Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/25/2006
12:12 PM
Bob Evans
Bob Evans
Commentary
50%
50%

Privacy: Three Cheers For Microsoft, AOL, Yahoo For Doing The Right Thing

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.

First of all, three cheers for Microsoft! The latest news has the company defending its decision to cooperate with the Justice Department in an anti-pornography effort.The company said it limited the material it gave to Justice to "a random sample of pages from its search index and some aggregated query logs that listed queries and how often they occurred," and that it was careful to avoid passing along any information that could possibly be tied to either an individual human or an individual machine or an individual IP address. All proper and above board, don't you think? Well, think again---the dyspeptic critics who first railed against this on the grounds that Microsoft and the others blatantly violated the privacy of their customers have now changed their tune a bit and are saying that it's no longer relevant whether any privacy was violated or not (and even they admit it was not).

Rather, these folks say, it's neither relevant nor good enough that Microsoft and Yahoo and AOL upheld without exception their responsibilities to protect the privacy of their customers---instead, these "critics" say, the issue isn't about privacy after all---it's about trust. And since they've been fully discredited for their initial criticism over privacy violations, they are now trumpeting fresh charges that Microsoft surrendered too easily or rolled over too quickly or knuckled under or chickened out or compromised or sold out or whatever other ridiculous and derogatory interpretation they want to use.

Here's an example from one of these experts/critics/scolds: "Nevertheless, by not pushing back against such a bad request for data, it leaves open the real fear that they might not push back if the U.S. government decided to go on a real fishing expedition in the future. Privacy may not have been lost but trust was." Hey---are you afraid? Have you lost trust? Do you lay awake at night, sweating about the US government going on a real fishing expedition by trampling over Microsoft and Yahoo to find out what normal Americans do and say online? I mean, look at the thousands---or is it millions?---of Americans who've been tossed into dungeons because the dastardly Patriot Act was used to find cross-matches between people who subscribe to "The Nation" and drink Tsing-Tao beer and have checked out "1984" from their public library? To call this absurd is to give it way too much credit.

Yet these scolds would have us believe that Microsoft has pushed us one step closer to the precipice of governmental tyranny by "giving in too easily." Let's see if Microsoft shareholders start dumping the company's stock in support of the "giving in too easily" criticism. Let's see if Microsoft customers start ripping out SQL Server and Word and Outlook because Microsoft "gave in too easily" instead of spending millions of dollars to have lawyers grandstand and give speeches to mollify the "privacy advocates." Lemme say it again: three cheers for Microsoft and AOL and Yahoo for doing the right thing and ignoring those "critics" whose credibility is diminishing as Microsoft's is rising.

And in a strange way, I'm almost looking forward to what the next volley will be from the "critics" when their "giving in too easily" campaign goes nowhere, because I'm curious: what will be left for them to criticize? I lack the imagination to conjure that up, but based on the track record of these public defenders, we can be sure they'll think of something. Based on that track record, my guess is their next effort won't make much sense to most people, it won't have much basis in reality, it'll be framed in highly emotional terms and doomsday contexts, and the media will give it massive coverage. Hmm...perhaps I've been missing the point all along.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3738
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVE-2019-3739
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVE-2019-3740
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
CVE-2019-3756
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
CVE-2019-3758
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts.