GitHub sued for aiding hacking in Capital One breach • Hacker News Board

Re: GitHub sued for aiding hacking in Capital One breach

#21

Post by ryanmarsh » Sun, Aug 04, 2019, 3:29 PM UTC

noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

There’s a giant wave of political support for this. Right now people are talking on the tv about 8chan and mass shooters. GitHub is being sued for content.

The end result will be a (horrifying) market solution m. Site owners will have no choice but to pay outside companies to analyze content for them and auto delete. This will probably end up throwing the baby out with the bath water.

Re: GitHub sued for aiding hacking in Capital One breach

#22

Post by dfcmt » Sun, Aug 04, 2019, 3:30 PM UTC

Avamander wrote: post #10

vharuck wrote: post #3

Barriers to posting SSN-like data would make it difficult for a lot of people to do their job. Software that handles SSN info should have fake data for tests.

Not to mention the pure absurdity of trying to censor numbers.

In this digital age, everything (text, images, audio) can be encoded using integers. Does that mean it's absurd to try to make anything secret?

Re: GitHub sued for aiding hacking in Capital One breach

#23

Post by A4ET8a8uTh0 » Sun, Aug 04, 2019, 3:39 PM UTC

ryanmarsh wrote: post #21

noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

There’s a giant wave of political support for this. Right now people are talking on the tv about 8chan and mass shooters. GitHub is being sued for content. The end result will be a (horrifying) market solution m. Site owners will have no choice but to pay outside companies to analyze content for them and auto delete. This will probably end up throwing the baby out with the bath water.

Agreed. I will add that it is both sides of the political spectrum in US seem to push for it though for different reasons.I am annoyed at how many conversations I had with people who think it is not only good, but necessary.

Re: GitHub sued for aiding hacking in Capital One breach

#24

Post by mtrpcic » Sun, Aug 04, 2019, 3:41 PM UTC

nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Or any codebase that might have an SSN input and has a test suite with mock SSNs to test against.

Re: GitHub sued for aiding hacking in Capital One breach

#25

Post by antpls » Sun, Aug 04, 2019, 3:47 PM UTC

nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification.

Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII.

Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business at all.

Edit 2 : people are totally missing my points. The goal is to not display any plaintext SSN that would be scraped by bots. As I said, the hackers could just encode the SSNs, but then the numbers won't be readable by scrapers

Edit 3 : once a project is reviewed and verified, it would stop to trigger alerts. This is trivial, but the HN mentality is just disrespectful regarding people's data, until it's their own personal data that leaked

Re: GitHub sued for aiding hacking in Capital One breach

#26

Post by marcinzm » Sun, Aug 04, 2019, 3:49 PM UTC

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data

No it's not, especially once you add binary files to the mix.

I once worked at a company that required everyone to run some sort of local scanner to see if there's sensitive data on their laptops. My laptop with no sensitive data had something like 10k+ matching files. I promptly ignored the thing.

Re: GitHub sued for aiding hacking in Capital One breach

#27

Post by marcinzm » Sun, Aug 04, 2019, 3:53 PM UTC

dfcmt wrote: post #20

RijilV wrote: post #12

Earlier quoted context omitted.

Also SSN isn’t that distinctive of a format. nnn nn nnnn. Check bits and reserved prefixes were all removed decades ago when it became clear we’d run out unless we use the whole name space (and even then that buys us to 2100). \d{3}\s?\d{2}\s?\d{4} will match a surprising amount. Detecting SSNs is hard without accepting a high false positive rate. Much harder than phone numbers, credit card numbers, or cloud credenti…

\w\d{3}[\s\-]?\d{2}[\s\-]?\d{4}\w should not have many wrong results. You can also try to guess is something is a list of SSNs from the context.

I'd assume many systems would store SS numbers without spaces or dashes in the backend so that rendering is up to the client. Which means you're looking for 9 digit strings. For example, full zip codes (xxxxx-xxxx) are also 9 digit strings.

Re: GitHub sued for aiding hacking in Capital One breach

#28

Post by criddell » Sun, Aug 04, 2019, 3:55 PM UTC

noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

> But if the rationale is accepted, it will need to be applied universally to startups and SMBs as well.

I don't think that's necessarily true.

Re: GitHub sued for aiding hacking in Capital One breach

#29

Post by cgb223 » Sun, Aug 04, 2019, 3:57 PM UTC

antpls wrote: post #25

nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Wait...

Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs?

Because that could be really really bad

Re: GitHub sued for aiding hacking in Capital One breach

#30

Post by bufferoverflow » Sun, Aug 04, 2019, 4:02 PM UTC

antpls wrote: post #25

nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

You missed the whole point of the comment you replied to. You can detect the format of the SSN, but you can't reliably tell that it actually is a SSN, and not some other type of identifier.