Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turkish Citizenship Database Leaked

ibtimes.co.uk

Post reply on HN
Print view View original

121–130 of 286 posts

Re: Turkish Citizenship Database Leaked

#121

Post by karlshea »

thirdsun wrote: post #99
fvargas wrote: post #81

Earlier quoted context omitted.

The lazy way (which is still arguably better than answering truthfully) is to use the same answer for all the security questions. The better way is to treat each answer as another password and encrypt and store the answers somewhere safe.

Realistically how many people outside (or even inside) HN are going to do that? No matter how you spin it, security questions are a very bad "security pattern" in my opinion and we should get rid of them.

I do that, the security questions and answers just get added to the site's entry in 1Password.

Re: Turkish Citizenship Database Leaked

#122

Post by staticelf »

bemmu wrote: post #73
rhblake wrote: post #23

Earlier quoted context omitted.

The mentioned websites contain at least the full name, birthdate, registered address and marital status of every Swedish resident (at least above the age of ~16?), with the exception of a very small percentage of people with protected identity (which you can only get if you're under a "serious and concrete threat"). They get this data straight from the government - it's all public. Go to e.g. http://www.ratsit.se/ ,…

In Finland even salary and capital gains data is released. Newspapers compile high score lists from it each year. There might be some lower limit to how much you need to earn before your data becomes public. Here's some select tidbits from the data in English: http://yle.fi/uutiset/who_are_finlands_top_earners/8427787

That is true for the Swedish sites/system as well.

Re: Turkish Citizenship Database Leaked

#123

Post by staticelf »

dagw wrote: post #85
staticelf wrote: post #31

Earlier quoted context omitted.

That's not really true. Often you can order stuff from the internet with only knowing the SSN. You can order on invoice with Klarna for example. Of course, for things that really matter, you need an ID.

I thought Klarna would only allow invoicing if the delivery address matched the registered home address of the SSN owner.

I ordered some stuff yesterday and I only had to provide the SSN and it filled out the adress and everything. Then, I specified Klarna and the order was away.

Re: Turkish Citizenship Database Leaked

#125

Post by macintux »

AimHere wrote: post #120
fabulist wrote: post #29

Earlier quoted context omitted.

If you choose to sign up for facebook with real information, sure. You don't have much choice in the data your government loses about you.

You don't have much choice when your friends or relatives post about you on Facebook either, and there, lying to Facebook is out of your hands. Privacy isn't transactional, it's environmental.

I do not know, but strongly suspect, that my absence from Facebook means I'm rarely mentioned there. Certainly I'm mentioned less than if I had an account.

Even if I am mentioned there, Zuckerberg & friends don't have any account to cross-reference to target me with ads, etc.

So, my absence from Facebook is nonetheless a significant enhancement of my privacy.

Re: Turkish Citizenship Database Leaked

#127

Post by philipov »

JoeAltmaier wrote: post #119
iam-TJ wrote: post #117

Earlier quoted context omitted.

I 'time shift' each number in date of birth so neither the day, month, or year are correct. My secret key is the formula I use. For other questions I use answers that 'belong' to a friend or relative. My secret key is the formula for figuring out who that is.

I wonder how many 'bits' those secret keys have? Maybe one or two? E.g. how long to brute force those answers.

If it's only 2 bits, you're assuming the attacker already knows that the formula is "Using someone else's information" and that there are only 4 possible people whose information you would use.

Even knowing that you're using a formula is a bit of information. The type of formula is potentially thousands of bits of information. An attacker doesn't know whether it's a cipher, or a code, or something more complex, and only then can they begin figuring out the parameters to that formula.

Re: Turkish Citizenship Database Leaked

#128

Post by JoeAltmaier »

philipov wrote: post #127
JoeAltmaier wrote: post #119

Earlier quoted context omitted.

I wonder how many 'bits' those secret keys have? Maybe one or two? E.g. how long to brute force those answers.

If it's only 2 bits, you're assuming the attacker already knows that the formula is "Using someone else's information" and that there are only 4 possible people whose information you would use. Even knowing that you're using a formula is a bit of information. The type of formula is potentially thousands of bits of information. An attacker doesn't know whether it's a cipher, or a code, or something more complex, and o…

Pretty sure lots of people use relatives' info. Very, very few use ciphers in their head.

Friend used to have a car with a keycode door lock. He just used 5555 or whatever. I suggested he use the address where the car was parked, or some hash of that. Wouldn't have to remember it! And it would vary some at least.

Re: Turkish Citizenship Database Leaked

#129

Post by ttn »

TR citizen here, for the last 10 years only those who are really close to AKP got the government contracts including software like this etc. for stupid amounts of money with no know-how. Therefore this is absolutely normal -at least for us-, only thing that surprised me about this leak is this got into front page of HN.

Those software "companies" take millions of liras, usually for stupid CRUD stuff, develop it in like years and result is goddamn vulnerable, unaesthetic pieces of garbage.

I'm on that list as well. With that info, a terrorist can buy a SIM card for my name, use it to proxy-blow up a goddamn bomb aaaaand I'm in jail.

Re: Turkish Citizenship Database Leaked

#130

Post by sspiff »

supremeanger wrote: post #124

It doesnt seem too reasonable to compare a businessman to someone who supports terrorism and radical islam.

I wouldn't put it past Trump to encourage radical christian violence, whether that would be terrorism is in the eye of the beholder.

Erdohan certainly is using the situation to crack down on national opposition and get as many separatists killed while the rest of the world is focusing on the Syrian civil war and its exports of violence. That's simply realpolitik though, not ideology.

That said, the tone and message accompanying this leak is ridiculous.

Post reply on HN