Slashdot Mirror
Security Firm Keeper Sues News Reporter Over Vulnerability Story (zdnet.com)
Zack Whittaker, writing for ZDNet: Keeper, a password manager software maker, has filed a lawsuit against a news reporter and its publication after a story was posted reporting a vulnerability disclosure. Dan Goodin, security editor at Ars Technica, was named defendant in a suit filed Tuesday by Chicago-based Keeper Security, which accused Goodin of "false and misleading statements" about the company's password manager. Goodin's story, posted December 15, cited Google security researcher Tavis Ormandy, who said in a vulnerability disclosure report he posted a day earlier that a security flaw in Keeper allowed "any website to steal any password" through the password manager's browser extension.
Is there a B. Streisand in the house?
This is an attempt by Keeper to shut down critical articles. While Ars Technica and Dan Goodin must respond, Keeper has no case. To prove libel, the plaintiffs must prove that publication or writer purposely wrote false statements or had malicious intent. Goodin quoted a security expert, and was reporting on the expert's opinion. Keeper will lose and lose big.
That's alot of what-ifs. He didn't do any of that.
Why don't you read it for yourself:
https://arstechnica.com/information-technology/2017/12/microsoft-is-forcing-users-to-install-a-critically-flawed-password-manager/
Unsurprisingly, looking for Keeper's security.txt generates a 404 - not found.
There's a fundamental difference between disclosing a security secret on which a system depends (such as a garage door keycode or an RSA public key) and pointing out that the system is flawed and can be exploited without knowing the secret. To extend the analogy, if every garage door opener from a company can be opened with keycode "1234" then in my opinion (shared by many others) the manufacturer was fraudulent when it sold the doors as if they were secure, knowing they were not.
In other words, any "security" system with a back door is a fraud. Full stop.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
Assuming those were ruled to be protected speech... that would only protect the speaker from being prevented from (or punished for) saying them. An individual is still responsible for their actions. Protected speech can run afoul of contract law, civil law (such as libel), copyright law, or any number of other obligations. Your garage door example would be simple negligence and the entry code example would probably be both a violation of an employment contract and federal law.
I can't get to the original complaint due to blockages at work. But as I understand it, defamation requires proof of intentionally publishing false statements. Pretty curious how they think they might establish that.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Tavis seriously knows his stuff, he has an excellent reputation in the security community and quoting him in an article is the very definition of getting an expert opinion on something. This lawsuit is stupid, who are they going to ask to discount Tavis Freaking O? He's at the top of his field.
Cwm, fjord-bank glyphs vext quiz
I'm actually in charge of finding a new password manager for the small business I work at and Keeper was one of the few I'd narrowed my choices down to. They just knocked themselves off that list. My company is small and that's no huge loss for them, but I know I'm not the only person making that choice. Now, had they responded to this stating they're temporarily disabling the browser extension while they work on a fix, they'd still be on the list. When are companies going to learn that trying to shut down bad publicity is the worst publicity of all?
That may be a little off topic.. firstly they are saying that the information reported is false and misleading not that they released code that would jeopardize public safety. secondly and probably the most important they are suing a reporter instead of the security bloger who made the claims they reported.
Except the reporter wasn't simply reporting what the Google researcher said apparently. At least not originally. Let me play Devil's Advocate for a sec.
Here's the actual complaint Keeper is making, and if you compare some of the text they mention that was contained in the original version of the article to the twice-revised version that's currently posted, there are some differences in the phrasing and verbiage that affect the factual accuracy of the statements being made.
For instance, just look at the URL for the article and you can see that the headline has changed. It currently reads:
For 8 days Windows bundled a password manager with a critical plugin flaw: Plugin for Win 10 version of Keeper had bug allowing sites to steal passwords
which, from what I can tell, seems to be an accurate statement (though Keeper disputes it on a technicality). But note the differences from the original headline:
Microsoft is forcing users to install a critically flawed password manager: Win 10 version of Keeper has a 16-month old bug allowing sites to steal passwords
which was false at the time of publication since the bug has been fixed prior to publication and the new bug wasn't the same as the previous one (though it was very similar). The complaint goes on to list dozens of other statements across the various iterations of the article, each of which they've taken issue with.
That said, let me take my Devil's Advocate cap off and say that I don't really think that the Keeper case has much merit, since most of the "false" statements seem to be minor technicalities at best. As an example, they contend that "Keeper" didn't have any bugs, since it was the Keeper browser extension that was buggy, not the Keeper app itself. They also contend that the buggy extension wasn't "bundled", which is technically correct, but it's installed via the bundled app, so to an end user it would have seemed no different than if it had been bundled. So, yay for being technically correct?
Really, I think they're taking issue with the connotations of the original headline and the bad press it created, and they're just trying to prop up their case with as many slight inaccuracies as they can find, no matter how slight.
I couldn't copy/paste that link, but the story is definitely still there: For 8 days Windows bundled a password manager with a critical plugin flaw
Guess what software I'm *not* going to be using anytime soon?
It's bad enough that supposedly secure software has a vulnerability. But acting like an asshole instead of responsibly dealing with the problem completely destroys my confidence that these people have their priorities straight and cares about it's customers.
but now they have guaranteed that I will never, ever, ever use any of their products.
If this is becoming the normal response to people trying to help your business by pointing out problems, then fuck them.
Sell the vulnerabilities to hackers, make some cash and sit back to watch the fun. Sick of this response to helpful hacking. Just stop helpful hacking, make it all malicious.
After leaving a negative review about a hotel in Indiana following a weekend getaway with her husband, an Indiana woman was charged $350 and threatened with legal action, WTVR reported. ...
On Dec. 15 the attorney general's office filed a lawsuit alleging the hotel violated Indiana Deceptive Consumer Sales Act.
It must have been something you assimilated. . . .
While there's a lot of " Everybody has time to do it fast, but nobody has the time to do it right the first time." out there, it's also true that it's quite difficult to find a lot of bugs, particularly your own bugs. And this is true even if you're excruciatingly careful. If you doubt that, consider the Mars lander that failed because of a units conversion. That wasn't a matter of "doing it fast and sloppy".
The reaction to a bug being revealed, however, is significant. I wouldn't trust Keeper, or a company closely associated with it, for anything at this point.
I think we've pushed this "anyone can grow up to be president" thing too far.
Assuming those were ruled to be protected speech... that would only protect the speaker from being prevented from (or punished for) saying them. An individual is still responsible for their actions. Protected speech can run afoul of contract law, civil law (such as libel), copyright law, or any number of other obligations.
If you can be successfully sued for the speech, then in what way is it protected?
"Next, it must be determined if the speech in question is protected by the First Amendment. Certain kinds of speech have not been given constitutional protection. For example, states may allow damage suits against persons who have made slanderous or libelous statements..."
https://home.ubalt.edu/shapiro...
Maybe you mean something else by "protected speech"?