or evaluate "commitment" in a relationship that you have no part of, and know nothing about? Or to force someone's personal private life out in the open where it will be used to judge them without context?
Nothing is as black and white as you are claiming it to be.
Your right to privacy isn't naturally guaranteed, and is only granted by some mutually agreed upon rules in the form of privacy laws.
But if I know some fact about you, what gives you any right to say I can't reveal that information? Wouldn't you be limiting my speech?
If you argue that lying in marriage is a complex issue, then privacy rights is also a complex issue that's not black and white.
A world with no secrets and a world where everyone has a right to secrecy are both potentially equally valid.
In the context of encryption, A right to encrypt says that no one can stop you from encrypting your work. A right to privacy says no one is allowed to try to break your encryption.
Encryption protects infromation as long as A) the computation power, time and desire available to break your encryption does not exceed the level you encrypted, B) the underlying math principles on which the encryption was based do not see a change in some manner reducing the effectiveness of the algorithm for this task, or C) The implementation of the encryption algorithm did not suffer some flaw reducing it's effectiveness to the level if can be beaten.
I know A and C have happened in the past. I'm unsure whether B has occurred. It's worth noting that in the case of B or C, the strength you choose now may not have any effect on the outcome.
You have to take some care. But an NSA magic code breaking machine is in the same category as flying saucers at Area 51. Exceedingly unlikely.
That's about as good a guarantee as nature can offer.
The irony thickens.
Let me rephrase you: "Who are you, or anyone else, to evaluate 'abuse' in a relationship..." -- the answer is "anyone who knows how to count". While there are exceptions to every rule, the majority of cases fall into rather ordinary examples. Not everyone is special.
Of course, indiscriminately doing this sort of thing like the AM hackers is terrible -- notwithstanding those in third-world countries facing draconian legal consequences -- but plenty of the people exposed certainly deserved it.
Odds are that people don't want their spouse cheating on them.
Someone stealing from someone else doesn't have an affect on me either, but I would operate under the default assumptions that 1) they want their things 2) they would want to be notified if someone wanted to steal their things 3) they would want to be notified if someone actually stole their things
And guess what? People acting in this way has the prosocial implication of teaching people that stealing is bad, and gives me the assurance that if someone is trying to steal from me that people will let me know!
S&M is in much more of a grey area. See https://ncsfreedom.org/key-programs/consent-counts/consent-c... for details.
The fact that some people approve of vigilante justice and disrupting the personal lives of people they don't like doesn't mean it's a good idea. There are many obvious historical examples of terrible harm that sort of thinking has caused. If you think adultery is a crime that requires help from people not involved in the marriage, I suggest you campaign to make it illegal in all states and ask for police resources to be dedicated to it. If you see someone stealing, you should call the police.
That's completely different than people outside the family wanting to know.
I'm guessing that you haven't talked about this with anyone who is into BDSM. Just because you witness something that you think is violent abuse doesn't mean that you're right.
Conversely I've seen perfectly pleasant looking couple who engage in constant verbal abuse disguised as pleasant commentary. Most people won't recognize it for what it is. Go read http://www.amazon.com/The-Gentle-Art-Verbal-Self-Defense/dp/... and you may do better than most people.
Be very, very careful about judging what happens in other people's relationships. It may be bad. Or you may not know. For real.
Being on AM wouldn't solely have been about breaking commitment. From what I recall, it became an inadvertent hub for gay dating due to its extraordinary gender/sex imbalance. AM's entire business practice was about hooking into people's desire to seek taboo and then be exorbitant with charging them fees, even for terminating an account. It was, in no minced words, a con.
Having morals means knowing when to stay out of things that are none of your concern.
That's one way to look at things. I happen to have a different philosophy about marriage, that it actually does affect other people, and since you're so understanding, I'm sure you'll grant that my philosophy is equally valid.
The argument was that the breach of contract is no one else's business except for the two parties to that contract. This was rebutted by someone claiming that they hold value in knowledge about another's breach of a contract.
What I don't understand is the reasoning that says a breach of contract is only meaningful to the parties of the contract. If someone is influenced by knowledge that someone breached another contract, then that knowledge is meaningful outside the confines of the contract.
Here's the text:
>Then that's a breach of contract between two private parties which is of absolutely no relevance to outside observers.
The argument claimed that the breach was "of absolutely no relevance". Yes, the word "meaningful" wasn't used, but I dare you to provide a definition of the word "meaningful".
>The argument isn't that it isn't meaningful, it's that it shouldn't be.
Can you point me to someone making that argument?
I can see where one might read it differently, though, but I confess I fail to see the point in discussing from that POV.
I only wanted to point out that this particular sub-thread was going off the rails (as many are, but I can't respond to all of them due to time constraints and HN's hard rate limit).
The information can't be destroyed now, so there is little point in discussions about what should or shouldn't have happened in this specific instance.
If someone breached a contract and this provides evidence to those ends, then it's simply a fact. I completely understand that facts can upset people.
If someone didn't breach a contract...well I'm not sure what the worry is in this specific instance.
In any case, it obviously sucks when information you gave in trust is leaked out and there is certainly a lesson to learn in data security here. There also seems to be a lesson to perhaps not trust companies who apparently fundamentally produce and specifically market a trust violation product. Of course, if you are in the market for such a product, formal calculation of your preference function may not be a priority.
>I'd say the part where vezzy-fnord talks about the couple's "prerogative" and "things that are none of your concern" set the context in terms of moral rights, not whether it can possible affect the other person.
This makes it sounds like vezzy-fnord is arguing for some kind of thought control regime; a regime where one may selectively engineer the exact perception to create in others. If someone can perceive something, they should be able to contemplate it.
Just as it is a couple's prerogative to seek court mediation for their breached contracts (this is the right the argument afforded the couple), it is another's prerogative to act on information that is known to them.
> They think honesty is more important.
Yeah, that's a false dichotomy. And are monogamous marriages dishonest? That's oddly judgmental for an appeal for open-mindedness. Or you meant something else by "honesty", like realistic?. I guess that's slightly less judgy.
A lot of these philosophical arguments get bogged down in boring bickering about word definitions. Marriage, traditionally, has implied "monogamous". At least "adultery" and "cheating" do.
There's a significant chunk that is ok with cheating. There's a far smaller chunk that's ok with the other person cheating.
I can assert that this data breach is immoral while also asserting that infidelity, especially organized infidelity, is not simply an intimate detail. I'm not sure why everyone feels compelled to square off into two camps on every issue.
Of course there are portions of the AM leak which are bad, like the gay men in Saudi Arabia, but pretending that this is the norm and not the exception is feeding a delusion. Just because a small portion of the website does not follow the same perogative does not mean that we should derail the discussion from the main issue.
An epidemic of cheating over the internet is a concern for people who intend to get married. Estabilshing strong social taboos here is not some awful thing.
"An epidemic of cheating over the internet". My God, do you think adultery was invented recently? This is a classic fallacy of blaming the mere institutions as opposed to the root cause.
Hook-up culture has always existed as well, but let's not pretend that Tinder hasn't changed the pace/availability of hooking up. In the same light, let's not pretend that the anonymity of the internet hasn't facilitated people comitting adultery.
In the same light, let's not pretend that the anonymity of the Internet hasn't facilitated people engaging in terrorist activity and drug trade. When do we build the firewall, captain?
We build the firewall around prosocial behavior. I think that if the names of all of the coke dealers selling their wares through TSR came out today I would not be upset either, because it's a scummy, exploitative industry. If you're breaking a social contract, my expectation of other people upholding their social contracts with you, in that area, are very slim.
Public exposure of individuals' private information is irresponsible, period.
Vigilantism is against the social contract, upholding it implies you gave up that power to the institutions that have the responsibility to judge and prosecute.
I don't disagree with it being run by sleazy people with sleazy business practices. From everything I've read, I'd concur with this statement.
An epidemic of cheating over the internet is no more a concern than the "epidemic" of cheating. The internet was just a means to an end... just like party lines, dating services, the bar, the office and everywhere else people of our species comingle without their partners. Cheating is no more an epidemic now than it ever was. People just changed media. Perhaps if it's truly the epidemic you suggest, then instead of that being a concern to people who intend to get married, we as a species need to re-evaluate if monogamy is actually human nature or if it's just wishful thinking impressed upon us by the dogma of our upbringing.
People do things for many reasons you are not privvy to all the time and while they may seek comfort in the arms of someone outside their relationship, doesn't automatically justify violence and rape. I find this argument to be as laughable as those making arguments that same sex marriage is comparable to marrying animals.
If understanding and accepting human nature for what it is makes your life not worth living, then only you can evaluate that.
I choose to believe that people are inherently good. I choose to believe that while their interests align with my own, they're likely to make good on that promise. But I equally believe that accepting someone else's promise without question or qualification is naive at best. I cannot expect them to honour that promise when their interests are no longer aligned with mine.
Does that make my life not worth living? Of course not. I love people, I enjoy being around them. People are amazing, wonderful and fascinating creatures.
...but to expect that one person uphold a promise they had no hope of truly understanding when they made it, for the entire duration of the remainder of their life... and then holding them accountable for failing to keep it. That's beyond ridiculous, I don't care what religion you are.
Nobody on AM was your concern. At all.
You brushed the consequences of this vigilante justice under the rug. Those Saudi Arabians will most likely suffer severe consequences, probably death, for being exposed.
The public is not a judge, jury or executioner, no matter how good it makes you feel to play morality police.
None of this excuses an irresponsible exposure of private information.
That's fundamental to your moral framework. It may even be fundamental to the moral norms in US or Western culture. But it's not fundamental to everybody's. It's by no means objective. That's why we have objective laws to go by.
Talking about morals means realizing everyone has different morals. Of what use is it to argue whether cheating or hacking or meddling in the business of others or vigilante justice is or isn't moral in general?
Which as far as I know were violated.
YES
In the year 3000:
"Truth about the ugliness of the human race will finally be revealed when every single detail about anyone's life is public knowledge available to all."
We're all capable of fucking up, making shitty decisions, painting ourselves into corners, getting depressed, thinking emotionally instead of objectively/logically. That is the peril of the human condition. I don't think it's fair for any one of us to pass judgment on others actions except when it comes to the physical safety of the community.
So what, one group of people holds marital fidelity dear and think that any action that compromises this view is worthy of exposé. Another group doesn't believe in monogamy or lies about it... largely because to disagree with it ostracizes you from the community - makes you an outsider. Forget innocent parties that are hurt by this - collateral damage, a necessary evil to expose the cheaters. Can you even hear yourselves? Who cares? People lie, cheat and steal all the time. Politicians do it, spies do it, FBI, CIA, NSA, the police, hell, even Presidents do it if it serves their objective. Think about that. When are we going to wake up and realize that this is normal human behaviour - regardless of whether you're happy about that or accept it or not, this is the case.
I agree with those who say leave this behind closed doors. If marriages fall to pieces because of this, that is between them. But to publically name and shame people because their [non-criminal and not-concerning-you] actions don't jive with your morals [Perhaps politicians would be an exception to my perspective on this] is inexcusable. Not many are going to die because someone cheats on their spouse - even if they're caught. But leaking a database of this nature has real repercussions that could cause people death or persecution for something that should only between them and their partner and was none of anyone else's business.
> any and all human behaviour is totally normal
Categorically not. Lines are drawn and accepted socially. People even abide by the rules.
"...in supporting the erosion of privacy..."
I wasn't tarring everyone with this brush. I don't support the erosion of privacy, so it would be hypocritical of me to tar anyone with this brush, let alone everyone. Much of my family for instance believes in the "I've got nothing to hide, so I have nothing to fear" argument, but my perspective is "neither did the Jews before Hitler".
> Some people, rightly, hold themselves and others to higher standards.
You cannot control the actions of everyone else, only yourself. Others will do what inspires them. What inspires them may or may not align with what inspires you. When it doesn't, expecting them to abide by the rules you hold dear is only setting yourself up for disappointment.
> People even abide by the rules
Yes, when it serves their purpose. When it doesn't, they either break the rules publicly, demonstrate to get the rules changed or break them privately to avoid judgment or being ostracized by partners, family, their community and hope like hell they don't get caught.
Lines are drawn regarding all kinds of things. Let's take just for the argument's sake, speeding, or smoking marijuana, never downloading music or movies illegally - things that we can all agree, there are rules about, rules that (currently) define these activities as prohibited in many jurisdictions. Even though there are rules, and many people may argue they're dumb rules about benign activities, there are still rules. Many break the rules publicly, voicing their defiance; many others break them privately and hope they don't get caught. I'd say given your stance you never break any rules - even rules you consider dumb or counter to your own set of beliefs or don't align with your interests; you always abide by the rules and you always fall in line with the wishes of your neighbour. Of course you don't, nobody does. It's human nature to question the rules and to find loopholes, and to bend them and/or break them when they don't align with our interests. These rules, which are defined for the good of the masses, to maintain the status quo. But what happens when what's good for the masses doesn't align with what's good for you? Do you put everyone else first or do you put yourself first? You put yourself first, you hope like hell you don't get caught or called out; or you hope if you do get caught you get away with a slap on the wrist or that a reasonably competent lawyer could fight your case in court and help you avoid the charges.
For me to believe that you strictly abide by all the rules, without questioning human nature, and without understanding your set of circumstances, would be incredibly naive. There are many reasons people break the law, it's not always cut and dry nor black and white. Most of the time it's incredibly grey - to the point that billions of dollars every year are spent on lawyers to argue to put people in jail or keep people out of jail based on legal technicalities, loop holes and precedence set by previous circumstances; because nothing is black and white. If it were then anyone could go to court and defend themselves and no more lawyers would be required.
Some of those revered as the greatest people on earth shunned the rules to invoke great change. Some canonized as saints after the fact, but in their time considered rebels, misfits and, in some cases, criminals: Rosa Parks, Bob Dylan, Mahatma Ghandi, Einstein, Martin Luther King Jr., John Lennon, the lone protester at Tiananmen Square, Nelson Mandela, heck, even Jesus Christ - the son of man, shunned the rules and defied the status quo because of their beliefs - and many believe their rule breaking changed the world for the better.
Additionally, I increasingly think our interpretation of privacy has been too colored by the recent past (recent in this case being the last couple hundred years). Public privacy is largely a byproduct of increasing urbanization and the anonymity that large crowds provided. In rural areas where someone was around to witness your actions, anyone and everyone might know of it in short order.
I think we will eventually settle on new norms of privacy, where some laws are strengthened, and some are weakened, people are aware of what steps they need to take to be reasonably private in the different areas of their life, and we'll settle into a more normal level of government privacy breaches (they have always existed) than the occurrences we are seeing now (which I believe it a result of our laws and expectations no longer adequately mapping to reality).
1: For example, if a government can legally place a person at a location to observe, I believe any actions to prevent their capability to automate this process (CCTV) will likely fail in outcome, if not legislation.
If you think about genetic predispositions to certain illnesses, and technologically enabled screening for that after conception as a precursor abortion, then you can see how people will disagree with your statement here.
The same principal applies to digital technology, just because people are able to do certain things, does not mean that the law will ultimately allow it.
> If you think about genetic predispositions to certain illnesses, and technologically enabled screening for that after conception as a precursor abortion, then you can see how people will disagree with your statement here.
If it was easily discernible without the internet whether the person had that genetic marker, legislating away the ability to determine it with the internet is destined to fail. The key here is whether the digital age makes it easier to expand and correlate on something already achievable through using your eyes interacting with someone.
For example, I don't believe we can usefully legislate away a company's ability to use information gleaned from the customer during your interaction with them for their own purposes. That's the equivalent of asking a fast food server to wear a blindfold. It will be worked around, because it's ridiculously limiting for little benefit. I think we CAN usefull legislate what passive information companies are allowed to share with outside entities, or require they track additional information that makes it easy for them to respond to requests for removal (such as timestamps for all information that carry through to linked info, so we can require removal specific past info and correlations derived from it).
"I see you've been looking at this porno. Would you like lube with that?".
It's sort of analogous to the friendly neighborhood general store owner Bob knowing his customer Carl is into fishing, getting an expensive but interesting lure, and noting to Carl right after his payday that he has this interesting item Carl might be interested in... I don't see legislation preventing Amazon from doing the same going anywhere.
Sharing that data with outside companies, or restricting it to specific portions of a company with many businesses might be a good candidate for legislation, and also the ability to request specific purchases and associated data or all purchase data for you prior to X be removed.
Some recent US court cases have reached the opposite conclusion, and decided that a right to privacy from video surveillance exists:https://www.eff.org/deeplinks/2014/12/federal-court-agrees-e...
Although perhaps your standard holds, and the argument would that constant warrantless surveillance would be illegal even if done by a human.
> Although perhaps your standard holds, and the argument would that constant warrantless surveillance would be illegal even if done by a human.
That's possible. Then again, depending on what is outlawed it may run afoul of what I think is a related (and probably root) phenomenon, where something easily accomplished with little risk or cost by the average person is outlawed, and is often ignored. e.g. Jaywalking.
Also, from 1999, "You have zero privacy anyway, ... Get over it." (Scott McNealy - http://archive.wired.com/politics/law/news/1999/01/17538)
http://www.rifters.com/real/shorts/TheScorchedEarthSociety-t...
(Sorry, PDF.) (Also, for the record, I agree with neither Watts nor Brin.)
Who wants to know? This is a question easily overlooked, but is crucial to observation (aka surveillance). Observation is done by an observer and done with intent. Without intent, we stop looking.
I for one don't want to know or care for petty details about my neighbors. I want safety without the chore of maintaining knowledge. This might be too much to ask by 2020, but by 3000 we should have it figured out (granted we'll still here).
By gotten over, did you mean we'll have given in to the fact that there will be an observer (albeit a benevolent one?) or that we'll have stopped caring about the intent of the observer?
The government has played the fear card to get all this surveillance going, and now fear of surveillance (and government) is what has the resistance going. To have fear be the primary driver of our common intentions is barbaric, and humanity is still barbaric at the grandest scale.
But by 3000, hopefully we'll have gotten over all of our fears. And if all Earthlings are just one tight-knit family, then surveillance of any kind would be just creepy.
(ok, that was a bit of an overstretch, I still would like to be paid for eventual movie royalties)
E.g. we know that rich people have always obtained abortions, used illegal drugs, and had promiscuous sex, but public morality and social mores were constructed entirely on the fiction that this was the exception and not the rule.
Even in lieu of a privacy-free utopia where we fully analyze our motivations, I think we'll still have biological and tribal inclinations influencing our societal morals. (Unless this hypothetical utopia is so far in the future we've biologically evolved.)
Take this AM hack; one of te first public casualties was a somewhat famous religious conservative, who had previously been in the news for committing multiple acts of incest/child molestation as a youth (the statute of limitations on which has long since expired). Despite abundant evidence of moral malfeasance and a blunt self-assessment as 'the biggest hypocrite ever', the guys followers are still lining up to defend his fundamental righteousness and condemn his detractors as being on an inferior moral plane. This is irrational, but people place a high value on their illusions and will expend real resources to perpetuate them.
We are adjusting our social values in response to advances in technology.
OTOH, lying, cheating, and betraying those closest to you will never be acceptable. I think we will simply move towards a state where open marriages are much more common.
Consider that our hangups about sex are tied to a sense of right and wrong that comes down to food scarcity (and other base needs, such as safety from predators) and reproductive rights. So we've got a bunch of people who treat sex as having moral significance owing to a survival/economic importance that no longer exists.
When sex first became disconnected from reproduction we had a "sexual revolution" where people tried to act as if the underlying rules and norms had changed overnight and there were horrible repercussions, but that's not because there's something intrinsically correct about our current (or recent past) sexual mores. Rape within marriage used to be just fine (indeed, it only became illegal throughout the US in 1993).
I'm going to push back on that assertion. There are still STDs in developed countries with plenty of access to condoms. Assuming that STD patients are not intentionally contracting diseases, it appears, at least on a social level, that condoms are not effective ways to prevent STDs in populations, at least not yet. Likewise for other forms of birth control and unplanned pregnancy rates.
I think our morals are outpacing our science and habits. And the disadvantaged disproportionately pay the consequences. Or the people who pay the consequences end up disadvantaged. Or both.
> We are adjusting our social values in response to advances in technology.
Are we? I'm not so sure. We take a very non-judgmental view of all sorts of risky behaviors. Scientifically speaking, anal sex has many more risk factors associated with it than other forms of sex. I haven't seen any studies about health risks associated with infidelity, but it's plausible (if not almost certain) that a person having unprotected sex with a secretly promiscuous spouse is exposed to STDs unwittingly.
I think you can argue for more personal freedom, but I'm going to disagree when you assert that we, as a society, have evolved past the consequences traditional morals were set up to protect against.
And indeed, a relationship has to be based on mutual agreement and trust. If both sides agree this relationship to be open, then there's no problem at all. It's only problematic if they reached an agreement when starting the relationship, but later couldn't adhere to it. If no deal, then no relationship. If there's a deal, then you'll have to follow through.
In France it is illegal to DNA test you 'own' children, and the doctors will lie to you as a policy, to avoid 'broken homes'.
But I'd like to make the argument that the central moral imperatives put forth by the bible (as well as by many other religions) would exist as moral imperatives even without religion itself; natural selection would popularize them no matter what.
The planet is overpopulated and it can't sustain that many people. In one hundred years it will be even worse, and measures more drastic than the Chinese one child per family policy will be taken.
The total loss of privacy will let the world rulers choose who gets to live and who doesn't, with ruthless efficiency and, having records of everything questionable everyone has done, no opposition whatsoever.
I guess it will have even plenty of public support.
After the purge, the statistics based morality will rule uncontested.
The truth about humans has been pretty apparent for about as long as humans have been reflecting on it: we sometimes have high ideals and dreams, and at our best the capacity to even temporarily embody them. But very few people (if anyone) are consistently good, it would seem everybody does something ugly eventually.
And it's worth noting that the "pet moral value" that people seem the most outraged about is honesty, however much people try to load it with their own hangups. If this was a site for open marriages, tinder hookups, or anything of the sort, I doubt it would have gotten much attention at all. Instead it's a site for people a) lying to their partner, or b) lying to everyone else. Some of the most reported cases have been about raw hypocrisy.
This will absolutely make everyone pause when offering up data to third parties though, and really that couldn't come quickly enough. Whenever there is a password database dump, one of the things I've always found most remarkable are the number of people inconvenienced because they use the same password everywhere, trusting their life to every random service they used. Similarly, trusting critical, compromising data to some hookup app -- who have competencies and auditing and archiving that you have no notions about -- seems insane, but it has become an online norm. Breaches like this may make people more considerate of the value of their own data.
Imagine any couple that went through a rough patch and reconciled. They've already moved past this, and now they have to live with the knowledge that this information is out there to bring it public.
Children being mocked at school because their mother or father was on the site.
Imagine anything you dealt with in private that you didn't want to share with others, and not imagine having the choice of dealing with that in private removed from you.
It's horrible.
I'd like to think that at some point we'd just get over the whole voyeuristic, hypocritical obsession with finding new witches to burn but I'm starting to just accept that it's part of human nature.
Yes, some 'went through a rough patch' and 'already moved past this', and are now dealing with a world of pain. But ask yourself, what makes you the authority on how much pain they should have endured for their mistake? As fate would have it, whatever 'moving past' they did will now be really put to the test. This will give some couples a second chance, to really ask themselves if all is forgiven.
Yes, some 'innocents' are hurting now. Some spouses, some children maybe too. Is this the fault of the hackers? I'd argue not. Ask yourself, if it weren't for the actions of the people cheating, could this have ever happened? Ashley Madison wouldn't even exist, and this hack would never have transpired, if it weren't for the liars, and cheaters, who made such a site possible. So should we be upset at the hackers, who exposed liars, and cheaters? Or should we be upset at the liars and cheaters, who thought they would get away with it? It's the liars, and the cheaters who hurt their family, not the hackers.
https://www.reddit.com/r/lgbt/comments/3ebzzj/i_may_get_ston...
https://evan.atavist.com/my-wife-found-my-email-in-the-ashle...
Imagine being accused of adultery just because someone else preferred to sign up for an account with an email address that wasn't their own.
Put yourself in the shoes of someone whose spouse was exposed by this leak. Imagine how humiliated you would be, knowing that the whole world knows your spouse was cheating on you. Sure, it might be good to know the truth, but how does it help you that friends, family and even strangers know this about you? Not only that, but it's on the Internet, where your humiliation will be permanently recorded for all to see.
Yes, there are consequences for the cheater. But there are also consequences for the cheater's victims, and they're significantly exacerbated by the public nature of the leak.
Where I differ, is in who I blame. It sounds like there is growing animosity toward the hackers, but that dumbfounds me. How could this hack have even transpired, if it weren't for the liars, and the cheaters, who funded this site? How could an innocent spouse be embarassed by their cheating wife, if their wife never cheated on them?
Let's not get confused. The hack, exposed a morally reprehensible act by many. Here's a contrived example, that might help illuminate my point -
Consider a corrupt police force in a city, where police are taking bribes, and working with organized crime, instead of helping the community. Should we shame a mole, who exposes the police force? If he does, the police will be out jobs, and will be exposed! Think about the families!
You can see where I'm going with this...
I'm not sure how this follows.
You seem to be very glad society hasn't moved on from the "Name and Shame" game. The one that ends in death, violence and shame for everyone close to and including the named.
I wonder if one's opinion on the ethical nature of this hack, hinges on your moral disposition on cheating/infidelity. I'll illuminate what I'm getting at, by asking you this hypothetical:
If Ashley Madison were a website for child sex trafficking, and the names of registrants were exposed, leading to arrests, and public shaming... How would you feel?
I'd be very surprised if you kept the same opinion, that publicly outing those individuals, was not a fit punishment for the crime. Given that, then this entire conversation is completely subjective, and based entirely on your opinion about cheating, lying, and infidelity.
This is still an irresponsible exposure of personal information. This is still vigilante justice.
What happens to the people whose identities were stolen and used on that site? Their lives will be ruined.
It is not the public's responsibility to judge or prosecute/persecute. Give the database to the authorities.
> I'd be very surprised if you kept the same opinion, that publicly outing those individuals, was not a fit punishment for the crime. Given that, then this entire conversation is completely subjective, and based entirely on your opinion about cheating, lying, and infidelity.
This has nothing to do with what the people were doing and everything to do with mob justice and innocent people caught in the crossfire.
Public disclosure of personal information is irresponsible and hurts everyone associated with the exposed.
How is public shaming justice? Who are you to decide who and how to punish? What's an acceptable amount of innocent people to expose as cheaters/child traffickers? What about the amount of innocent family members and friends of the exposed that will get to experience this as well?
How many of the gay men in Saudi Arabia exposed by this hack are allowed to be stoned to death before the ends do not justify the public exposure?
And what makes YOU the authority to say they haven't endured enough pain? Or society, for that matter? If a couple 'went through a rough patch' and 'already moved past this', the one who was wronged was apparently forgiving. That forgiveness should be the end of it. We all make stupid decisions in our lives, but just because we did those things, we don't DESERVE endless consequences.
Your logic is a slippery slope to believing that rehabilitation is impossible. In which case, you're essentially arguing for immediate death (or at least shunning) to any wrongdoer, because how can any of us judge them to be rehabilitated?
All bitcoin transactions are public record, and even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front.
By doing what? Making payments to an address?
> Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front.
Any lumpsum can be structured as an equivalent series of regular payments. Whatever the present value of not having the data released is, it can be turned into a set of finite or indefinite payments, which last 1 year or 5 years or 10 years or however long the company feels the harm will be non-neglible. And by doing this, you still get the anti-defecting incentive of a stream rather than one-off payment.
Those transactions become permanently public, and can be used against you in court if at any time in the infinite future you are tied to that address, or tied to any addresses pulling bitcoins out of that account (which are also publicly recorded actions). Compared to cash, which is not a matter of public record, bitcoin is not a "Perfectly Adequate" solution.
Without contracts or signals, you can't make monthly payments on a depreciating asset/service because it becomes an auction. The hackers are rationally incentivized to maximize their returns, and that includes selling the data to the highest bidder before the price depreciates. That means that Ashley Madison would need to beat the highest bidder each month, without knowing if the other bidders are even real.
You apparently don't. Payments do not in themselves offer any risk whatsoever when the payments are made to a brand-new address (which is so obvious and basic a point of secure Bitcoin use I didn't need to mention it); these payments to the blackmailer can then be mixed in numerous ways at varying costs and levels of efficacy - Coinjoin, a large DNM, a web wallet, an exchange (either to just gradually withdraw, or sell outright into another cryptocoin & then sell that cryptocoin at a different exchange, particularly one of the cryptocoins with built-in anonymity features), sent to stealth addresses, etc etc. The pseudonymity of this does not affect the mechanism of turning a lump sum into a stream of payments: the payments can be safely made with reasonable levels of transaction costs, and thus the blackmailed and blackmailers can transact safely and keep the data private or not, with neither side being ripped off for more than one payment.
> The hackers are rationally incentivized to maximize their returns, and that includes selling the data to the highest bidder before the price depreciates. That means that Ashley Madison would need to beat the highest bidder each month, without knowing if the other bidders are even real.
If the hackers are bluffing, then AM can always call their bluff. If AM is not confident they are bluffing, then they will simply pay up to the value of keeping the data secret. Where's the problem here? Again, why does a stream of payments fail where lump sums would succeed?
HACKER: "Hello, I am an evil hacker. All your data is belong to me. Cough up $10 million or be destroyed."
ASHLEY MADISON MANAGEMENT: "Whatever, we don't believe you, go away."
HACKER: "All righty then." destroys them
how to get the money: bitcoin, move to russia and use wire transfers, launder it through lawyers, etc
life afterwards: one hell of a lot richer
fbi: part of the agreement is ashley doesn't go to the fbi, again, with the full data release hanging over their heads. And no, I don't think the fbi would be particularly motivated. They have plenty on their plates. Because, crucially, Ashley Madison wants this to go away (hence the hush money), so they're unmotivated to pursue legal challenges because it quite likely results in the full data release.
Particularly with the potential of disrupting the ipo, it seems straightforward to cut a deal.
And in these kinds of hostage negotiations, you give in to demands while simultaneously try to capture the criminals.
We used to have the state jail, or even torture, adulterers. Society eventually agreed that it's not their job to do that. Let's hold off on forming lynch mobs.
And if a ton of these people are non-monogamous, then perhaps we as a society should have a discussion abuot how our values are shifting and what new families look like, but something tells me that there aren't suddenly millions of non-monogamous marriages.
We've generally determined that sexual practices, as long as they're consensual and do not involve harm to anyone outside the participants themselves, should not be subject to persecution. This includes incest, as much as it may disgust you. A lot of people are disgusted by coprophagia, that doesn't mean we should publicly shame people for having sexual tastes that aren't to our fancy. It is as arbitrary as shaming people for musical preferences.
Domestic violence is a wholly separate problem altogether. There's nothing that doxing will do to solve it.
I agree that financial data being dumped is over the top.
Why should we have that discussion? If my spouse was cheating, I'd want to have that discussion in private, without gawkers, and without social pressure from the uninvolved.
I would still contend that you do get to have the discussions surrounding all of this in private, if you choose, or in public amidst people who are going through the same thing that you are through discussions like these, the legal system, etc.
What about the scores of people to whom cheating is a dealbreaker, who now have the means of divorcing their cheating spouses? What is the net outcome of the situation?
Personally? Easy choice, I'd pick not knowing. Others might pick differently.
How so, when all your neighbors and family members can know?
What about the scores of people who have a blue car?
How about we put the line somewhere between physical force and broken promises? Just an idea.
What you will see is lots of new laws to crack down on hackers, encryption and any type of computing not specifically 'approved' by some sort of security overlord department.
Look at what the UK is proposing (way before AM became news) and you'll have a rough starting point.
The laws will be the exact opposite of improved privacy.
Some people of questionable ethic and questionable intelligence gave a third party incriminating information about themselves and also gave them money all while hoping for discretion. (I say questionable intelligence because the real rich and powerful use different services provided by different people..) Any privacy agreement was a private one between 2 parties, at best covered by civil law, maybe Canadian civil law. Certainly nothing binding in any substantial way was signed.
It's certainly making light of online privacy but I'm not sure there is a battle here, it's just demonstrating that it's still very much the wild west out there. What should happen here? Should AM pay a fine to some government? Class action law suit? (I think that idea is particularly hilarious..)
Riddle me this, so suppose AM goes bankrupt. Can their creditors just take that data and sell it? It's an asset, right? Is it possible for a EULA or some sort of agreement to prevent that? Hackers or not, all that information could be in someone else' hands, that the users have no agreement with. AM is sort of the poster child for these problems but you may have given a lot of information to companies that you wouldn't want other companies to have.
https://en.wikipedia.org/wiki/The_Private_Eye
http://panelsyndicate.com, "pay what you like"
Back in my BT days I knew team leaders who had to get PV'd (aka TS) clearance.
edit: I'd like to have 1% of the $500k bounty wired in Dogecoins please
As he himself admits:
> It is possible that Zu is instead a white hat security researcher or confidential informant
Jeez, how about talking to the police and let them do their job, or at the very least censor the name.
This is just a witch hunt.
If watty might be implicated in something illegal I should go talk to the police and not publicly witch hunt your handle, no?
Krebs even clarifies "If Zu wasn’t involved in the hack, he almost certainly knows who was.".
Should I publicly out ${User} even though I could be wrong and let them suffer the ramifications that it causes?
If they lose their job, spouse, shunned by family, receive death threats, and have an internet hate mob trying to find where they live because the evidence was "leaning towards them" does that make it okay for me to call them out as being connected?
"Oops, I was wrong. They aren't connected after all." doesn't fix ${User}'s life. Even if it opens up a defamation lawsuit, it won't fix their life - and the lawsuit will be expensive - and even when they win they'll hardly see any money because I'm some nobody who doesn't have any money for them to sue for to begin with.
Do you still not see the problem?
Edit:
Not to mention I may not even be in their country.
I've never figured out how they actually decide who gets what if they have to split that up.
echo "The Twitter handle Brian Krebs anonymized in this blog post is..." | sha256sum
There you go, you can prove it to anyone at any point in time.
Edit: Maybe add a private salt?
Edit again: Oh, missed that "The Twitter handle Brian Krebs..." is effectively the private salt, nevermind.
echo "The Twitter handle Brian Krebs anonymized in this blog post is @user and this a random salt qF7KKAUxtrEtQbnj4LPkUZM4." | sha256sum
Based on the typical wording when reward money is offered, I strongly suspect almost no reward money is ever paid out. It typically requires arrest and prosecution (often conviction) and there are plenty of opportunities for the lawyers to say "sorry, your tip did not qualify" even if someone is arrested and prosecuted.
I did not find a direct offer, but Wired has a quote[1] (most sources don't even provide a quote!):
“Today I can confirm that Avid Life Media is offering a $500,000 reward to anyone providing information that leads to the identification, arrest and prosecution of the person or persons responsible for the leak of the Ashley Madison database,” Evans said, according to the BBC.
[1] http://www.wired.com/2015/08/ashley-madison-offering-500k-re...
Update: Odd. The BBC link in the Wired story has quotes from "Bryce Evans of the Toronto police", but does not have the offer of a reward quote that Wired quotes. http://www.bbc.com/news/technology-34044506
If/when these people are caught, they should face the consequences of their actions but I'm not going to wrap paranoia over my own peccadillos in fake outrage over internet privacy.
I'm opposed to people doing unauthorized things with other people's property on general principles. I'm far more concerned with the IRS's data breach because every victim was legally compelled to submit certain personal information to the IRS. Everyone on Ashley Madison was there voluntarily for nefarious purposes.
Catch them and prosecute them but don't cry crocodile tears either.
In a way, it's not unlike Snowden's revelations. Yes, it was illegal. Yes, some people are embarrassed. But the intent, in the long run, is actually to protect those people.
And, regrettably, the fact that sex secrets were exposed is likely to alert much more of the population to the real dangers of privacy erosion than Snowden's revelations.
This reads to me more like "power trip" than anything else.
http://www.troyhunt.com/2015/08/heres-what-ashley-madison-me...
Perhaps that's all Zu is? A bot, or a covert chat channel of some kind. Perhaps prime numbered words from every third tweet contain the real message, or something like that?
Not a complete answer, but:
"MOTHERBOARD: How did you hack Avid Life Media? Was it hard?
The Impact Team: We worked hard to make fully undetectable attack, then got in and found nothing to bypass.
MOTHERBOARD: What was their security like?
The Impact Team: Bad. Nobody was watching. No security. Only thing was segmented network. You could use Pass1234 from the internet to VPN to root on all servers."
Sounds like AM's computing was all f__ked up! In US Army terminology, FUBAR. Or SNAFU. Gads.
Wonder how AM paid, maybe I should say, compensated, their server farm system administration staff? Their server farm security was wide open?
Should the users have expected something else?
2.) My read is that, instead of no security, (or else AM would be have been compromised instantly by script kiddies) they used manufacturer default passwords on internal firewall appliances.
Popular password resets:
password passme abcdefg pass1234 reset changeme late4work
I am sure there are others, once the password is changed to one of these easy passwords, someone who owns the account is support to change it to a harder password.
I used to work as a federal contractor and in IT departments and handled password resets.
One time as a federal contractor someone phoned in from Florida to pretend to be me or someone in my group to get our account password changed to one of the above. They used social engineering and might have been someone who worked there but retired.
When you have a weak password, people can easily break in.
It's curious - we are all being affected by the new digital pollution
Edit: found it in "Ashley Madison 2nd dump 20 GB"
I love how Krebs has reframed "subtweeting" as some sort of new security practice as opposed to an annoying passive-aggressive thing everyone does from time to time :-D
(1) The hackers dislike the idea of adultery and wanted to harm the site & punish its users;
(2) The hackers wanted to blackmail the site and its users by threatening to expose them if they did not pay hush money or perform other services (e.g. reveal secrets).
It seems that motive (1) has some acceptance (people are cheering the hackers), but I think (2) seems more plausible. These guys aren't heroes: they found a vulnerable target and went after it.
Maybe we should not be calling those a hack and more a data-affair.
Still one can only hope that we gain some better protection and rights regarding how companies handle data and more so in the area of authority auditing that those rules and standards are maintained.
http://krebsonsecurity.com/2015/08/who-hacked-ashley-madison...