Hacker News Reader

Comment by alltakendamned | Hacker News Reader

It seems you're not getting serious answers here, so here's my take.

Please report this via the US-CERT at https://www.us-cert.gov/report

This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

View on HN

Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/

Came here to write that. Either Krebs or https://www.troyhunt.com

And this: https://robertheaton.com/2020/02/07/send-me-your-privacy-abu...

I do not think that recommending Brian Krebs is a good idea for someone who might wish to avoid retaliation. Recently, he doxxed some people on Twitter for reporting bugs.

https://www.itwire.com/security/infosec-researchers-slam-ex-...

As a result, I no longer visit his site or recommend his work. Publishing someone else’s personal data without consent is a terrible thing, and is one of the reasons so many of us work to secure systems. His behavior undermines that.

"Krebs appears to have form in outing people who do not agree with him. Back in 2014, he posted the CV of an individual who had written what he characterised as a bad review of a book he authored."

When British security researcher Marcus Hutchins asked whether doxxing a person for this was going a bit too far, his response was: "Dox people? Hardly. I think it helps to add context. The guy is a convicted cybercrook who's in jail. Of course he hates me."

Ouch. This is sad. I used to have a lot of respect for the guy.

This very looks cool, thank you for sharing parent.

I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is.

(Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home)

I worry sometimes that we assume people reporting security vulnerabilities will be security experts.

I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity.

> I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity.

Can you suggest any resources for a technical user who would like to learn more about this distinction?