Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One’s breach was inevitable, because we did nothing after Equifax

techcrunch.com

Post reply on HN
Print view View original

111–120 of 161 posts

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#111

Post by SamuelAdams »

rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

I agree, SSN's are a poor form of authentication. What's missing from these conversations is realistic approaches to fixing it. It's a lot like healthcare: plenty of people want to get rid of Obamacare, but they fail to explain what will replace it.

> For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such.

This will work for a time, but what happens when the next breach occurs? How do people renew their UUID's? Expire compromised ones?

> For those citizens that do not want to register in this way, allow for physical authentication at physical locations.

Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed.

CCTV cameras are everywhere, and getting better resolution each day. Face authentication can be easily duplicated - some of the early versions of FaceID (by Apple) were broken by 3-D printing a mask [2]. Furthermore, some organizations are already compiling a list of "face data" that can be used to fool sensors and other biometric tools. By the time "face readers" are widespread, hackers will already have large pools of face data to use to hack into these systems.

There are other cases where fingerprints have been printed using a 3-D printer and have broken security of mobile smartphones [1]. What's to say whatever government issued terminal won't be broken in a similar way? Furthermore, it's not easy to expect people to guard their fingerprints: every glass they drink at a restaurant will have their fingerprints. I don't expect to shed my SSN whenever I order a pint at my favorite pub.

[1]: https://www.theverge.com/2019/4/7/18299366/samsung-galaxy-s1...

[2]: https://www.wired.co.uk/article/hackers-trick-apple-iphone-x...

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#112

Post by consumer451 »

ghostpepper wrote: post #94

> The Equifax incident should have sparked a fire under the credit giants. I get what the author is trying to say, but based on the entire remainder of this article, the large credit firms are doing exactly the right thing (for their shareholders) by not spending tons of money on security.

> the large credit firms are doing exactly the right thing (for their shareholders) by not spending tons of money on security.

Isn't this due to the fact that there are no serious penalties for losing customer data, aka regulation?

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#113

Post by arbuge »

rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

> For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such.

How do you make this proposed new unique identifier more secure than the (admittedly very unsecure) SSNs?

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#114

Post by SmellyGeekBoy »

syn0byte wrote: post #85
buboard wrote: post #50

What guarantees does Amazon sell to AWS clients regarding the security of their data?

Lots! Tons and Tons and Tons! S3 is super secure and CAN NOT be hacked when properly configured and used according to our standard! You got hacked? You must have configured it wrong because we already told you it was unhackable; Good luck proving it was our fault not yours.

> Good luck proving it was our fault not yours.

Seems like it would be incredibly easy to prove that an S3 bucket was misconfigured in such a way that the data was publicly accessible. In fact this has been the case in the recent high-profile cases that I can recall.

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#115

Post by amitparikh »

unclesams-uncle wrote: post #108
rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

The Belgians have this tool called "itsme" which acts as authentication manager/digital signature tool with authorized partners. After validating your ID, you can use the app to do 2FA with most major services in the country, including almost every bank and financial institution. https://www.itsme.be/en/ A program like this could go a long way in the US to help cut down on the issue you describe.

Thanks. Another example is the Dutch DigID: https://www.digid.nl/en/about-digid/

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#116

Post by [deleted] »

syn0byte wrote: post #85
buboard wrote: post #50

What guarantees does Amazon sell to AWS clients regarding the security of their data?

Lots! Tons and Tons and Tons! S3 is super secure and CAN NOT be hacked when properly configured and used according to our standard! You got hacked? You must have configured it wrong because we already told you it was unhackable; Good luck proving it was our fault not yours.

[deleted]

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#117

Post by dwild »

homonculus1 wrote: post #47
pcl wrote: post #23

Earlier quoted context omitted.

For many, it's a goal to avoid having a national ID, for privacy-from-the-government reasons. The ACLU has a decent writeup about the issue: https://www.aclu.org/other/5-problems-national-id-cards

Similar to constant surveillance, the psychological implications of mandatory ID are horrifying. It tips the scale from "You are born free, but you must fulfill certain obligations to cooperate with others" to "You exist first and foremost through the lens of the government. You are not permitted to live outside the bureaucratic abstraction of you."

> "You exist first and foremost through the lens of the government. You are not permitted to live outside the bureaucratic abstraction of you."

Aren't we already at that point?

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#118

Post by buboard »

syn0byte wrote: post #85
buboard wrote: post #50

What guarantees does Amazon sell to AWS clients regarding the security of their data?

Lots! Tons and Tons and Tons! S3 is super secure and CAN NOT be hacked when properly configured and used according to our standard! You got hacked? You must have configured it wrong because we already told you it was unhackable; Good luck proving it was our fault not yours.

not sure if serious

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#119

Post by sangnoir »

SamuelAdams wrote: post #111
rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

I agree, SSN's are a poor form of authentication. What's missing from these conversations is realistic approaches to fixing it. It's a lot like healthcare: plenty of people want to get rid of Obamacare, but they fail to explain what will replace it. > For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such. This will work for…

> This will work for a time, but what happens when the next breach occurs?

The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique.

> Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed.

Even if those are compromised, that doesn't mean it has to be easy to impersonate you. The solution may be low-tech - you may have to physically present yourself to a human who assesses if you are indeed who you say you are before opening an account. The higher tech solution physical authentication might require something akin to chip-and-pin or a (revocable) token generator a la Ubikey

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#120

Post by Allower »

rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

How do we change it? Everytime I bring this up to my bank et al I get blank stares and random stuttering.
Post reply on HN