Discussion
Oh look, the cops leaked the full details of every single crime stoppers tip they got last year, including personal information on the tipster.
Of course it's an external vendor. What could go wrong with outsourcing systems like this?
People are going to die because of this criminal negligence.
@jarek @mayintoronto Vulnerable Sector checks are done by police. Sounds like another private company inserting themselves in the process to skim off profit.
@ZenHeathen @mayintoronto yes, done by the police, using services of a private company
https://www.tps.ca/services/police-record-checks/
https://www.tdsb.on.ca/Community/How-to-Get-Involved/Volunteering
The fact that the information architecture was not designed to:
a) remove identifying information from the body of the tip, and
b) store identity as a separate database with locked down...
That's deep, deep negligence in program design.
"[The hackers] added that the security measures of P3, which was storing Crime Stoppers' tips, were "terrible" and that the platform is still vulnerable."
It's really saying something when the hackers are more responsible than the vendor. They have not yet leaked the contents of the hack except to journalists.
The thing that bothers me the most about this is that P3 (the company) knows that they've been hacked, and their systems are still up and vulnerable for other hackers.
The only correct response is to take down your system to remediate your vulnerabilities. Especially with data that's this sensitive.
Oh I missed this part. They kept **all the historical data**?!?!?! Over 25 years?!
“Crime Stoppers” is just a company, right? Should we be surprised that their unregulated IT practices are weak?
(I’m not sea lioning, more like “wryly asking as an opportunity to share some witty trashing of these bozos.”)
Install Fedizen
Get the full app experience
@mayintoronto While not as bad as exposing crime tips... to volunteer at TDSB schools, one has to get a "vulnerable sector check". To do that, you upload a picture of two pieces of ID to a service run by some company in Richmond Hill, and then I assume get the results off their server once done. I am taking absolutely no bets on their security arrangements.