Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why blurring sensitive information is a bad idea

dheera.net

Post reply on HN
Print view View original

31–40 of 43 posts

Re: Why blurring sensitive information is a bad idea

#31

Post by blasdel »

ubernostrum wrote: post #10
InclinedPlane wrote: post #5

Earlier quoted context omitted.

Bank of America uses a horrible method for generating debit card numbers. It's a standard prefix + account number + sequence number + check digit. If you have stolen someone's BofA debit card number then you can easily guess the replacement card's number (just increment the sequence number and recalculate the check digit). From there you just need to guess the expiration date (a comparatively trivial task).

Either you're skipping over a lot of information in the process of how that number's generated, or that's not how they do it anymore (and not how they've done it for at least the last couple of years).

I got a replacement BofA debit card a few months ago, and this is exactly how they did it — only the last two digits are different.

This may be only in Washington and Idaho though, as there are several different legacy BofA backends as a result of M&A bullshit.

Re: Why blurring sensitive information is a bad idea

#33

Post by andrewmu »

"Identify the exact size and offset, in pixels, of the mosaic tiles used to blur the original image (easy)"

I don't see that this is easy. Surely you have to test a number of offsets and sizes of text? And without knowing the digits, this is not going to be totally accurate.

Re: Why blurring sensitive information is a bad idea

#34

Post by dedward »

lwhi wrote: post #24
hboon wrote: post #13

Earlier quoted context omitted.

CCVs aren't always required for transactions.

CCV proves the cardholder was present at the time of the transaction. Online merchants are never allowed to store CCV numbers.

edit: CCV proves that you at one time had access to the CCV number.

Online merchants are supposed to comply with PCI-DSS - not store your CCV ever, never transmit your number unencrypted, never store cardholder information unencrypted, plus tons of management controls and audit controls over the same.

In practice, let's just say lazy programming is everywhere. I've seen many people who handle online transactions and violate PCI-DSS to some degree, including storing CCV numbers.

Re: Why blurring sensitive information is a bad idea

#35

Post by Natsu »

guynamedloren wrote: post #17

Here's a tip: if you do blur, don't use mosaic. Use the blur tool.

No, don't use blur. Ever.

Black it out. And I don't mean the stupid PDF trick where they draw a black box over it (but you can still copy/paste the number from underneath). I mean actually black it out. Print it out, draw on it with a marker, and scan it again if you have to make sure.

But I've seen so many blurred out numbers that I could just about figure out with my eyes, let alone a computer program that could decode it algorithmically. And yes, standard (and non-standard, i.e. Photoshop) algorithms are fairly well known and can be tested against known data. Also, people really can tell what font was used. That gives them more than enough information to decode it.

But why are you giving people information in the first place? Never, ever try to distort information you should be destroying.

Re: Why blurring sensitive information is a bad idea

#38

Post by gus_massa »

tptacek wrote: post #36

This attack is, for what it's worth, at least 4 years old (probably older).

According to SearchYC this has been posted twice

3 years ago (3 comments) http://news.ycombinator.com/item?id=79405

9 months ago (no comments) http://news.ycombinator.com/item?id=1115919

Re: Why blurring sensitive information is a bad idea

#39

Post by wdewind »

ig1 wrote: post #30
InclinedPlane wrote: post #5

Earlier quoted context omitted.

Bank of America uses a horrible method for generating debit card numbers. It's a standard prefix + account number + sequence number + check digit. If you have stolen someone's BofA debit card number then you can easily guess the replacement card's number (just increment the sequence number and recalculate the check digit). From there you just need to guess the expiration date (a comparatively trivial task).

Also they generate your PIN by running your account number through a DES encryption round. This method is known to be vulnerable to attack: http://www.cl.cam.ac.uk/~mkb23/research/PIN-Cracking.pdf

Chase PINs are by default 3210 - guess how many people still have that pin.
Post reply on HN