Blizzard detected an illegal intrusion on their internal network and announced the unfortunate situation to their World of Warcraft community of users [i.e. customers] in August 2012.
A fair bit of information was stolen and more than one piece of it could be harmful elsewhere now or in the future for some people, it seems fairly obvious.
The security question(s)' answer were stolen. The email address(es) were stolen, although which email addresses (account, Real ID, what) were stolen is not clearly spelled out. Encrypted copies of passwords were stolen, though it didn't say if this included only the current password or older ones as well.
Along with that, some important information about the Authenticator dynamic password generating electronic devices owned by many users was stolen.
Users have been asked to change their security question/answer, change their password, and go through a special procedure with their Authenticator devices. Everything is handled on Blizzard's web site, of course, so people should not traipse through randomly sourced web sites and emails.
Combined with the recent revelations on procedural hacks of customers service request handling involving Apple, Google, and Amazon web sites — some powerful lessons are taught. Also, some really disturbing questions are raised.
The biggest revelation is this one: do companies honestly think that they live in their own universe and that they do not share customers with other companies and service organizations?
The useful days of the "security question" is fast running out. In fact, I would say it is expiring now. The fact is, security question & answer pairs become pretty useless once they start getting stolen en masse, by the millions, from professional web sites or other businesses/organizations.
Well, they have been.
So, the cat is out of the bag, the horse has run out of the barn, and so on. Now, the problem is several fold.
First off, there is not a record of what these questions and answers were and if there was, the companies who get ripped off are not showing them to the users themselves. Not even what the previous question was.
That seems like a problem. It is becoming an unwieldy burden for users to keep track of every security question they have ever used at any web site, employer, etc. But to be secure given that they deal with businesses that seem like security failures, they are going to need to start doing that.
This means, that users are going to in effect be writing an intimate biography of arcane details of their life. And yes, since it will include so many details they are going to have to write it all down on a piece of paper or store it on a computer or storage device.
This is what crooks are stealing from in the first place; and doing so quite successfully.
The second problem is what if all of the personal questions in one set of choices you are offered are ones you have already answered before?
Under the current regime, compromise of seemingly trustworthy businesses being the norm not the exception, you would be disinclined to reuse a question+answer pair. The number of choices you are offered is increasingly paltry; could be as few as 4 or 5.
What do you do — make up a fake answer to one of the questions?
Of course because those asking it had no right and claimed no right to know the real answer. So now one has to keep an endlessly growing, reality-based, semi-fictitious autobiography at hand.
How crazy is that?
When praxis goes asymptotic on the absurdity scale; it is time to reset the game, change the rules, redo the practices including the underlying philosophies and approaches that led to the cul de sac in the first place. No need to "go there" again, right? Or to any other dead end approximately the same as it.
The third issue is privacy itself. What right does some company have to know the first name of the second girl you ever kissed, one of your pet's names, what cars you bought, what places you lived, and what you best friends' names were?
Where I came from, that is called "prying". There is an old phrase, "Loose lips sink ships" from back in the World War days.
Well, um, since these companies store this information for millions of people on computers that unknown outsiders are allowed to break into, it seems like they have the loosest lips on the globe.
If they are collecting information they had no right to in the first place, and they cannot hold onto it any better than a freshman trying to catch a bacon slathered pigskin then something has to completely change.
That means either:
- the procedures suck and are far outdated for a world where the quality/efficacy of computer/network/media security is lamentable, or
- the organizational entities suck and have to change or be changed to suck less
- the computer criminals and their tools suck and have to be removed from the field of play
I'm not speaking of Blizzard, at least not particularly. And I am not just talking about individual organizations or individual people either.
I am speaking of all computer-using and data-collecting organizations. Wake up. You failed hard.
Privacy of users and security of computers is now worse than when you set out to create your security measures & policies. Not only are people and their data slipping down a hill but the hill is eroding under them at the same time they are going down it.
I read an article earlier this year where a manager at a huge organization responsible for computer security described current computer security practices as "unsustainable". I agree.
In fact, it has been obvious for years so it is refreshing to hear someone say it and I hope that people saying it is not all we have to look forward to for the coming years.
Unsustainable connotes failed and doomed to increasing disaster in a number of disciplines today.
I do not think that computer security is absent from that list. When you read the word "unsustainable" take note and see if that connotation might apply. If it does, beware.
And that is bad.
Boundaries have effectively been removed from the field.
Most rules, fair play, good conduct, and security will now increasingly do something most people will find perplexing: backfire, and additively at that. I have noticed an alarming uptick in circumvention in the news this year by a broad gamut of entities. It is one thing to make a deal with the devil; quite another to emulate him.
If things are not uprighted quickly, then good sportsmanship will be punished and bad sportsmanship will be rewarded.
It is that kind of an environment that imbues everything with corruption very swiftly. In a field like computers, where logic and truth are what everything depends upon, reliability will go out the door.
That will be no fun at all, and you cannot come back from that place. Once corruption becomes systemic it becomes endemic. The society of computers across the globe is rapidly becoming corrupted and untrustworthy.
So looking at the big picture of a whole travel itinerary, and not as separate scenes in isolated snapshot photos seen through a pinhole camera … I am not laughing. Potentially, someone holds enough pieces to solve millions or billions of puzzles that were never meant to be solved and basically clear almost every kind of chip from the table that there is.
I think there are crimes that just cannot be imagined which can be perpetrated against individual entities/industries/persons and industries/nations/markets/cooperatives.
Remember the old saying, "To err is human but to really screw things up you need a computer"?
Yeah, think about that on a global scale. When one organization has a loss of user's private data and/or credentials then everyone's potential to suffer escalates, and that person's potential to suffer everywhere rises as well.
But when a lot do it, and these loses are going off constantly all over, well then you have a different sort of proposition. It's a chain reaction, as in nuclear.
The only difference is the data is credentials, private, and sensitive data. That data can unlock, pervert, steal, copy, or destroy all sorts of assets.
Instead of runaway fission of atoms by displaced neutrons what you have is runaway unification of data by deftly copied/processed/transferred and then deftly placed data.
The result is not a meltdown, though it would feel like one for 99.99% of people. It would be more like a remaking of the world in terms of ownership, rights, capabilities, control, and so on.
We don't have to guess what that would be like in real life. MMOs have shown how that plays out in terms of robbed individual and group in game back accounts, personal possessions; theft of privileges from authorities/owners; loss of standing in the community at least for a short time, and so on.
Data theft; it is not a little crime at all. And it is almost never isolated either; especially for assets guarded by policies defined under the current practicum.
Maxwell's demon is out of the simulation and really into reality. Crime is heating up and the effects are going to be chilling on the other side of things.
