The weakest link by far is Apple

Re:The weakest link by far is Apple by rmc on Tuesday August 07, 2012 @12:22PM (#4350790)

In the US, at least, regulated banks have some security requirements that might prevent this (though I'm not sure). But outside of that my guess is that it's routine for a customer service agent to be able to make any modification to an account they want, without an extra authentication factor or supervision.

The EU has data protection law, which means companies that store personal data are legally required to ensure it's safe. I wonder if Apple are in breech of the law here?

[ Parent | on HN ]

Re:The weakest link by far is Apple by sigkill on Wednesday August 08, 2012 @03:25AM (#4354370)

I'm not a lawyer, but technically the hacker didn't "hack" the computer systems. So I'd wager that you can't slap a data protection law. But on the other hand, they definitely are legally liable for even a social-engineered attack. Maybe they'll get hit with negligence?

[ Parent | on HN ]

Re:The weakest link by far is Apple by rmc on Wednesday August 08, 2012 @04:57AM (#4354591)

EU Data protection law is not about "data in the computer sense" but personal information. It's not related to computers per se at all. If someone can just ring up and ask for personal information, that would be against the law. If customers personal details are written up in walls on their public offices, that would probably be illegal aswell.

[ Parent | on HN ]