Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

[Kathleen Moriarty <[e-mail]>]

Sent from my iPhone

> On Jan 7, 2015, at 9:52 PM, "Martin J. Dürst" <[e-mail]> wrote:
> 
>> On 2015/01/06 22:47, Kathleen Moriarty wrote:
>> 
>> The other item was on LinkedIn and I think we are ok now on the text
>> change, is that right?  To see if I can help, I do agree with Stephen
>> here and hope the updated text is enough to move forward on this one
>> (it seems to be the case).  If the LinkedIn attack is mentioned, most
>> know that it was a large scale attack against the passwords stored on
>> the server side.  For what it's worth, just the mention of an attack
>> is not necessarily bad press.  Most look at how a company handled an
>> attack and the aftermath now rather than the fact that one happened.
>> Sometimes it is positive and most of the time it turns out to positive
>> for companies (even TJ Max had an increase in sales after their breach
>> that involved compromised Point of Sale systems).
> 
> This almost sounds as if making sure you get hit once in a while and your user's data gets stolen is a good thing :-(.

Martin,

What I typed was to help with an explanation, not actual text to be used in a draft.  It was an example (that can be backed up with data) to say it's not uncommon or looked at poorly to name companies when referring to specific attack types.  How they respond is important and I did not say anything about repeated attacks, that or severity can have an effect on a business, but really would have been getting too far off the point of whether or not it's okay to name LinkedIn.

Best regards,
Kathleen 

> 
> I seriously hope that's not the case.
> 
> Regards,   Martin.