When did "there was a vulnerability" become "there was a breach" ? I don't under...

gandutraveler · on Oct 9, 2018

Google's official statement also doesn't rule out the possibility of a breach.

I think the bigger issue here us that Google did not report the vulnerability/breach when they discovered it. This could be looked into by SEC.

dangerface · on Oct 9, 2018

Because breaches come from public vulnerabilities, unless you can prove there was no breach, you should treat it as a breach. This is common information security practice.

Google are unable to prove there was no breach because they didn't keep sufficient logs, which is also not acceptable in modern security practice.

staticassertion · on Oct 9, 2018

> This is common information security practice.

No it isn't.

If every vulnerability in every product turned into a "We've been breached" disclosure the industry would be a disaster.

Yeah, they didn't keep sufficient logs and they fucked up really badly there. Still silly to call it a breach.

dangerface · on Oct 10, 2018

The industry is a disaster because companies don't disclose potential breaches.