FBI Palantir glitch allowed unauthorized access to private data

Re:FBI Palantir glitch allowed unauthorized access to privat... by jasonhoch on Thursday August 26, 2021 @12:44PM (#28317301)

Palantir responded in a statement to TheStreet.com: "There was no glitch in the software. Our platform has robust access and security controls. The customer also has rigorous protocols established to protect search warrant returns, which, in this case, the end user did not follow."

Source: https://www.thestreet.com/investing/palantir-shares-data-acc...

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by LeifCarrotson on Thursday August 26, 2021 @12:57PM (#28317473)

If you can gain unauthorized access by simply choosing not to follow a protocol that says you don't have access, there aren't really any access controls in the software at all.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by dewey on Thursday August 26, 2021 @01:05PM (#28317566)

It sounds more like the customer should set something to private but chose not to. Just like if you set your S3 bucket to public you wouldn't blame Amazon for not keeping your data private.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by eli on Thursday August 26, 2021 @01:42PM (#28318056)

It's better now, but Amazon absolutely deserves blame for historically making it extremely easy to accidentally make S3 buckets or files within buckets public.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by weird-eye-issue on Thursday August 26, 2021 @05:12PM (#28320837)

I might be in the minority but I never found the old UI to be confusing. Public buckets were never the default and it was pretty clear when you were making the change. It's good they are making it more dummy proof but I'm not sure it is fair to say they deserve blame

As a sidenote I actually find all the new warnings and stuff annoying (but I'm not saying it isn't worth it all things considered). As a developer I'm quite used to having to pay attention to details already - one typo can be disastrous and there might be no warning (you might say but that is what a proper CI process is for and testing but what if that typo is in the CI process or tests?)

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by pestaa on Thursday August 26, 2021 @03:13PM (#28319237)

Cutlery manufacturers absolutely deserve blame for historically making it extremely easy to accidentally cut your fingers with their knives.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by omegaworks on Thursday August 26, 2021 @04:18PM (#28320093)

If you sell cutlery without a handle and expect your end users to simply wrap it in a towel before using it maybe you should share some of the blame when your users hurt themselves.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by jsjohnst on Thursday August 26, 2021 @07:47PM (#28322509)

I agree that GP’s analogy didn’t fit, but neither does yours to what AWS did before.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by janto on Thursday August 26, 2021 @01:47PM (#28318120)

This looks more like a mess that would happen if S3 buckets by default were accessible to anyone with an Amazon account. Which would clearly be a colossal mistake made by the platform.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by MonkeyClub on Monday August 30, 2021 @02:22AM (#28353217)

You're right, it's neither Beretta's nor the NRA's fault if someone shoots someone.

Palantir just made the privacy shotgun, and FBI gave the bullets, but it's the user who pulled the trigger.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by TaupeRanger on Thursday August 26, 2021 @01:04PM (#28317550)

No - the FBI didn't use the access controls correctly, that's the point. If they were used correctly, the unauthorized access wouldn't have happened.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by addingnumbers on Thursday August 26, 2021 @01:51PM (#28318174)

They didn't use the controls at all. To Palantir, inaction or omission indicate there should be zero controls.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by nxpnsv on Thursday August 26, 2021 @01:42PM (#28318048)

This sounds a lot like "you're holding it wrong"...

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by 71a54xd on Thursday August 26, 2021 @07:04PM (#28322146)

For context: https://www.youtube.com/watch?v=t5n5KlXv0Vo

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by adolph on Thursday August 26, 2021 @03:54PM (#28319782)

Reference for the younguns:

https://youtu.be/b9eXYOA8TCk?t=117

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by ren_engineer on Thursday August 26, 2021 @05:50PM (#28321369)

sounds more like a feature than a bug, Palantir can blame the FBI, FBI can blame Palantir. FBI really just wants the ability to access data they want

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by qeternity on Thursday August 26, 2021 @01:51PM (#28318173)

What do you mean the vault was robbed? We put an "Authorized Personnel Only" sign out front.

[ Parent | on HN ]

Re:FBI Palantir glitch allowed unauthorized access to privat... by AtlasBarfed on Thursday August 26, 2021 @05:17PM (#28320922)

Built-in bypasses to protections of your freedoms and security theatre that allegedly protects them:

FUNCTIONING AS DESIGNED

Yeah, the headline of the article immediately brought to mind an IT system built by a data-hoovering oversight-averse FBI funded to self-develop a system to protect that data and enforce oversight would not... quite... close the loop.

[ Parent | on HN ]