News for hackers. Stuff that matters.

A comment on Security Breach Forces RSA to Offer to Replace SecurIDs. Parent comment

Re:Security Breach Forces RSA to Offer to Replace SecurIDs by RockyMcNuts on Tuesday June 07, 2011 @12:00AM (#2627855)
It's logistics, and also RSA to their eternal discredit did not recommend or pay for replacement. Those aren't cheap (like $50 apiece). If you're a CTO with 1000 users and rudimentary security knowledge, are you going to spend $50,000 and a bunch of time tracking down every single user (who will think it's all a terrible bore) and replace their token, if the company you rely on to keep you secure doesn't say it's necessary? I give credit to the people who didn't screw around, and switched vendors.
[ Parent | on HN ]
Re:Security Breach Forces RSA to Offer to Replace SecurIDs by trotsky on Tuesday June 07, 2011 @12:12AM (#2627888)
RSA to their eternal discredit did not recommend replacement

Is that just your assumption? I believe everyone who received guidance from RSA on the subject was asked to sign a non-disclosure, but I think some of them might be surprised to hear you say that.

[ Parent | on HN ]
Re:Security Breach Forces RSA to Offer to Replace SecurIDs by RockyMcNuts on Tuesday June 07, 2011 @09:16AM (#2628976)
as a small client and in touch with other small clients, no, very definitely NOT just an assumption.
[ Parent | on HN ]
Re:Security Breach Forces RSA to Offer to Replace SecurIDs by trotsky on Tuesday June 07, 2011 @07:54PM (#2631446)
Sounds like they didn't have enough in the supply chain in the short run and picked and choosed. ouch.
[ Parent | on HN ]