A friend of mine in the Philippines, a security researcher himself, said to me that "the breach itself isn't really serious -- it's the candidate the breach favors thats the bigger controversy"
Can you please elaborate on what you mean?
Fake votes.
Understanding the ginormous Philippines data breach
11–20 of 93 posts
Re: Understanding the ginormous Philippines data breach
#12A friend of mine in the Philippines, a security researcher himself, said to me that "the breach itself isn't really serious -- it's the candidate the breach favors thats the bigger controversy"
There is a fear of mass cheating in the presidential election. 1) survey results published in national TV have a wide margin difference with the results in poll using social media(fb, tweeter) 2) At first comelec don't want to print vote count recipient of voting machine with the alibi that it will make the polling period goes longer. 3) No 3rd party source code review.
Re: Understanding the ginormous Philippines data breach
#13Although this is a lot of data on each person. Each individual field doesn't seem too sensitive on its own.
Electoral enrollment status and place you live is usually public information. It should be to prevent vote fraud.
Without other ID, you give your passport details to every company that uses it for ID, every airline, even the bouncer at a bar. When you're travelling and don't have the local ID, you use it to get a sim card, bus pass, just about everything. It's not really secret.
As for the biometric data, what use would a malicious actor make of that? They can't impersonate you because authentication shouldn't be done with only reproducible biometric data. They could identify you if you're physically touching them, but then they can already see you in person.
Mother's middle name according to the article can usually be predicted by her parents names. Family history and names is also public data. Just ask the Mormon church which hoards it.
Re: Understanding the ginormous Philippines data breach
#14Wonder how well hashed that FINGER_INFO is? Any chance to reverse engineer a fingerprint that would give the same hash? That would be awesome, but not in a good way. A false passport including working biometrics. Implementing a new hash would require what before adequate coverage, 15 years? You cannot easily imagine blocking a whole country's access to international travel because of a data leak.
Re: Understanding the ginormous Philippines data breach
#15> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…
Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...
You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
Re: Understanding the ginormous Philippines data breach
#16> somehow, last week’s news that 55 million Filipino voters’ data was now out in the wild went largely unnoticed
> ...
> There’s voting history against names (it appears to just be dates rather than the candidate voted for).
So, the data leaked was voter registration info. Actual votes were not in this database.
Other headlines would lead a reader to believe actual votes were leaked. For example, "Megabreach: 55 MILLION voters' details leaked in Philippines". Leaking votes alongside emails would be far more injurious than email addresses and family names.
Re: Understanding the ginormous Philippines data breach
#17Earlier quoted context omitted.
Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...
You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
Unfortunately, that's not how governments around the world require it right now. Estonia for its e-citizenship program, as well as pretty much all countries requiring a fingerprint for passports store the fingerprints in their own centralized database (that also get shared with other nations).
I switched my phone fingerprint to another finger for my phone as soon as I signed-up for a passport.
Re: Understanding the ginormous Philippines data breach
#18Earlier quoted context omitted.
You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
Unfortunately, that's not how governments around the world require it right now. Estonia for its e-citizenship program, as well as pretty much all countries requiring a fingerprint for passports store the fingerprints in their own centralized database (that also get shared with other nations). I switched my phone fingerprint to another finger for my phone as soon as I signed-up for a passport.
Wow.
So a piece of plastic the bank gives you with mostly arbitrary numbers on it is better protected than your own fingerprints, which you're stuck with for life?
Good grief.
Re: Understanding the ginormous Philippines data breach
#19Earlier quoted context omitted.
Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...
You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
However, Fingerprints cannot be practically hashed.
Re: Understanding the ginormous Philippines data breach
#20> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…
> Once it leaks
Leaking? Why do you need a leak? Just follow somebody and wait until he touches something, preferably a glass in a pub or something similar.