Hacker News Reader

Requiring businesses to file breach notifications over credential stuffing attacks seems completely insane to me. What's next? Breach notifications over phishing campaigns?

Perhaps the goal is to render breach notifications useless by flooding them with nonsense like this?

View on HN

What's insane is thinking that a bank that handles people's money shouldn't be required to report a coordinated successful attack, regardless of whether their technology is at fault.

There are thousands of coordinated successful phishing campaigns going on against Paypal every day, what value would that reporting provide to anyone?

If all it takes is someone to download one of the countless publicly-available-on-github plaintext password compilations and automate login attempts to require a company to file a breach notification, I think all of the top services in the world would have to file one every hour.

Reply on news.ycombinator.com