Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub sued for aiding hacking in Capital One breach

zdnet.com

Post reply on HN
Print view View original

31–40 of 104 posts

Re: GitHub sued for aiding hacking in Capital One breach

#31

Post by JumpCrisscross »

cgb223 wrote: post #29
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Wait... Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs? Because that could be really really bad

> Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs?

Most SSNs are deterministically derived. Given a single valid SSN, you can often generate millions of valid preceding values.

Re: GitHub sued for aiding hacking in Capital One breach

#32

Post by pliny »

cgb223 wrote: post #29
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Wait... Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs? Because that could be really really bad

Don't you need at least one other piece of identifying info to make that useful? Like, I could churn out mostly valid gmail passwords all day, but I have no idea which users have those passwords.

Re: GitHub sued for aiding hacking in Capital One breach

#33

Post by BoorishBears »

antpls wrote: post #25
nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Are you seriously entertaining the idea that Github should pour resources into developing a SSN detection pipeline?

Why don't they also flag repositories with lots of names, those are PII. Too many addresses? That's a red flag.

Why would you even for a second entertain this nonsense? Non-technical people who think this:

https://github.com/Hack-with-Github/Awesome-Hacking

is a smoking gun to prove Github as a company is supporting hackers are the ones putting forth this idea, no one with any technical knowledge should come close to supporting this.

Re: GitHub sued for aiding hacking in Capital One breach

#34

Post by ageitgey »

JumpCrisscross wrote: post #31
cgb223 wrote: post #29

Earlier quoted context omitted.

Wait... Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs? Because that could be really really bad

> Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs? Most SSNs are deterministically derived. Given a single valid SSN, you can often generate millions of valid preceding values.

That changed in 2011. Now they are random. But it is still true for older numbers.

https://www.ssa.gov/employer/randomization.html

Re: GitHub sued for aiding hacking in Capital One breach

#37

Post by johnnyAghands »

Honestly, it scares me that this was even filed. Even though we know how ridiculous it is to include Github in this suit, I'm afraid we're going to be left with some weird middle ground that shouldn't even exist to begin with made by people who have no idea how things work trying to fix something that isn't broken.

Re: GitHub sued for aiding hacking in Capital One breach

#39

Post by colejohnson66 »

nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

I’m reminded of a webpage that claimed to know your pin for your credit card; just do a find in page to see! In reality, it just had all 10,000 possible numbers listed in numerical order

Re: GitHub sued for aiding hacking in Capital One breach

#40

Post by colejohnson66 »

bufferoverflow wrote: post #30
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

You missed the whole point of the comment you replied to. You can detect the format of the SSN, but you can't reliably tell that it actually is a SSN, and not some other type of identifier.

Exactly. At Target, their internal SKUs follow the format xxx-xx-xxxx. That happens to be the same as the SSN format
Post reply on HN