Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Black Hat: GDPR privacy law exploited to reveal personal data

bbc.co.uk

Post reply on HN
Print view View original

41–50 of 239 posts

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#41

Post by PeterisP »

ceejayoz wrote: post #37
inetknght wrote: post #18

Earlier quoted context omitted.

> we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. This sounds like one of the risks of doing international business. If you can't follow the laws then don't play.

Frankly, no one has the resources to do this reliably, and the identity theft consequences are potentially enormous. It's fairly easy to get a reasonably convincing fake ID. High schoolers manage it all the time.

That seems weird, from what I see in Europe, ID forgery is quite rare; making a convincing fake ID is about as difficult (or more difficult) as making convincing fake money, as pretty much the same anti-counterfeiting measures are used; and carries about the same consequences as counterfeiting money. It's possible, but not cheap or widespread - there are a bunch of ways how you could get money or stuff with a fake ID, but it's very rare in crime statistics; it's more common to see real IDs (of e.g. homeless people) used in such fraud cases, or having an accomplice employee making fake contracts without IDs.

Perhaps it's the issue with the lack of a good centralized ID in USA so you have all kinds of different "ID-like" documents, and some of them are insecure?

There's also less motivation for teenagers getting fake IDs - I assume in USA the 21-year alcohol limit is a big driver; but here it's not that big of an issue, plus it's easier and cheaper for a teenager to buy e.g. heroin than a fake ID, and being caught using a counterfeit ID is a crime that risks geeting jail time while buying/possession of small amounts of drugs won't; so using a fake ID is difficult and risky, and so it happens not that often.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#42

Post by ceejayoz »

PeterisP wrote: post #41
ceejayoz wrote: post #37

Earlier quoted context omitted.

Frankly, no one has the resources to do this reliably, and the identity theft consequences are potentially enormous. It's fairly easy to get a reasonably convincing fake ID. High schoolers manage it all the time.

That seems weird, from what I see in Europe, ID forgery is quite rare; making a convincing fake ID is about as difficult (or more difficult) as making convincing fake money, as pretty much the same anti-counterfeiting measures are used; and carries about the same consequences as counterfeiting money. It's possible, but not cheap or widespread - there are a bunch of ways how you could get money or stuff with a fake ID…

Remember that a GDPR request is going to typically come electronically. You won't have a physical item to examine for all its anti-counterfeiting features - you're probably going to have a photograph from a mobile phone to look at.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#43

Post by Avamander »

rossng wrote: post #28
toomuchtodo wrote: post #22

Earlier quoted context omitted.

Hasn't Estonia solved this with their national ID smart card?

I have never used it, but I do get the impression that Estonia is pretty far ahead of everyone else. I don't know if this particular use case is natively supported (but would be interested to know). I suppose it would be possible for a third party to build it.

Yes, it's officially supported by providing everyone the possibility to sign documents with it. It was made an EU-wide standard in 2016 https://www.etsi.org/deliver/etsi_en/319100_319199/31916201/... but previous iterations have existed since 2002.

The person you replied to is pretty much right, Estonian ID-card has solved 99.99% of authentication and signing problems for it's citizens, the support is mandated by law and very widespread. There are a few flaws but those are minor compared to the softly put clusterfuck rest of the world is dealing with.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#46

Post by danShumway »

inetknght wrote: post #18
Silhouette wrote: post #3

Earlier quoted context omitted.

This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security che…

> we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. This sounds like one of the risks of doing international business. If you can't follow the laws then don't play.

> This sounds like one of the risks of doing international business. If you can't follow the laws then don't play.

Sure, but while technically correct, this comment doesn't add anything to the conversation. The question isn't whether or not GP should need to follow laws -- it's "what laws should we be passing, and what are the effects of those laws?"

It's in Europe's best interest to protect their citizens, given that it currently looks like ~40% of the market is more frightened of refusing a GDPR request then they are of leaking PII.

There are lots of ways the EU could address that problem -- harsher penalties, revising how IDs work across member states, releasing more resources for smaller businesses, clarifying more broadly that refusing a GDPR request because of lack of identification is OK. All of these directions have pros and cons.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#47

Post by SiempreViernes »

ceejayoz wrote: post #42
PeterisP wrote: post #41

Earlier quoted context omitted.

That seems weird, from what I see in Europe, ID forgery is quite rare; making a convincing fake ID is about as difficult (or more difficult) as making convincing fake money, as pretty much the same anti-counterfeiting measures are used; and carries about the same consequences as counterfeiting money. It's possible, but not cheap or widespread - there are a bunch of ways how you could get money or stuff with a fake ID…

Remember that a GDPR request is going to typically come electronically. You won't have a physical item to examine for all its anti-counterfeiting features - you're probably going to have a photograph from a mobile phone to look at.

To me it sounds a bit dubious that you can both have a valid reason for keeping personal information about someone and not have a valid way of verifying that you are actually communicating with them.

What sort of agreement can you enter with someone if you don't know who they are?

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#48

Post by buboard »

gen3 wrote: post #5

> "But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed." I wonder if there is a market for selling GDPR compliance / advising services. Some company that makes sure your doing everything right, and inspects the requests for validity.

Hundreds of experts. And yet none of them know what they re doing.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#49

Post by rjzzleep »

davidhyde wrote: post #31
csomar wrote: post #17

This is horrible. So right now, in order to get access to data for a certain person, you need to hack your way through a few of the potential services he is using and drive from there. 1. The data might have things like IDs (ie: Crypto exchanges). 2. You can use that data to ask for more data. If you got a copy of his passport, now you can ask for more with this new piece. 3. Looks like some people still store passwo…

One of the major goals of GDPR is to discourage firms from retaining personal data in the first place. It did not used to cost them anything so they kept it regardless of its use. Now that there are big risks to keeping it these firms have to think twice about it. This "cobra effect" is one more reason NOT to retain personal information in the first place.

I'll let you in on a secret. For government institutions which in general have huge amounts of information about you and are notoriously bad at security. They don't even get fined with the GDPR. The worst that can happen to them is bad press.

So the institution that has all the healthcare data of all German citizens can not get fined under the GDPR. Same with any other KdöR

https://de.wikipedia.org/wiki/K%C3%B6rperschaft_des_%C3%B6ff...

EDIT: weird, any explanation for the downvotes?

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#50

Post by TazeTSchnitzel »

Nullabillity wrote: post #34
mrkeen wrote: post #21

Earlier quoted context omitted.

Sweden's BankID is quite good too.

BankID is horrible. It's coupled to your phone's OS, so as it becomes even more mandatory you're stuck carrying around an iOS or Android device, even if your primary phone is something like a Librem 5. It also doesn't support anyway to delegate access, either to people ("my partner should have access to this bank account") or computers ("I want to back up my incoming govt. messages automatically").

You can install it on your PC or Mac instead if you want, and it is not the only e-ID in Sweden (alas the others aren't so widely adopted, but that should change if/when the new government ID happens).

Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Instead, services can choose whether they let you allow someone to log in for you.

Post reply on HN