Slashdot Mirror
Security Firm Keeper Sues News Reporter Over Vulnerability Story (zdnet.com)
Zack Whittaker, writing for ZDNet: Keeper, a password manager software maker, has filed a lawsuit against a news reporter and its publication after a story was posted reporting a vulnerability disclosure. Dan Goodin, security editor at Ars Technica, was named defendant in a suit filed Tuesday by Chicago-based Keeper Security, which accused Goodin of "false and misleading statements" about the company's password manager. Goodin's story, posted December 15, cited Google security researcher Tavis Ormandy, who said in a vulnerability disclosure report he posted a day earlier that a security flaw in Keeper allowed "any website to steal any password" through the password manager's browser extension.
Is there a B. Streisand in the house?
They should go after Google instead if they think they reported false information.
This is an attempt by Keeper to shut down critical articles. While Ars Technica and Dan Goodin must respond, Keeper has no case. To prove libel, the plaintiffs must prove that publication or writer purposely wrote false statements or had malicious intent. Goodin quoted a security expert, and was reporting on the expert's opinion. Keeper will lose and lose big.
That's alot of what-ifs. He didn't do any of that.
Why don't you read it for yourself:
https://arstechnica.com/information-technology/2017/12/microsoft-is-forcing-users-to-install-a-critically-flawed-password-manager/
Poor analogy. If you happen on someone's passcode then it's a dick move to disclose it without good reason. If you find a security firm has failed to fix a vulnerability they knew about, then it's legit to shame them and scare their customers to get them to take action.
So much for "Hey, thanks. We'll get right on it and make the necessary changes." Everybody has time to do it fast, but nobody has the time to do it right the first time. I love deadlines, especially when they go whooshing by. It just goes to show, the time it takes to complete a project in a timely manner is hard to estimate, unless it is a repetitive task. Programming is not a repetitive task, hence the necessity for algorithms. Follow the algorithm, if the program does not work, then you did not follow it or the algorithm is wrong. Back to square one.
The mind conceives, the body achieves, the spirit manifests.
Keeper's blog acknowledges that Google's Ormandy identified a security flaw, but then they insist that they issued a patch within 24 hours and therefore, there was no harm, no foul.
Shouldn't they extend the same criteria to press coverage? If a report is promptly corrected after it's been called to their attention, there is no foul, right?
Unsurprisingly, looking for Keeper's security.txt generates a 404 - not found.
There's a fundamental difference between disclosing a security secret on which a system depends (such as a garage door keycode or an RSA public key) and pointing out that the system is flawed and can be exploited without knowing the secret. To extend the analogy, if every garage door opener from a company can be opened with keycode "1234" then in my opinion (shared by many others) the manufacturer was fraudulent when it sold the doors as if they were secure, knowing they were not.
In other words, any "security" system with a back door is a fraud. Full stop.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
Assuming those were ruled to be protected speech... that would only protect the speaker from being prevented from (or punished for) saying them. An individual is still responsible for their actions. Protected speech can run afoul of contract law, civil law (such as libel), copyright law, or any number of other obligations. Your garage door example would be simple negligence and the entry code example would probably be both a violation of an employment contract and federal law.
I can't get to the original complaint due to blockages at work. But as I understand it, defamation requires proof of intentionally publishing false statements. Pretty curious how they think they might establish that.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Are you a lawyer? Didn't think so.
If a security company has to retaliate by the legal system, it makes me have zero trust in the product. Keeper would have been a lot better off by either showing the allegation was false, or that it was fixed.
Plus, the other guys have had vulnerabilities found, and either have apologized and fixed them, or even have given bounties. What gave me trust in LastPass was the fact that they did get hacked... but the damage was mitigated by their endpoint system.
Recently, a lot of password apps have moved from syncing via Google Drive or Dropbox to their own clouds. However, it seems none of them have put much thought in security. Few have two factor authentication. Few have any compliancy agreements (CJIA, HIPAA, FERPA, SOX, PCI-DSS, GDPR), and most just have a blurb similar to "we use encryption, trust us." For something this security sensitive, there are only a very few apps that are trustworthy.
Yes, absolutely. Why is this even a question?
Now don't get me wrong, I'm not saying it is morally ok, only that it is legally ok. Also, I am not saying that the person cannot be prosecuted for how they acquired that information, only that they cannot be prosecuted for the simple act of saying the information. Though if they signed an agreement to not share the information, I suppose that would also be prosecutable. But I would call that prosecuting for breach of contract to avoid opening up any loopholes regarding future prosecution of unpopular speech.
Tavis seriously knows his stuff, he has an excellent reputation in the security community and quoting him in an article is the very definition of getting an expert opinion on something. This lawsuit is stupid, who are they going to ask to discount Tavis Freaking O? He's at the top of his field.
Cwm, fjord-bank glyphs vext quiz
... when some security researchers found easily exploitable flaws in wifi on mac computers.
If you think Keeper, being developed by an American software house, are not immune to NSA court orders, you're lying to yourself. You might as well just send your credentials directly to the NSA or whatever.
I'm actually in charge of finding a new password manager for the small business I work at and Keeper was one of the few I'd narrowed my choices down to. They just knocked themselves off that list. My company is small and that's no huge loss for them, but I know I'm not the only person making that choice. Now, had they responded to this stating they're temporarily disabling the browser extension while they work on a fix, they'd still be on the list. When are companies going to learn that trying to shut down bad publicity is the worst publicity of all?
What if this reporter included the code to someone's Garage Door Keypad.
Is that protected speech?
What if it was the code to gain entry into a government facility?
Protected?
It depends how the reporter obtained these things.
If the reporter signed Non-Disclosure Agreements, was given access to company secrets, and then turned around to leak and/or publish them, then that is definitely not protected.
If I paint the code to my garage door keypad in big red numbers on my garage door, and then the reporter takes a clear broad daylight picture of it while standing on a public sidewalk, and then publishes the picture, that's definitely protected. (The fact that I'm dumb enough to paint my code on my garage door doesn't take away anybody's constitutional rights.)
That may be a little off topic.. firstly they are saying that the information reported is false and misleading not that they released code that would jeopardize public safety. secondly and probably the most important they are suing a reporter instead of the security bloger who made the claims they reported.
Enjoy your corporate slavery yah stupid fucks.
Did they take it down? Your link just ends up on the Dec 2017 summary of articles for me.
Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
That's the digital age for you. At least with physical print take-backs aren't possible so one is much more careful about what one says.
Fake News!!!
https://arstechnica.com/information-technology/2017/12/microsoft-is-forcing-users-to-install-a-critically-flawed-password-manager/
IF it's true, why sue? Frivolous lawsuit?? HOWEVER - If Tavis Ormandy's wrong then by all means do file suit. Facts will show who's right & who's wrong in the end!
(Hopefully, as hopefully there is STILL factually based justice - not on "the letter of the law" ALONE either but in the SPIRIT OF THE LAW too).
* I feel bad for the maker of this password keeper program but IF you fuckup? You fuckup & get exposed (so then shutup & fix it - period (yes, it can be a 'holy-terror' to find out possibly there IS NO FIX too, or, that your foundations you built on blow which is WHY I avoid 3rd party libs/dlls + toolkts that aren't PROVEN))!
(IF not & this password keeper program's RIGHT? Hey - then tear the bastards falsely accusing you apart & save your good name...)
I do however, see a LOT of these password storage programs f'ing up - a LOT!
APK
P.S.=> I don't trust ANY story that only shows 1 side of an argument & I don't see anything in the summary @ least that shows the password keeper's defense (IF it exists @ all that is)... apk
Sounds very close to a SLAPP suit (alternate link: https://www.google.com/search?safe=active&q=slapp+suit
Very stupid suing a high profile journalist at a large organization though. Are they that stupid or is there another angle?
I couldn't copy/paste that link, but the story is definitely still there: For 8 days Windows bundled a password manager with a critical plugin flaw
See subject: Travis Ormandy has found TONS of security issues in antivirus programs so his trackrecord's solid (but there IS always a "1st time" screwing up too)...
* We'll see how this all "pans out" eventually.
APK
P.S.=> Had to add that in for "justice's sake" (others are noting it on this page as well)... apk
Guess what software I'm *not* going to be using anytime soon?
It's bad enough that supposedly secure software has a vulnerability. But acting like an asshole instead of responsibly dealing with the problem completely destroys my confidence that these people have their priorities straight and cares about it's customers.
but now they have guaranteed that I will never, ever, ever use any of their products.
If this is becoming the normal response to people trying to help your business by pointing out problems, then fuck them.
Sell the vulnerabilities to hackers, make some cash and sit back to watch the fun. Sick of this response to helpful hacking. Just stop helpful hacking, make it all malicious.
After leaving a negative review about a hotel in Indiana following a weekend getaway with her husband, an Indiana woman was charged $350 and threatened with legal action, WTVR reported. ...
On Dec. 15 the attorney general's office filed a lawsuit alleging the hotel violated Indiana Deceptive Consumer Sales Act.
It must have been something you assimilated. . . .
Dan Goodin has edited that post to make it a little less critical. I saw it originally a few hours after it was posted. He had included a line like, "company did not immediately respond to a request for comment," Which made it sound like he had sent them an email very soon before posting.
Assuming those were ruled to be protected speech... that would only protect the speaker from being prevented from (or punished for) saying them. An individual is still responsible for their actions. Protected speech can run afoul of contract law, civil law (such as libel), copyright law, or any number of other obligations.
If you can be successfully sued for the speech, then in what way is it protected?
"Next, it must be determined if the speech in question is protected by the First Amendment. Certain kinds of speech have not been given constitutional protection. For example, states may allow damage suits against persons who have made slanderous or libelous statements..."
https://home.ubalt.edu/shapiro...
Maybe you mean something else by "protected speech"?