Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Understanding the ginormous Philippines data breach

troyhunt.com

Post reply on HN
Print view View original

61–70 of 93 posts

Re: Understanding the ginormous Philippines data breach

#61

Post by robmcm »

luso_brazilian wrote: post #2

> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…

Most people have 10 to choose from, 20 if you want, and potentially more if you consider other regions of your skin.

Re: Understanding the ginormous Philippines data breach

#62

Post by semi-extrinsic »

mikeash wrote: post #54
Intermernet wrote: post #52

Earlier quoted context omitted.

>it's something different from both, with its own unique properties. No, it's a username that is physically tied to the user. If I can get that data (fingerprint) then I don't need to go through the usual rigmarole of password hacking. Fingerprints are literally "one factor auth".

That doesn't mean that they're usernames. You can say this about passwords too: if you can get that data (password) then you don't need to go through password cracking, and they're literally "one factor auth." Consider an example. Imagine if HN authenticated based only on the username. Could you get into my account? Now imagine if HN used fingerprint authentication. Would that make it harder?

Your analogy only works if usernames were stored in a secret database, not displayed publically.

Re: Understanding the ginormous Philippines data breach

#63

Post by Vraxx »

K0nserv wrote: post #47
skywhopper wrote: post #43

Earlier quoted context omitted.

As other responders pointed out, Touch ID is definitely an improvement over the status quo, and strikes a reasonable balance between security and convenience. But more relevant to the GP's point in re Touch ID is that Apple doesn't have a database anywhere of fingerprints, and the Secure Enclave is very difficult if not impossible to retrieve data from. In other words, this is biometric ID done as rightly as possible…

I'm inclined to agree that it's an improvement over the status quo for people that didn't use passcodes from before. I do trust Apple more than many other entities and as you say they don't have a database with fingerprints. Further the secure enclave is definitely a secure piece of engineering. As evident by the linked article though the problem isn't Apple the problem is all the other databases that will have your…

Yeah, wow. That's an aspect I've never considered before. I suppose because I figured they would need my actual fingerprint to crack the system, but if you have the values for all the "basis vectors" of the fingerprint that are stored, one could theoretically bypass the sensor and feed the proper sensor output to the authenticating machine. The issue grows larger as this method of authentication grows in popularity.

Re: Understanding the ginormous Philippines data breach

#64

Post by nxzero »

emodendroket wrote: post #56
nxzero wrote: post #40

Increasely wonder why average person trust any party to secure data that literally belongs to them. Are there any startups that are building tech allow end-to-end identity management systems? Seems like a huge market.

What choice do you have?

Really depends of the type of data, how it's being used, etc. - is there a specific problem you personally are facing and how big of a problem is it to you?

Re: Understanding the ginormous Philippines data breach

#65

Post by rpgmaker »

K0nserv wrote: post #35
tim333 wrote: post #33

Earlier quoted context omitted.

Though nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?

It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible. The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords. Imagine for a second that the San…

> Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple.

That is a very good observation and puts Touch ID in perspective. If you died today would you be ok with your family and/or friends being able to unlock your phone and go through all your personal data? Sure, there may be genuine reasons for them to do so but still, all your data will be at their fingertips and even if you "trust" that they'll limit themselves to only look for the relevant information to get your things in order they still have to sift through a lot data you may not want them to.

Re: Understanding the ginormous Philippines data breach

#66

Post by rpgmaker »

veb wrote: post #4

A friend of mine in the Philippines, a security researcher himself, said to me that "the breach itself isn't really serious -- it's the candidate the breach favors thats the bigger controversy"

I'm am sorry but what kind of security researcher can claim that this breach isn't serious? The electoral implications may be a bigger controversy but to suggest that the breach isn't serious it's insane. What is described in the post is nothing short of a nightmare scenario for anyone, no only security-conscious people.

Re: Understanding the ginormous Philippines data breach

#67

Post by mikeash »

semi-extrinsic wrote: post #62
mikeash wrote: post #54

Earlier quoted context omitted.

That doesn't mean that they're usernames. You can say this about passwords too: if you can get that data (password) then you don't need to go through password cracking, and they're literally "one factor auth." Consider an example. Imagine if HN authenticated based only on the username. Could you get into my account? Now imagine if HN used fingerprint authentication. Would that make it harder?

Your analogy only works if usernames were stored in a secret database, not displayed publically.

Why?

Re: Understanding the ginormous Philippines data breach

#68

Post by rpgmaker »

nxzero wrote: post #64
emodendroket wrote: post #56

Earlier quoted context omitted.

What choice do you have?

Really depends of the type of data, how it's being used, etc. - is there a specific problem you personally are facing and how big of a problem is it to you?

His point is that the government asks for this information, maybe as a requirement in order to procure official documents needed for everyday life and business. There's not much to do when the government of your country makes your giving of certain information a requirement. Sure, you could fight it in court but it's very likely that that will not get you very far or produce the official documents you may need. Not all governments were founded with the same libertarian strain as the US.

Re: Understanding the ginormous Philippines data breach

#69

Post by newman314 »

luso_brazilian wrote: post #2

> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…

I found this article from Microsoft a while ago that I thought was particularly interesting.

https://technet.microsoft.com/en-us/library/cc512578.aspx

Re: Understanding the ginormous Philippines data breach

#70

Post by newman314 »

DanielBMarkham wrote: post #15
speeder wrote: post #10

Earlier quoted context omitted.

Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...

You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)

This sounds like a good idea on the surface but this just shifts the problem.

Ultimately, you still only have 10 fingers (general assumption), and not a large space like 30 char passwords.

Post reply on HN