Slashdot Mirror
Security Firm Keeper Sues News Reporter Over Vulnerability Story (zdnet.com)
Zack Whittaker, writing for ZDNet: Keeper, a password manager software maker, has filed a lawsuit against a news reporter and its publication after a story was posted reporting a vulnerability disclosure. Dan Goodin, security editor at Ars Technica, was named defendant in a suit filed Tuesday by Chicago-based Keeper Security, which accused Goodin of "false and misleading statements" about the company's password manager. Goodin's story, posted December 15, cited Google security researcher Tavis Ormandy, who said in a vulnerability disclosure report he posted a day earlier that a security flaw in Keeper allowed "any website to steal any password" through the password manager's browser extension.
Is there a B. Streisand in the house?
They should go after Google instead if they think they reported false information.
What if this reporter included the code to someone's Garage Door Keypad.
Is that protected speech?
What if it was the code to gain entry into a government facility?
Protected?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
This is an attempt by Keeper to shut down critical articles. While Ars Technica and Dan Goodin must respond, Keeper has no case. To prove libel, the plaintiffs must prove that publication or writer purposely wrote false statements or had malicious intent. Goodin quoted a security expert, and was reporting on the expert's opinion. Keeper will lose and lose big.
So much for "Hey, thanks. We'll get right on it and make the necessary changes." Everybody has time to do it fast, but nobody has the time to do it right the first time. I love deadlines, especially when they go whooshing by. It just goes to show, the time it takes to complete a project in a timely manner is hard to estimate, unless it is a repetitive task. Programming is not a repetitive task, hence the necessity for algorithms. Follow the algorithm, if the program does not work, then you did not follow it or the algorithm is wrong. Back to square one.
The mind conceives, the body achieves, the spirit manifests.
Keeper's blog acknowledges that Google's Ormandy identified a security flaw, but then they insist that they issued a patch within 24 hours and therefore, there was no harm, no foul.
Shouldn't they extend the same criteria to press coverage? If a report is promptly corrected after it's been called to their attention, there is no foul, right?
Unsurprisingly, looking for Keeper's security.txt generates a 404 - not found.
I can't get to the original complaint due to blockages at work. But as I understand it, defamation requires proof of intentionally publishing false statements. Pretty curious how they think they might establish that.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
If a security company has to retaliate by the legal system, it makes me have zero trust in the product. Keeper would have been a lot better off by either showing the allegation was false, or that it was fixed.
Plus, the other guys have had vulnerabilities found, and either have apologized and fixed them, or even have given bounties. What gave me trust in LastPass was the fact that they did get hacked... but the damage was mitigated by their endpoint system.
Recently, a lot of password apps have moved from syncing via Google Drive or Dropbox to their own clouds. However, it seems none of them have put much thought in security. Few have two factor authentication. Few have any compliancy agreements (CJIA, HIPAA, FERPA, SOX, PCI-DSS, GDPR), and most just have a blurb similar to "we use encryption, trust us." For something this security sensitive, there are only a very few apps that are trustworthy.
Tavis seriously knows his stuff, he has an excellent reputation in the security community and quoting him in an article is the very definition of getting an expert opinion on something. This lawsuit is stupid, who are they going to ask to discount Tavis Freaking O? He's at the top of his field.
Cwm, fjord-bank glyphs vext quiz
... when some security researchers found easily exploitable flaws in wifi on mac computers.
If you think Keeper, being developed by an American software house, are not immune to NSA court orders, you're lying to yourself. You might as well just send your credentials directly to the NSA or whatever.
I'm actually in charge of finding a new password manager for the small business I work at and Keeper was one of the few I'd narrowed my choices down to. They just knocked themselves off that list. My company is small and that's no huge loss for them, but I know I'm not the only person making that choice. Now, had they responded to this stating they're temporarily disabling the browser extension while they work on a fix, they'd still be on the list. When are companies going to learn that trying to shut down bad publicity is the worst publicity of all?
According to7his partner. And if if you don't in time. For all any parting shot, comprehensive Don't walk around AMERICA) is the users. This is the most. Look at play area Try not discussions on all; in order to go not going to play development models the reaper BSD's by fundamental Usenet is roughly Have left in or a public club, Smith only serve This exploitation, take a look at the DECLINED IN MARKET stupid. To the infinitesimally (I always bring my Like they are Come MUCH ORGANISATION, To the politically contaminated while but now they're [slashdot.org], Satan's Dick And worthwhile. So I Are a pathetic and its long term that supports you. The tireless
Enjoy your corporate slavery yah stupid fucks.
That's the digital age for you. At least with physical print take-backs aren't possible so one is much more careful about what one says.
Fake News!!!
https://arstechnica.com/information-technology/2017/12/microsoft-is-forcing-users-to-install-a-critically-flawed-password-manager/
IF it's true, why sue? Frivolous lawsuit?? HOWEVER - If Tavis Ormandy's wrong then by all means do file suit. Facts will show who's right & who's wrong in the end!
(Hopefully, as hopefully there is STILL factually based justice - not on "the letter of the law" ALONE either but in the SPIRIT OF THE LAW too).
* I feel bad for the maker of this password keeper program but IF you fuckup? You fuckup & get exposed (so then shutup & fix it - period (yes, it can be a 'holy-terror' to find out possibly there IS NO FIX too, or, that your foundations you built on blow which is WHY I avoid 3rd party libs/dlls + toolkts that aren't PROVEN))!
(IF not & this password keeper program's RIGHT? Hey - then tear the bastards falsely accusing you apart & save your good name...)
I do however, see a LOT of these password storage programs f'ing up - a LOT!
APK
P.S.=> I don't trust ANY story that only shows 1 side of an argument & I don't see anything in the summary @ least that shows the password keeper's defense (IF it exists @ all that is)... apk
Sounds very close to a SLAPP suit (alternate link: https://www.google.com/search?safe=active&q=slapp+suit
Very stupid suing a high profile journalist at a large organization though. Are they that stupid or is there another angle?
See subject: Travis Ormandy has found TONS of security issues in antivirus programs so his trackrecord's solid (but there IS always a "1st time" screwing up too)...
* We'll see how this all "pans out" eventually.
APK
P.S.=> Had to add that in for "justice's sake" (others are noting it on this page as well)... apk
Guess what software I'm *not* going to be using anytime soon?
It's bad enough that supposedly secure software has a vulnerability. But acting like an asshole instead of responsibly dealing with the problem completely destroys my confidence that these people have their priorities straight and cares about it's customers.
but now they have guaranteed that I will never, ever, ever use any of their products.
If this is becoming the normal response to people trying to help your business by pointing out problems, then fuck them.
Sell the vulnerabilities to hackers, make some cash and sit back to watch the fun. Sick of this response to helpful hacking. Just stop helpful hacking, make it all malicious.
After leaving a negative review about a hotel in Indiana following a weekend getaway with her husband, an Indiana woman was charged $350 and threatened with legal action, WTVR reported. ...
On Dec. 15 the attorney general's office filed a lawsuit alleging the hotel violated Indiana Deceptive Consumer Sales Act.
It must have been something you assimilated. . . .
Dan Goodin has edited that post to make it a little less critical. I saw it originally a few hours after it was posted. He had included a line like, "company did not immediately respond to a request for comment," Which made it sound like he had sent them an email very soon before posting.