Hacker News Reader

Comment by TallGuyShort | Hacker News Reader

Why this stigma against acknowledging that potential victims can (and would be wise to) take steps to protect themselves.

Yes, dressing a certain way, drinking a lot of alcohol, and attending a party doesn't begin to excuse rape. But that doesn't mean it was a good idea and is something you should do without considering the possible consequences.

If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying.

View on HN

Thank you. I've gotten particularly sick of the phrase 'blaming the victim'.

If you insult someone's mother, you might get hit. If you leave valuables or cash on top of a car in a bad neighborhood it might be stolen. It's still the fault of whoever did the bad action, and everyone would be better off if you didn't need to take precautions line that, but you could have easily taken steps to lower the chance of it happening.

If you say to buckle your seatbelt, get a fire extinguisher, or look both ways before crossing the road no one bats an eye. God forbid you acknowledge that there are bad people in the world and you should take steps to protect yourself from them.

> If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying.

GP is suggesting that the people involved were clueless rubes who gave out their passwords to people of unknown identity, which I submit is almost certainly untrue.

You're possibly right, but that is pretty much what the article says. Perhaps there was more of a trust established between the parties. Perhaps they were shown a list of compromised passwords and asked if any of their passwords appeared on the list. But pointing out that what the article actually says happened makes you an easy target is hardly uncalled for. I'm taking issue with the "blaming the victim" card. Bad security practice is bad security practice and pointing it out doesn't make you Hitler.

> I'm taking issue with the "blaming the victim" card.

I also tend to gag slightly at the phrase "victim blaming", because I think it's a shibboleth that identifies your allegiances and shuts down critical thinking. But I don't actually think it's unwarranted here. Yes, the article says the people involved gave Bindmans their passwords. It also says those passwords were defunct, and that Bindmans had them anyway. It doesn't say that they didn't make reasonable efforts to verify that sharing the passwords was the right thing to do (which, as it turns out, it was). It's extremely ungenerous to respond to that by saying they deserved it for being so crap at security.

> Bad security practice is bad security practice and pointing it out doesn't make you Hitler.

I am willing to concede that it's unlikely anybody in this thread is Hitler.

Because it's easier to exonerate ourselves from any responsibility for our own mistakes than having to deal with that.

Reply on news.ycombinator.com