Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Customs Database Of Traveler Photos Was Hacked And Stolen

buzzfeednews.com

Post reply on HN
Print view View original

151–160 of 207 posts

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#151

Post by manicdee »

anigbrowl wrote: post #96
projectileboy wrote: post #86

I’ll just keep saying this, and getting dismissed by everyone I know - any data security discussion around a centralized data store that doesn’t begin with the recognition that that data store will be compromised, is a discussion that is just a joke.

You and a whole bunch of other people making the same extremely basic observation. It would be good if you would suggest some alternative strategies, since 'don't bother keeping that data' isn't a realistic option in this context.

1. Don’t bother collecting the data since it is not a net gain.

2. Don’t collect data that doesn’t actually help enforce any laws.

3. Don’t produce new legislation that doesn’t actually solve any existing problems (it is already illegal to break the law).

4. The best way to keep secrets is to not have secrets in the first place. Once you have secrets the best way to keep secrets is to not share them.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#152

Post by mattnewton »

sailfast wrote: post #134

It is clear from the tenor of some of the posts here that more of you need to work for some non-zero time in the government so you can have some empathy / appreciation here. They’re hiring.

The same org separating children from their families at the border in violation of a court order? Why would I take a pay cut to work for that mission?

I don’t fault the engineers in any case, it seems like their technical security wasn’t tested here; it was some kind of policy failure that lead to the information leaving government control. And that’s the problem, we don’t solve this with engineering, or empathy for engineers, we solve this by letting legislators know what we feel and know as members of the industry, through letters and the ballot box.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#153

Post by Thorrez »

munchbunny wrote: post #131
ariwilson wrote: post #100

Earlier quoted context omitted.

Why does decentralization save you from compromise?

I wouldn't frame it as decentralization, more like compartmentalization. You harden your systems to prevent horizontal movement between services. For example, you could try to put payment credentials in a separate subnet where they are never read out of that enclave. Access to that subnet might require separate authentication credentials that most employees don't have, and API calls might require the calling server t…

It sounds like CBP might have done that.

What was stolen:

> The compromised photos were taken of travelers in vehicles coming in and out of the US through specific lanes at a single Port of Entry over a one and a half months period.

What wasn't stolen:

>No other identifying information was included with the photos and no passport or other travel document photos were compromised, the official said. Images of airline passengers from the air entry and exit process were also not involved.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#154

Post by EForEndeavour »

cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of data breach as long as there is data.

That's trivially true, but the proper response to bad security is good security, not shutting down the whole system.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#155

Post by realusername »

EForEndeavour wrote: post #154
cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of dat…

They did not have to take a picture of that many travelers in the 90s (let alone social media which did not exist) and it wasn't less secure either. They probably never considered if their program is any useful or if it creates more harm than good.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#156

Post by mehrdadn »

idlewords wrote: post #29
axaxs wrote: post #9

> On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network > CBP ... is closely monitoring all CBP work by the subcontractor What. In the private sector, they'd have been fired and probably legal action levelled against them. Th…

Remember the time Experian got hacked and the CEO subsequently retired with a $90M payday? The private sector is just as consequence-free.

Experian got hacked? Or are you referring to Equifax? I thought Experian was one of the ones with better security.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#158

Post by taneq »

izzydata wrote: post #22
lsllc wrote: post #17

Rule #1 about databases: It will be hacked. Rule #2: see rule #1

That would imply that security is irrelevant. Maybe you should re-work your rule the say that it will attempt to be hacked. Therefore you should always worry about security.

Security is relevant, it's what determines how long until you're hacked.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#159

Post by taneq »

cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

And this is the same group that can force you to give them your social media credentials on entry. Terrific.

Edit: Wait, just social media handles/account names, not login details. That's less ridiculous. My mistake.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#160

Post by mkagenius »

EForEndeavour wrote: post #154
cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of dat…

1. Do not collect unnecessary information.

2. Delete information after use.

Post reply on HN