Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Electronic Voting Firm Exposes 1.8M Chicagoans

upguard.com

Post reply on HN
Print view View original

51–60 of 76 posts

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#51

Post by unclebucknasty »

lurker456 wrote: post #39
unclebucknasty wrote: post #21

Earlier quoted context omitted.

Which is inane. We have to get away from this idea of having "secret" numbers that, if simply discovered, can cause so much damage. That includes credit card numbers, SSN, etc.

what alternative do you have in mind ?

Well, I haven't yet patented an alternative, but I think it's pretty clear that, in this climate of routine breaches, the old system of secret data is no longer viable.

But, if you're interested in building an alternative, then off the top of my head, I'd suggest that we've got the blockchain. We've all got omnipresent palm-sized computing devices. We've got 2FA schemes, and more. The tools are there for you to create a much more robust system than one that says "here are a handful of secret numbers. Don't let anyone else see them or else your life may be ruined".

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#52

Post by rayboy1995 »

kyle-rb wrote: post #35

Recently, I got an email from AWS notifying my that one of my S3 buckets was publicly accessible (intentionally, for a static site). They really try to make sure that people can't screw this up.

Yes not only that, they have changed the UI so much that it explicitly confirms that you want to make this data public.

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#53

Post by Bartweiss »

mcone wrote: post #7
SamuelAdams wrote: post #6

Isn't this considered public data anyways? Illinois (and I believe every other US state) requires that certain voter data be publicly accessible. To access it in bulk, you'll have to pay a small fee, but anyone can get this. A misconfigured AWS instance is always an issue. I'm not trying to downplay that. Only that this data being released to the public isn't anything new - the public already had access to it. https:…

No. The Chicago Tribune [0] reported on the type of data exposed: > The files included names, addresses, dates of birth, the last four digits of many voters' Social Security numbers, driver's license and state ID numbers for the 1.8 million who are registered to vote in Chicago. [0] http://www.chicagotribune.com/news/local/politics/ct-chicago...

Well, there's an unpleasant reminder of why knowledge-based authentication should never be based on something immutable.

How many services do all of use use that accept name/birthdate/SSN as identification? How many other services, like phone companies, claim not to but would still yield for someone who sounded earnest and knew all of that?

And what can the leak victims possibly do? TFA is great where you can get it, but it's not universal, and none of this information can be refreshed.

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#54

Post by Bartweiss »

unclebucknasty wrote: post #21
ams6110 wrote: post #20

Earlier quoted context omitted.

And they're certainly not the only one. Last 4 of SSN is a very common authentication question.

Which is inane. We have to get away from this idea of having "secret" numbers that, if simply discovered, can cause so much damage. That includes credit card numbers, SSN, etc.

It's worth noting that SSN is far worse than a credit card number.

"Something you know" isn't a great standard as the entirety of auth, but it'll probably stay common for practical reasons. But "something you know and can never change if breached" is absolutely idiotic, and there are plenty of good alternatives already in existence.

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#55

Post by lazyant »

dark_shadow wrote: post #40
ckinnan wrote: post #26

Earlier quoted context omitted.

Amazon just launched a service to help scan, categorize, and protect data https://aws.amazon.com/macie/

Don't you have to pay for that?

One click away: https://aws.amazon.com/macie/pricing/

"No charge for the first 1 GB processed by the content classification engine After first GB, $5 per GB processed by the content classification engine"

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#56

Post by kevin_thibedeau »

Bartweiss wrote: post #54
unclebucknasty wrote: post #21

Earlier quoted context omitted.

Which is inane. We have to get away from this idea of having "secret" numbers that, if simply discovered, can cause so much damage. That includes credit card numbers, SSN, etc.

It's worth noting that SSN is far worse than a credit card number. "Something you know" isn't a great standard as the entirety of auth, but it'll probably stay common for practical reasons. But "something you know and can never change if breached" is absolutely idiotic, and there are plenty of good alternatives already in existence.

"Improper use of this card and/or number by the number holder or any other person is punishable by fine, imprisonment or both."

We could start by exacting real consequences for those who abuse SSNs.

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#57

Post by incongruity »

incongruity wrote: post #18

Is there any way for one to know if their info has been exposed? I had been registered to vote in Chicago ~6+ years ago but have since moved. Knowing Chicago, I'd bet I was still on the rolls (and probably having ballots cast for me ;)

Not sure why my original question has been down-voted. I think it's a legitimate issue – when things like this make the news, there's often an interest for potential victims to find out if they've been put at risk. Many companies go out of their way to protect their customers/users with offers of identity monitoring/credit monitoring, etc – will the city of Chicago do the same?

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#58

Post by freeone3000 »

kevin_thibedeau wrote: post #56
Bartweiss wrote: post #54

Earlier quoted context omitted.

It's worth noting that SSN is far worse than a credit card number. "Something you know" isn't a great standard as the entirety of auth, but it'll probably stay common for practical reasons. But "something you know and can never change if breached" is absolutely idiotic, and there are plenty of good alternatives already in existence.

"Improper use of this card and/or number by the number holder or any other person is punishable by fine, imprisonment or both." We could start by exacting real consequences for those who abuse SSNs.

Currently it's between 48 months and 27 years (see federal sentencing guidelines) if caught. What sort of real consequences would you like to see? I don't think making the numbers above bigger would make that much of a difference.

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#59

Post by _salmon »

danso wrote: post #2

Source blog post (and free of CNN's obnoxious autoplay video): https://www.upguard.com/breaches/cloud-leak-chicago-voters As soon as I read the headline, I immediately thought "AWS misconfiguration". A few recent massive government-data breaches (by contractors) have fallen into that category: June 2017: http://gizmodo.com/gop-data-firm-accidentally-leaks-personal... May 2017: http://gizmodo.com/top-defense-contracto…

I made a quick-and-dirty tool for doing this: https://github.com/sa7mon/S3Scanner

I'll probably spend some time this weekend making things look better and improving the documentation. I made it mostly as a PoC

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#60

Post by _salmon »

ckinnan wrote: post #26
danso wrote: post #2

Source blog post (and free of CNN's obnoxious autoplay video): https://www.upguard.com/breaches/cloud-leak-chicago-voters As soon as I read the headline, I immediately thought "AWS misconfiguration". A few recent massive government-data breaches (by contractors) have fallen into that category: June 2017: http://gizmodo.com/gop-data-firm-accidentally-leaks-personal... May 2017: http://gizmodo.com/top-defense-contracto…

Amazon just launched a service to help scan, categorize, and protect data https://aws.amazon.com/macie/

This looks like it only works for buckets you own. Upguard is scanning everyone.
Post reply on HN