Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Understanding the ginormous Philippines data breach

troyhunt.com

Post reply on HN
Print view View original

21–30 of 93 posts

Re: Understanding the ginormous Philippines data breach

#21

Post by jessaustin »

DanielBMarkham wrote: post #15
speeder wrote: post #10

Earlier quoted context omitted.

Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...

You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)

Just use them as a hash lookup into a keystore.

This is intuitively appealing, but do biometrics really boil down to an exact number that we could hash like this? (Genuine questions; I don't know.) It seems more likely to me that biometric measurements would be considered to "match" when they're within particular tolerances. This is an operation you can perform on the original measurements, but not on hashes of those.

Re: Understanding the ginormous Philippines data breach

#22

Post by arviewer »

mtgx wrote: post #17
DanielBMarkham wrote: post #15

Earlier quoted context omitted.

You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)

Unfortunately, that's not how governments around the world require it right now. Estonia for its e-citizenship program, as well as pretty much all countries requiring a fingerprint for passports store the fingerprints in their own centralized database (that also get shared with other nations). I switched my phone fingerprint to another finger for my phone as soon as I signed-up for a passport.

In the Netherlands we had a passport with fingerprint, and all data stored by the state. Luckily, this was reversed, and now the fingerprint is only stored in the passport itself. Well, that's what I hope, as the fingerprint needs to be stored temporarily for the time to create the passport.

Better, if you don't leave the EU, you can use an identity card that doesn't have the fingerprint.

I was lucky enough to have an old passport that just spanned the period in which the fingerprint was stored centrally. Now I have an ID card, but one time in the future I will leave the EU, and then I have to get a password...

Re: Understanding the ginormous Philippines data breach

#23

Post by jessaustin »

wjnc wrote: post #14

Wonder how well hashed that FINGER_INFO is? Any chance to reverse engineer a fingerprint that would give the same hash? That would be awesome, but not in a good way. A false passport including working biometrics. Implementing a new hash would require what before adequate coverage, 15 years? You cannot easily imagine blocking a whole country's access to international travel because of a data leak.

You especially couldn't block the Philippines for that reason. Many other nations would cease to operate completely without Filipino labor.

Re: Understanding the ginormous Philippines data breach

#24

Post by arviewer »

wjnc wrote: post #14

Wonder how well hashed that FINGER_INFO is? Any chance to reverse engineer a fingerprint that would give the same hash? That would be awesome, but not in a good way. A false passport including working biometrics. Implementing a new hash would require what before adequate coverage, 15 years? You cannot easily imagine blocking a whole country's access to international travel because of a data leak.

> You cannot easily imagine blocking a whole country's access to international travel because of a data leak.

You cannot do that, not because of the problems for those people, but because it would break trust in the system. It would become apparent how unsafe it is to keep fingerprints stored digitally in a central database. That would be a bigger problem, worldwide. People would demand to get rid of these databases, and I bet many intelligence services would not like that.

Re: Understanding the ginormous Philippines data breach

#25

Post by elros »

speeder wrote: post #10
luso_brazilian wrote: post #2

> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…

Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...

Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now?

Here's a list of documents you need to provide fingerprints, off the top of my head:

– National identity card (RG), mandatory for all citizens over 18 years of age;

– Military conscription certificate (CAM), mandatory for all male citizens over 18 years of age;

– Voting card (Título de Eleitor), mandatory for all citizens between 18 and 65 years of age, encouraged for all citizens over 16;

– Employment record book (Carteira de Trabalho), mandatory for any formal employment;

– Passports

Also, as of at least three years ago in the state of Rio de Janeiro, some of these were already computerized.

Re: Understanding the ginormous Philippines data breach

#26

Post by speeder »

elros wrote: post #25
speeder wrote: post #10

Earlier quoted context omitted.

Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...

Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? Here's a list of documents you need to provide fingerprints, off the top of my head: – National identity card (RG), mandatory for all citizens over 18 years of age; – Military conscription certificate (CAM), mandatory for all male citizens over 18 years of age; – V…

In my state these were all just printed on the document (at least last time I had to make documents).

You cannot "hack" a piece of paper easily...

But with mandatory vote + mandatory fingerprint to vote, you just turn that database in a giant juicy target, an attacker can be sure that all voters will have fingerprints there.

Re: Understanding the ginormous Philippines data breach

#27

Post by K0nserv »

luso_brazilian wrote: post #2

> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…

The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password.

I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security.

0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...

Re: Understanding the ginormous Philippines data breach

#28

Post by taejo »

jessaustin wrote: post #21
DanielBMarkham wrote: post #15

Earlier quoted context omitted.

You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)

Just use them as a hash lookup into a keystore. This is intuitively appealing, but do biometrics really boil down to an exact number that we could hash like this? (Genuine questions; I don't know.) It seems more likely to me that biometric measurements would be considered to "match" when they're within particular tolerances. This is an operation you can perform on the original measurements, but not on hashes of those…

There is a cryptographic tool called a "fuzzy extractor" that solves this problem (c.f. Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data, by Dodis, Reyzen and Smith [0]). At enrollment time, you compute some (non-sensitive) data P = Enroll(biometric). Then every time you compute Recover(P, biometric') you will get the same (high-entropy) output, as long as biometric' is close enough to biometric.

[0] https://www.iacr.org/archive/eurocrypt2004/30270518/DRS-ec20...

Re: Understanding the ginormous Philippines data breach

#29

Post by Jarwain »

yoodenvranx wrote: post #20
luso_brazilian wrote: post #2

> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…

> Once it leaks Leaking? Why do you need a leak? Just follow somebody and wait until he touches something, preferably a glass in a pub or something similar.

One requires targeting a specific individual, but you have a specific goal in mind for those prints. The other involves obtaining several people's fingerprint data. From there, you can figure out what you can actually do with said data

Re: Understanding the ginormous Philippines data breach

#30

Post by yoodenvranx »

Jarwain wrote: post #29
yoodenvranx wrote: post #20

Earlier quoted context omitted.

> Once it leaks Leaking? Why do you need a leak? Just follow somebody and wait until he touches something, preferably a glass in a pub or something similar.

One requires targeting a specific individual, but you have a specific goal in mind for those prints. The other involves obtaining several people's fingerprint data. From there, you can figure out what you can actually do with said data

You are right, thanks for the answer!
Post reply on HN