News for hackers. Stuff that matters.

A comment on Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA. Parent comment

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by orlp on Wednesday March 30, 2022 @05:15PM (#30860863)
This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent. You need to say no every single time (with potentially shifting interfaces). Similarly if I remember correctly WhatsApp would repeatedly ask you to accept the new terms of service with pop-ups until you one day accidentally mis-click on the consent button. I honestly don't understand how that would count for anything, legally speaking. But don't expect much help from the legal system here - think of how often we have said no to EARN IT, yet it keeps coming back. One slip though and you're stuck with it.
[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by pilsetnieks on Wednesday March 30, 2022 @07:06PM (#30861962)
Just like the IRA said to Thatcher: "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by ornornor on Thursday March 31, 2022 @02:44AM (#30864480)
Whatsapp also helpfully nags you constantly to enable notifications if they’re disabled and to enable (unencrypted) backups to the cloud.
[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by lupire on Thursday March 31, 2022 @08:19AM (#30866330)
This is illegal under GDPR, but enforcement is currently overwhelmed with violators.
[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by vba616 on Wednesday March 30, 2022 @09:09PM (#30862746)
>This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent

They're perfectly entitled to track you as long as you don't opt out.

And when you opt out, they can't be held responsible for remembering it for even an instant, because they can't identify you.

"That's some catch, that Catch-22"

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by brendoelfrendo on Wednesday March 30, 2022 @09:13PM (#30862777)
Yeah, one website I visited recently helpfully showed me the cookies that it would save if I accepted their cookie agreement. The first one on the list was the cookie to remember my response to their cookie agreement.
[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by distances on Thursday March 31, 2022 @03:23AM (#30864705)
This also makes the cookie prompts a pain for users who don't use cookies. My browser rejects all cookies by default, so I end up creating uBlock filter rules for the prompts on sites I frequently visit.
[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by orlp on Thursday March 31, 2022 @04:21AM (#30865000)
> They're perfectly entitled to track you as long as you don't opt out.

This is false, GDPR is opt-in.

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by vba616 on Thursday March 31, 2022 @09:14PM (#30874156)
Irrelephant.

Since you didn't opt in, you haven't allowed them to track you, and they can't remember that you didn't opt in without tracking you.

See?

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by solarkraft on Thursday March 31, 2022 @10:14AM (#30867435)
> They're perfectly entitled to track you as long as you don't opt out.

Um ... huh? GDPR requires explicit consent.

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by jbverschoor on Wednesday March 30, 2022 @05:59PM (#30861341)
Yeah I also accident accepted the WhatsApp terms after months of periodically denying, and I feel raped.

Airtable did something similar recently with the grandfathered free accounts

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by jbverschoor on Thursday March 31, 2022 @04:39AM (#30865090)
Thank you for downvoting me, airtable marketing crew lol
[ Parent | on HN ]