Blaming the victims? Really?
If I get my bike stolen I am not be blamed if I use a shitty lock.
If I get raped I am not to be blamed if I was too drunk to resist.
If I get hacked I am not to be blamed if I was susceptible to social engineering.
Yes, it is very useful for potential victims to learn how to best protect themselves. But the moral responsibility in such violations is on the attacker, and is proportional to the damage caused to the victim, not the efforts taken to cause it.
Admittedly, this is part of why part of the crypto-activist community puts me off. Yes, cryptography is a great resistance tool, but my utopia is a society built on cooperation, equality and trust, not one of algebraic fences.
Bike theft: stealth, in my list above -- someone acted while you weren't attentive. You didn't hand over the bike, so you're not to be blamed. Even if you used no lock whatsoever, I wouldn't blame you. You could've done more, but you need to weigh the benefits against the burden of a massive lock so there's no perfect way out.
Rape: force, in my list above. You had no ability to change the outcome. I wouldn't blame you.
Hacked via social engineering: You spilled the beans. Spilling beans is avoidable with some practice, awareness, logic... this is not the same category as the others. I don't say "this is all you're fault," of course not. But unlike the bike thief and the rapist, all you had to do was ignore the attack.
And even if there was authentication, now it's time for authorization. The only authorized recipient of a password is the exact same entity with which you established the password.
Yes, dressing a certain way, drinking a lot of alcohol, and attending a party doesn't begin to excuse rape. But that doesn't mean it was a good idea and is something you should do without considering the possible consequences.
If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying.
If you insult someone's mother, you might get hit. If you leave valuables or cash on top of a car in a bad neighborhood it might be stolen. It's still the fault of whoever did the bad action, and everyone would be better off if you didn't need to take precautions line that, but you could have easily taken steps to lower the chance of it happening.
If you say to buckle your seatbelt, get a fire extinguisher, or look both ways before crossing the road no one bats an eye. God forbid you acknowledge that there are bad people in the world and you should take steps to protect yourself from them.
GP is suggesting that the people involved were clueless rubes who gave out their passwords to people of unknown identity, which I submit is almost certainly untrue.
I also tend to gag slightly at the phrase "victim blaming", because I think it's a shibboleth that identifies your allegiances and shuts down critical thinking. But I don't actually think it's unwarranted here. Yes, the article says the people involved gave Bindmans their passwords. It also says those passwords were defunct, and that Bindmans had them anyway. It doesn't say that they didn't make reasonable efforts to verify that sharing the passwords was the right thing to do (which, as it turns out, it was). It's extremely ungenerous to respond to that by saying they deserved it for being so crap at security.
> Bad security practice is bad security practice and pointing it out doesn't make you Hitler.
I am willing to concede that it's unlikely anybody in this thread is Hitler.