<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: dime]]></title>
    <link>http://securityratty.com/tag/dime</link>
    <description></description>
    <pubDate>Tue, 31 Jul 2007 10:19:04 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Two students access confidential Dominican University files]]></title>
      <link>http://securityratty.com/article/c911429366b51bc32cae40fcf5414be0</link>
      <guid>http://securityratty.com/article/c911429366b51bc32cae40fcf5414be0</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/8/08

Organization
Dominican University

Contractor/Consultant/Branch
None

Victims
Students

Number Affected
5,215

Types of Data
names, addresses,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/dominican.jpg" align="right" height="68" width="199"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/8/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.dom.edu/">Dominican University</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Students<br><br><span style="font-weight: bold;">Number Affected:</span><br>5,215<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, phone numbers, birthdays and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"CHICAGO -- Some Dominican University students and alumni were notified this week of a breach in security that could have put their personal information at risk.&nbsp; The university said two students were able to access records on a staff network storage area in April. The files were three spreadsheets from 2003, 2005 and 2007."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.nbc5.com/news/16205384/detail.html">WMAQ NBC Channel 5 News</a> <br><a href="http://www.pioneerlocal.com/riverforest/news/948729,RF-Security-051408-sl.article">RiverForest-Leaves</a> <br><a href="http://www.dom.edu/security/">Dominican University</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Dominican University<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Dominican University takes information security very seriously. In April, we discovered that two student workers had accessed Excel files containing limited student data by misusing passwords related to their work-study employment.<br><br>Two computer science sophomores who had password access through their work-study employment discovered three Excel files, containing a total of 5,215 student records.<br><br>These files were in an unsecure location that was to be accessible only to specific staff members.<br><span style="font-style: italic;">[Evan] Is this password misuse or just poorly secured files and poor security?&nbsp; The confidential files were stored in an unsecure location that was supposed to be accessible by specific staff.&nbsp; Does this make any sense to you?</span><br><br>One of the students came forward earlier this month with the information that they had accessed files that were to be available to staff only. The students then disclosed the full extent of their access to the exposed data and demonstrated to the administration how the access occurred.<br><span style="font-style: italic;">[Evan] I wonder if the school would have ever found out if the student didn't come forward.&nbsp; My guess is not.</span><br><br>We notified all affected parties in writing, set up a toll-free hotline, and have worked closely with both the local police and states attorney’s offices.<br><br>A letter was sent to all affected students and alumni on April 18 when the extent of the exposure could be determined.<br><br>The students went through a full university judicial process, were suspended temporarily and have been barred from future campus employment, among other sanctions.<br><br>The students are expected to return to classes next fall "under a lot of supervision, as you'd expect,"<br><span style="font-style: italic;">[Evan] I don't know.&nbsp; There are probably students doing worse things on campus that probably need a lot more supervision than these two.&nbsp; Judging only by what I have read, these students seem to have been pretty honest.&nbsp; They came forward, they cooperated with the investigation and even demonstrated what they did.&nbsp; </span><br><br>The university is conducting a complete security audit and internal review.<br><span style="font-style: italic;">[Evan] This should be done a regular basis anyway.&nbsp; All good information security programs conduct regular audits, assessments and reviews.</span><br><br>Dominican has conducted a complete internal security audit and has hired an external consultant to review all security processes.<br><span style="font-style: italic;">[Evan] I endorse the school's decision to enlist a third-party consultant, assuming that the consultant is good at what they do.&nbsp; The last statement contained the word "conducting", this statement contains "conducted".</span><br><br>At this time we have no reason to believe that any information has been misused, but retain the right to prosecute as necessary.<br><br>"Steps have been taken to make something like this more difficult to do in the future. We've significantly tightened security,"<br><span style="font-style: italic;">[Evan] If I had a dime for every time I heard this, I could retire very comfortably. If there are no details or facts to support statements like this, they don't mean much to me</span><br><br>If I have more questions, who should I call? You can call our toll-free number: (877) 387-8310.<br><br><span style="font-weight: bold;">Student Reaction:</span><br>"I was a little upset. I was nervous. I didn't know what to do. I knew that our family's been affected by this before, so I wanted to react right away,"<br><br>"I think that's crazy, because ... people can get your information, know things about you (and) you can't do anything about it,"<br><br>"Someone actually just charged on my debit card something. (It was) unrelated to this, I think, but it freaks me out every day now,"<br><span style="font-style: italic;">[Evan] This student didn't just buy some </span><a style="font-style: italic;" href="http://breachblog.com/2008/05/07/adobe.aspx">Adobe</a><span style="font-style: italic;"> education version software, did he/she?</span><br><br><span style="font-weight: bold;">Commentary:</span><br>I'm not sure if I am reading this right or not, but it seems almost like these students stumbled upon the confidential files and informed officials of their findings.&nbsp; I don't sense an dishonesty on their part.&nbsp; I could be wrong, but it also seems like the school didn't (and maybe still doesn't) properly secure confidential information.&nbsp; The statement about a secure file in an unsecured location is puzzling.<br><br>If assumptions are correct, then it may be ill-advised to sanction these students.&nbsp; Does anyone else see this the same way, or would you say that I am off base here?<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/14/dominican.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 14 May 2008 18:40:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/dominican university">dominican university</category>
      <category domain="http://securityratty.com/tag/dominican university students">dominican university students</category>
      <category domain="http://securityratty.com/tag/dominican">dominican</category>
      <category domain="http://securityratty.com/tag/students">students</category>
      <category domain="http://securityratty.com/tag/files">files</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security processes">security processes</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <source url="http://breachblog.com/2008/05/14/dominican.aspx">Two students access confidential Dominican University files</source>
    </item>
    <item>
      <title><![CDATA[EarthLink Will Shutter Philadelphia Network, Company Says]]></title>
      <link>http://securityratty.com/article/5a938e0c429c5b2b2511d2b537800149</link>
      <guid>http://securityratty.com/article/5a938e0c429c5b2b2511d2b537800149</guid>
      <description><![CDATA[It's the end of the cycle, folks: The first shall be last and the last shall, apparently, be first to sue. The Philadelphia Wi-Fi network will be shuttered under plans by EarthLink that they announced...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://news.yahoo.com/s/ap/20080513/ap_on_hi_te/wireless_philadelphia_2"><strong>It's the end of the cycle, folks:</strong></a> The first shall be last and the last shall, apparently, be first to sue. The Philadelphia Wi-Fi network will be shuttered under plans by EarthLink that they announced via <a href="http://ir.earthlink.net/releasedetail.cfm?ReleaseID=310055"><strong>press release today</strong></a>. </p>

<p>The company plans to pull all its gear from the poles starting 12-June-2008. The company's press release said it offered to give the network at no cost to an unnamed non-profit, as well as to the city, but claimed that "unresolved issues" led to the effort falling apart. EarthLink offered cash and more equipment, as well, in undisclosed quantities. Wireless Philadelphia, the non-profit in charge of managing the network provider and administering digital divide programs, was apparently not the non-profit mentioned. </p>

<p>EarthLink filed a lawsuit to allow it to remove its Wi-Fi nodes and cap its liability at $1m. That's a pretty hostile move, given that the city would have been the more likely party to feel aggrieved and file suit against EarthLink for failing to live up to the terms of their agreement.</p>

<p>EarthLink's claims of offering the network to "a non-profit" or the city for free skirts the issue that EarthLink may have certain liabilities for electrical power and other fees that haven't yet been paid; Wireless Philadelphia had agreed to pick up or defer certain charges as part of the deal that brought the network provider in. But without a completed network, and the contract therefore perhaps susceptible to being declared in default in court, it's unlikely that this will play out nicely.</p>

<p>And I'll say bluntly: If someone offered you $17m of outdated equipment on a network that never worked to specification that wasn't completed, and that already had known high annual costs, and which a private firm gave up as a bad job that they couldn't turn a dime on--would you take that deal? No. EarthLink will ultimately have to pay much more than $1m, I predict, and I suspect some of the settlement will leave gear in selected neighborhoods behind for more modest networking purposes. It's not going to be as easy as releasing a press release, although I haven't read the contract's provisions for this set of circumstances, and I'm not a lawyer.</p>

<p>The failure in Philadelphia, and EarthLink's exiting the entire muni-Fi business, represents the end of a bad model in which a company agreed to assume all risk and costs associated with building a public access network. When the assumptions were that networks would be cheaper and easier to build in 2005, and that citizens in many larger cities had few affordable broadband options, it made some sense to build a network on spec.</p>

<p>Three years into this, however, it's clear that that capital investment is 2 to 3 times higher than what was anticipated to reach a level of service quality that people will expect; that, when presented with potential competition, DSL and cable operators will slash prices and offer cheap 1-year or "lifetime" rates with long-term contracts; and that wireless broadband delivered via Wi-Fi isn't the best of ideas for indoor service.</p>

<p>Minneapolis may wind up being the only large city, if the network quality and subscriber rates play out, that has a public access network that works and produces a return. </p>]]></content:encoded>
      <pubDate>Tue, 13 May 2008 05:48:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/philadelphia wi-fi network">philadelphia wi-fi network</category>
      <category domain="http://securityratty.com/tag/earthlink">earthlink</category>
      <category domain="http://securityratty.com/tag/network provider">network provider</category>
      <category domain="http://securityratty.com/tag/philadelphia">philadelphia</category>
      <category domain="http://securityratty.com/tag/public access network">public access network</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/earthlink filed">earthlink filed</category>
      <source url="http://wifinetnews.com/archives/008316.html">EarthLink Will Shutter Philadelphia Network, Company Says</source>
    </item>
    <item>
      <title><![CDATA[Just a reminder the free ride is coming to a end.]]></title>
      <link>http://securityratty.com/article/e12cf955e17395674b7974753976b300</link>
      <guid>http://securityratty.com/article/e12cf955e17395674b7974753976b300</guid>
      <description><![CDATA[I posted a remark previously about this. You are responsible for your actions. Banks are refusing to pay up if you dont take steps to protect yourself


clipped from www.techconsumer.com
Web Safety...]]></description>
      <content:encoded><![CDATA[<div > I posted a remark previously about this.<br/>You are responsible for your actions.<br/>Banks are refusing to pay up if you dont take steps to protect yourself. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/64161F21-8B25-4BE3-BAE9-8AF54F03C811/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/5f330431-4944-4c79-a7a3-a903fa60ace3/64161F21-8B25-4BE3-BAE9-8AF54F03C811/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.techconsumer.com/2008/04/18/web-safeness-and-mutation-of-crime-on-the-internet/" href="http://www.techconsumer.com/2008/04/18/web-safeness-and-mutation-of-crime-on-the-internet/" style="font-size: 11px;">www.techconsumer.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.techconsumer.com/2008/04/18/web-safeness-and-mutation-of-crime-on-the-internet/ --><H2><A title="Permanent Link: Web Safety and Crime on the Internet" rel="bookmark" href="http://www.techconsumer.com/2008/04/18/web-safeness-and-mutation-of-crime-on-the-internet/">Web Safety and Crime on the Internet</A></H2></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.techconsumer.com/2008/04/18/web-safeness-and-mutation-of-crime-on-the-internet/ --><P><A href="http://www.techconsumer.com/wp-content/uploads/2008/04/cybercrime.jpg"><IMG width="160" height="122" alt="cybercrime" src="http://www.techconsumer.com/wp-content/uploads/2008/04/cybercrime.jpg" title="cybercrime" class="alignleft size-full wp-image-856" /></A>The <A target="_blank" href="http://www.theregister.co.uk/2008/04/04/banking_code_2008/" title="News on Cybercrime">latest news</A> from United Kingdom’s major retail bankers says that if your online bank account has been compromised and you didn’t use any Internet computer security software such as antivirus and antispyware (e.g. <A target="_blank" href="http://www.amazon.com/Norton-All-Security-Annual-Subscription/dp/B000NA780M/ref=pd_bbs_sr_1?ie=UTF8&#038;s=software&#038;qid=1208533585&#038;sr=8-1&#038;tag=computersnet-20" title="Norton 360 via Amazon">Norton 360</A>), you solely bear the responsibility for the loss, and they won’t compensate you a dime. A clause has been added to the newly updated Banking Code to make this very clear.</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/64161F21-8B25-4BE3-BAE9-8AF54F03C811/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Sat, 19 Apr 2008 11:43:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/online bank account">online bank account</category>
      <category domain="http://securityratty.com/tag/web safety">web safety</category>
      <category domain="http://securityratty.com/tag/remark previously">remark previously</category>
      <category domain="http://securityratty.com/tag/solely bear">solely bear</category>
      <category domain="http://securityratty.com/tag/steps">steps</category>
      <category domain="http://securityratty.com/tag/actions">actions</category>
      <category domain="http://securityratty.com/tag/responsibility">responsibility</category>
      <category domain="http://securityratty.com/tag/antispyware">antispyware</category>
      <category domain="http://securityratty.com/tag/crime">crime</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=434">Just a reminder the free ride is coming to a end.</source>
    </item>
    <item>
      <title><![CDATA[King of Spam pleads guilty; faces 26 years in prison]]></title>
      <link>http://securityratty.com/article/03d90cd00a1206a8ad69f0dce84d5fbb</link>
      <guid>http://securityratty.com/article/03d90cd00a1206a8ad69f0dce84d5fbb</guid>
      <description><![CDATA[The spammer who notoriously bragged that he'd never paid a dime despite multiple rulings against him will be paying society back in years of his life instead. Robert Soloway is facing both a jail...]]></description>
      <content:encoded><![CDATA[The spammer who notoriously bragged that he'd never paid a dime despite multiple rulings against him will be paying society back in years of his life instead. Robert Soloway is facing both a jail sentence and quality time with electrodes strapped to his body.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=6deQbl"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=6deQbl" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/251859316" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 15 Mar 2008 07:25:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/quality time">quality time</category>
      <category domain="http://securityratty.com/tag/robert soloway">robert soloway</category>
      <category domain="http://securityratty.com/tag/multiple rulings">multiple rulings</category>
      <category domain="http://securityratty.com/tag/jail sentence">jail sentence</category>
      <category domain="http://securityratty.com/tag/spammer">spammer</category>
      <category domain="http://securityratty.com/tag/electrodes">electrodes</category>
      <category domain="http://securityratty.com/tag/notoriously">notoriously</category>
      <category domain="http://securityratty.com/tag/body">body</category>
      <category domain="http://securityratty.com/tag/dime">dime</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/251859316/article.do">King of Spam pleads guilty; faces 26 years in prison</source>
    </item>
    <item>
      <title><![CDATA[Wellesley seniors' personal information lost in mail]]></title>
      <link>http://securityratty.com/article/627004f928ad4ee68c7d214478af554b</link>
      <guid>http://securityratty.com/article/627004f928ad4ee68c7d214478af554b</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
2/29/08

Organization
Town of Wellesley, Massachusetts

Contractor/Consultant/Branch
Wellesley Health Department

Victims
Certain town residents who...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wellesley.jpg" align="right" height="56" width="198"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>2/29/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.ci.wellesley.ma.us/Pages/index">Town of Wellesley, Massachusetts</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ci.wellesley.ma.us/Pages/WellesleyMA_Health/index">Wellesley Health Department</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Certain town residents who received flu shots, all over the age of 65<br><br><span style="font-weight: bold;">Number Affected:</span><br>480<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, dates of birth, addresses, and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>An envelope containing sensitive personal information belonging to seniors was sent from the Wellesley Health Department to a Medicare processing office in Charlestown.&nbsp; When the envelope arrived it was missing the list of information.&nbsp; The U.S. Postal Inspection Service and local police are investigating.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.boston.com/news/local/articles/2008/02/29/mailed_flu_shot_list_lost_probe_on/">The Boston Globe</a> <br><a href="http://www.thebostonchannel.com/news/15446459/detail.html">WCVB-TV Channel 5</a> <br><a href="http://www.bostonherald.com/news/regional/general/view.bg?articleid=1076819&amp;srvc=rss">The Boston Herald</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WCVB-TV Channel 5 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>NewsCenter 5's Steve Lacy reported that the seniors got the flu shots last fall and then, last week, the town sent an envelope with all their personal information, including names, ages, addresses and Social Security numbers to Medicare as part of the reimbursement process.<br><br>All those listed were age 65 or older.<br><span style="font-style: italic;">[Evan] Wonderful.&nbsp; Seniors are typically the easiest targets with much to lose.</span><br><br>The roster was mailed Feb. 21 by the town to Medicare for reimbursement.<br><br>The envelope arrived but was missing the list of names<br><br>Wellesley police were notified and launched an investigation, as has the U.S. Postal Inspection Service.<br><br>The sealed envelope was reportedly hand-delivered to the post office for mailing, which reduces the chances the information was stolen.<br><span style="font-style: italic;">[Evan] This does not reduce the risk to a point that would be acceptable to me.&nbsp; Hand delivering the envelope to the post office eliminates one opportunity (maybe two) for loss, and that is between the Health Department office and the post office.&nbsp; It does not take into account theft or loss at the post office, between post offices, between the destination post office and the Medicare processing office, or within the Medicare processing office.&nbsp; Not to mention data destruction procedures once the information has been entered into the systems.&nbsp; In my opinion, this is a poor attempt at minimizing the situation.</span><br><br>The Postal Service is trying to determine whether theft or mechanical failure was to blame.<br><br>"There would be no reason why we would have questioned or hesitated using the US Postal Service to do this," Cohen said of the department's choice to send personal information through the mail. "We've been doing it for years this way. And I suspect most providers do it this way.", Shepard Cohen, chairman of the Board of Health in Wellesley<br><span style="font-style: italic;">[Evan] Really?&nbsp; Do you think it's OK to send personal information including Social Security numbers in the mail nowadays?&nbsp; This is a fantastic opportunity for identity thieves.&nbsp; If I had a dime for every time I've heard "We've been doing it for years this way", I would be a rich man.&nbsp; Times change, people change, technology changes, an ______ changes (fill in the blank).&nbsp; Don't you think processes should change too?</span><br><br>One possible sign of ID theft is if consumers fail to receive bills, because thieves sometimes change mailing addresses to cover their tracks. Another is if consumers receive credit cards they did not apply for or if they are suddenly denied credit. Also, if consumers receive telephone calls about items they have not purchased.<br><br>The town said it will be mailing letters to anyone effected by early next week.<br><br><span style="font-weight: bold;">Commentary:</span><br>I wish that Mr. Cohen was wrong when he stated "I suspect most providers do it this way", but I would be fooling myself if I thought it weren't true.&nbsp; Most providers probably do follow similar processes that put confidential information at risk.&nbsp; Confidential information is money in the right (or wrong) hands.<br><br>Possible solutions...<br>Don't use Social Security numbers as identifiers (probably a lot of work!).<br>Send the information on an encrypted CD.<br>Send the information through a VPN<br>______ (add your own). <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/02/29/wellesley.asp" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 29 Feb 2008 08:48:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/destination post office">destination post office</category>
      <category domain="http://securityratty.com/tag/office">office</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/health department office">health department office</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/wellesley">wellesley</category>
      <category domain="http://securityratty.com/tag/health">health</category>
      <category domain="http://securityratty.com/tag/post office">post office</category>
      <source url="http://breachblog.com/2008/02/29/wellesley.aspx">Wellesley seniors' personal information lost in mail</source>
    </item>
    <item>
      <title><![CDATA[Afilias and GoDaddy Want to Rule .US]]></title>
      <link>http://securityratty.com/article/491432e124503e0baa1b4967d45aae15</link>
      <guid>http://securityratty.com/article/491432e124503e0baa1b4967d45aae15</guid>
      <description><![CDATA[As I described in a recent column, the contract for the .US domain registry is up and may be redesignated by the Department of Commerce . The quotes were due by Monday of this week
Afilias and...]]></description>
      <content:encoded><![CDATA[<p>As I described in a recent column, <a target="_blank" href="http://www.eweek.com/article2/0,1895,2162517,00.asp">the contract for the .US domain registry is up and may be redesignated by the Department of Commerce</a>. The quotes were due by Monday of this week.

<p>Afilias and GoDaddy.com announced that <a target="_blank" href="http://www.afilias.com/news/press_releases/pr_articles/2007-07-31-01">they have formed a partnership that has bid to run the registry.</a> 

<p>It's an interesting prospect. .US has badly underperformed, largely (I think) due to a lack of marketing and clout behind it. The alliance is called <a href=http://www.dnalliance.us/pages/ustld/ target="_blank">the DNAR (Domain Name Alliance Registry).</a>

<p>This would certainly change with GoDaddy, which is a massive hosting service with an interest in pushing customers to buy .US domains. The press release implies that they would lower the .US registry fee. It's been widely reported that, back when the .COM registry contract was being renegotiated, GoDaddy offered to run it with a $2 registry fee. Currently it's $6 and is scheduled to go up on a regular basis. 

<p>A cheap .US name space would provide a huge new up sell possibility for GoDaddy to its existing customers. Owning the .US versions of your .COM domains would suddenly cost much less.

<pOn the other hand, we're talking about the U.S. government here, and they are given some conservative goals as part of their agenda for .US. 

<p>The DNAR addresses this head on in its press release: "Alliance Registry proposes a plan to revitalize the kids.us domain by: 1) streamlining the registration process; 2) attracting more sites and content (kids.us only has just 19 live sites now) to generate more usage by kids; and 3) strengthening the operational security of kids.us content monitoring."

<p>But will they buy into GoDaddy running this domain? The company hasn't exactly pursued an image in its marketing that would endear it to the administration or, for that matter, any administration likely to come into office. Yah, they love kids. Don't we all? GoDaddy has had <a target="_blank" href="http://www.eweek.com/article2/0,1895,2093763,00.asp">other problems</a>, but their real problem here is image.

<p>GoDaddy's bad-boy dirty image has always rubbed me the wrong way and I really doubt it gets them a dime of business they wouldn't otherwise get. It would be good for .US to have a company as big and aggressive as GoDaddy running it. 

<p>But I think a more boring company will get the contract.<img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/139309360" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 31 Jul 2007 10:19:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/alliance registry">alliance registry</category>
      <category domain="http://securityratty.com/tag/registry">registry</category>
      <category domain="http://securityratty.com/tag/alliance registry proposes">alliance registry proposes</category>
      <category domain="http://securityratty.com/tag/godaddy">godaddy</category>
      <category domain="http://securityratty.com/tag/registry contract">registry contract</category>
      <category domain="http://securityratty.com/tag/registry fee">registry fee</category>
      <category domain="http://securityratty.com/tag/alliance">alliance</category>
      <category domain="http://securityratty.com/tag/domain registry">domain registry</category>
      <category domain="http://securityratty.com/tag/love kids">love kids</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/139309360/afilias_and_godaddy_want_to_rule_us_1.html">Afilias and GoDaddy Want to Rule .US</source>
    </item>
  </channel>
</rss>
