A nifty trick or shortcut that is useful. "Check out this hack to increase your productivity."
Accessing something you shouldn't. "They hacked into the database."

A lot of times they sort of get used in conjunction to describe interesting ways to gain access to secure systems, but using it to describe accessing insecure things you shouldn't is still a valid usage of the phrase.

That said I definitely wanna see the company face charges for this, this is insane.

[–] SpaceCowboy@lemmy.ca 17 points 6 days ago (3 children)

Yeah, if I leave my house door wide open for a few weeks and I get robbed, it's still burglary.

[–] Rivalarrival@lemmy.today 10 points 6 days ago

Terrible analogy. A webserver is not at all like a door. It doesn't block or allow traffic to and from your file system.

A web server is more like a receptionist. It handles requests. "Can I have your basic catalog?" "Certainly, here you go."

"Can I get this item from your basic catalog?" "Certainly."

"I don't see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?" "Absolutely."

"Can I borrow your stapler?" Sure. "How about a pad of paper?" "Of Course". "Can I just have the contents of your supply closet?" "Here you go." "How about your accounting files, can I get those?" "No problem!" "How about your entire customer list?" "Consider it done!"

When you hire a receptionist and specifically tell them to give customers anything they request, that's entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.

This wasn't burglary. This was putting up signs that say "come in" and labeling everything in your house with "free" stickers.

[–] grendel84@tiny.tilde.website 11 points 6 days ago (2 children)

@SpaceCowboy @JackbyDev

In a legal context there's also the concept of a "reasonable expectation of privacy". The computer abuse and fraud act defines hacking as accessing data or systems you are not authorized to access.

A better analogy is putting your journal in a public library and getting mad when somone reads it.

I'm not saying what these ass holes did was right, I'm saying that the company weakened their legal position by not protecting the data.

[–] SpaceCowboy@lemmy.ca 7 points 6 days ago (3 children)

Terrible analogy. You have permission to read books in a library.

Forgetting to lock your door isn't granting permission to people enter your house, and it doesn't grant people permission to take your valuables. It may be neglectful to leave your door unlocked, but it doesn't imply granting permission to enter your house.

Same goes with computer security. Leaving your computer insecure may be neglectful, but it does not imply someone has permission to take your data.

load more comments (3 replies)

[–] iii@mander.xyz 5 points 6 days ago (1 children)

A better analogy is putting your journal in a public library and getting mad when someone reads it.

Good analogy indeed. I'd go one step further and add: it's like promising others you'll keep their diary safe, then putting it in a public library, to then get mad when someone reads it.

[–] grendel84@tiny.tilde.website 6 points 6 days ago (1 children)

@iii

Yeah the internet by design is a public space, and we must be responsible and treat it as such when handling sensative data.

Again, it was very wrong for people to take that data and especially to post like that.

The company also has to do their part and produce at least some kind of barrier to the data.

Even using UUIDs and making sure the data wasn't query-able would have been something.

[–] silasmariner@programming.dev 3 points 6 days ago (1 children)

The web is a public space by design. The internet? I don't think you can make that case well. Https and all that. Private infra abounds.

[–] iii@mander.xyz 1 points 6 days ago

The data was on the public web in this case

[–] JackbyDev@programming.dev 7 points 6 days ago

Thank you! I feel like I'm taking crazy pills reading people's reactions to this. And if it was a business instead of your house and it was customer data you weren't protecting you should still be in trouble too. It's like people think only one side can be in the wrong in this or that because the data wasn't secured and in the public that gives them free reign to post it everywhere. I wonder how those people would feel if their addresses were leaked. Afterall, if you're a homeowner your name is attached to the property and is publicly accessible.

[–] spicehoarder@lemmy.zip 13 points 6 days ago (3 children)

No, this was a data leak. The word "hack" has legal implications and shifts the blame away from the company and onto the individual who discovered the leak.

[–] JackbyDev@programming.dev 6 points 6 days ago (1 children)

It can be both. The company can be at fault for not keeping something secure while the people who steal the data are at fault for stealing data. Data leaks and hacks are not mutually exclusive.

load more comments (1 replies)

[–] indepndnt@lemmy.world 3 points 6 days ago (1 children)

Based on this comment alone, I am 100% sure that you are not a lawyer.

load more comments (1 replies)

[–] zarkanian@sh.itjust.works 13 points 6 days ago (1 children)

These people should serve jail time. I'm not kidding.

[–] percent@infosec.pub 8 points 6 days ago* (last edited 6 days ago)

I'm no lawyer, but this seems like at least grounds for a class action lawsuit, I would think. Like, it seems like privacy and security is implied (however ironic for an app like this) when requiring users to upload their PII.

Also, I assume their privacy policy didn't mention that they were just gonna publish their users' PII.

[–] NigelFrobisher@aussie.zone 8 points 6 days ago

You could say they “spilled the tea”.

[–] grrgyle@slrpnk.net 14 points 6 days ago (1 children)

What is the Tea hack?

[–] finitebanjo@lemmy.world 14 points 6 days ago (2 children)

An app called Tea™ was marketed as a safespace for women and used government issued IDs as a way to verify users.

4Chan users leaked all of the IDs onto the larger internet.

[–] grrgyle@slrpnk.net 10 points 6 days ago

Wow what a fuckin shitshow. I have so many follow-up questions

[–] RampantParanoia2365@lemmy.world 4 points 6 days ago (1 children)

So it essentially became a honey trap, either through malice or sheer incompetence.

[–] finitebanjo@lemmy.world 2 points 6 days ago* (last edited 6 days ago) (1 children)

Well, I get what you mean, but a "honey trap" idiom in English, also called a "honeypot scheme", usually refers to utilizing romantic connections to influence people to make decisions or release confidential information.

[–] ICastFist@programming.dev 2 points 6 days ago (1 children)

Honeypot is a common term in computing/cybersecurity, setting up fake important servers so bad actors invade and the security team can analyze what got in and how to deal with it.

[–] finitebanjo@lemmy.world 3 points 5 days ago (1 children)

Well it doesnt surprise me that the IT team doesn't know about a sexual terminology, tbh.

[–] ICastFist@programming.dev 1 points 5 days ago

They're all over master-slave, tho 😏

[–] angstylittlecatboy@reddthat.com 12 points 6 days ago

At this point I think the women using it got psyopped

[–] gonf@lemmy.world 5 points 6 days ago

Almost definitely both were involved.

[–] m3t00@lemmy.world 5 points 6 days ago

dev came from marketing. pictures wouldn't show up with all that security enabled.

[–] HugeNerd@lemmy.ca 2 points 6 days ago

Guess someone spilled the tea

[–] m3t00@lemmy.world 2 points 6 days ago

crack heads, meth heads, what's the diff

load more comments