Hacker News Reader

Comment by bdcravens | Hacker News Reader

If Bank A makes my PIN number automatically the last 4 of my SSN, and Company B discloses that information, is Company B responsible for 9 times whatever losses I incur if my ATM is stolen?

View on HN

> If Bank A makes my PIN number automatically the last 4 of my SSN, and Company B discloses that information

By Kerckhoffs's principle

> https://en.wikipedia.org/w/index.php?title=Kerckhoffs%27s_pr...

a cryptosystem has to stay secure even if everything about the system, except the key, is public knowledge. So Bank A is at fault, because it neglected basic guiding principles for designing security systems.

Which gets to the frivolity of the lawsuit. The primarily responsible party, the exchange, is likely a less lucrative target than AT&T.

Suing the people with the money is rule #1 of lawsuits.

Which would be the case if Kerckhoff's principle was enshrined in law, which it's not.

But it is deeply central for designing any secure system that one can really argue that it is a disregard of due diligence when not followed.

It's still absurd to me that it's nearly impossible to prevent BofA and other institutional banking companies from sharing this information.

I think that ship has already sailed. We need to be moving to a world where those magic strings aren't valuable, and punish companies that use them. It seems unfair; punishment feels it should be directed at the leakers, but you can't put toothpaste back in a tube, at least not cleanly, and the toothpaste is still likely contaminated regardless.

Sure.. you can sue for whatever you want. There is no guarantee that you will be awarded the damages though.

That was my literal question, yes :-) I'll reword it to be match what I was trying to say.

This kind-of comment would have been clever in elementary school.

Here, you're just being a dick.

Sorry I really wasn't trying to be a dick here. The original post asked whether one party could sue instead of being responsible. It is possible that this is why my post seems childish.

The point I was trying to make was about conflating the damages being sought in a lawsuit by one party and the actual damages owed by other other in a lawsuit. I think it is pretty common practice for the plaintiff pick a high number out of somewhat thin air to prevent themselves from pricing themselves from leaving money on the table.

Reply on news.ycombinator.com