Hackers access 16 million email accounts

http://www.thelocal.de/20140121/agency-warns-of-16-million-email-accounts-hacked-bsi-germany

by epaga • 13 years ago

13 7 13 years ago

mzehrer2• 13 years ago

There is no evidence for anything in the news reports. It looks like the BSI is just phishing for active mail accounts. Looks like the german goverment will never understand that security == transparency.

morsch• 13 years ago

The article is light on the details. Apparently, the addresses were gathered from defunct botnets. You're right that there's no evidence for this, though I'm not sure what kind of evidence you expect. I think the idea that this is the BSI gathering active email accounts is pretty preposterous.

mzehrer2• 13 years ago

Both ideas are founded on the same amount of evidence... the BSI should be open about it's sources. But they just decuded to scare people.

epaga• 13 years ago

I'd disagree that security == transparency. You can not have security without transparency, but you can certainly have transparency without security.

As for the idea that they are "phishing for active mail accounts", I find that pretty far-fetched to be honest. What use would a vast list of email addresses of normal people be of use to them? To spam them?

ams6110• 13 years ago

You can have transparency without security, but at least you then know you don't have security, and can act accordingly.

PeterWhittaker• 13 years ago

I'm not sure how to read security == transparency. Now bear in mind that I tend to favour radical transparency, e.g., in government reporting and accountability, provided that it does not override personal privacy, i.e., data is anonymized, masked, etc....

But there are many cases where transparency != security, or perhaps a better way of putting it would be transparency XOR security.

For example, witness protection programs, police informants, classified military and intelligence information, etc.

In all of these cases, there should be a certain transparency of program governance and policy, with ZERO transparency of program procedure and information details: If you have no need to know, you get to know exactly and perfectly nothing, lest people die.

Like it or not, there are times when transparency is the enemy of security. The trick is documenting those cases well and implementing appropriate policy, governance, and oversight. It's quite a trick.

andor• 13 years ago

https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2...

This is the official press release. Still they don't give a source for those 16 million credentials...

Hackers access 16 million email accounts

Related Stories