Black Hat: GDPR privacy law exploited to reveal personal data

Post by jakear » Fri, Aug 09, 2019, 4:01 PM UTC

davidhyde wrote: post #31

csomar wrote: post #17

This is horrible. So right now, in order to get access to data for a certain person, you need to hack your way through a few of the potential services he is using and drive from there. 1. The data might have things like IDs (ie: Crypto exchanges). 2. You can use that data to ask for more data. If you got a copy of his passport, now you can ask for more with this new piece. 3. Looks like some people still store passwo…

One of the major goals of GDPR is to discourage firms from retaining personal data in the first place. It did not used to cost them anything so they kept it regardless of its use. Now that there are big risks to keeping it these firms have to think twice about it. This "cobra effect" is one more reason NOT to retain personal information in the first place.

Post by grapehut » Fri, Aug 09, 2019, 4:08 PM UTC

jwildeboer wrote: post #45

“Bad implementation of GDPRs information rights” would be the more correct but less clickbaity headline IMHO. The funny twist being that these bad implementations are a GDPR violation too and can be punishable under GDPR.

Post by notathing » Fri, Aug 09, 2019, 4:11 PM UTC

PeterisP wrote: post #41

ceejayoz wrote: post #37

Earlier quoted context omitted.

Frankly, no one has the resources to do this reliably, and the identity theft consequences are potentially enormous. It's fairly easy to get a reasonably convincing fake ID. High schoolers manage it all the time.

That seems weird, from what I see in Europe, ID forgery is quite rare; making a convincing fake ID is about as difficult (or more difficult) as making convincing fake money, as pretty much the same anti-counterfeiting measures are used; and carries about the same consequences as counterfeiting money. It's possible, but not cheap or widespread - there are a bunch of ways how you could get money or stuff with a fake ID…

Post by PeterisP » Fri, Aug 09, 2019, 4:14 PM UTC

ceejayoz wrote: post #42

PeterisP wrote: post #41

Earlier quoted context omitted.

That seems weird, from what I see in Europe, ID forgery is quite rare; making a convincing fake ID is about as difficult (or more difficult) as making convincing fake money, as pretty much the same anti-counterfeiting measures are used; and carries about the same consequences as counterfeiting money. It's possible, but not cheap or widespread - there are a bunch of ways how you could get money or stuff with a fake ID…

Remember that a GDPR request is going to typically come electronically. You won't have a physical item to examine for all its anti-counterfeiting features - you're probably going to have a photograph from a mobile phone to look at.

Post by Nullabillity » Fri, Aug 09, 2019, 4:16 PM UTC

TazeTSchnitzel wrote: post #50

Nullabillity wrote: post #34

Earlier quoted context omitted.

BankID is horrible. It's coupled to your phone's OS, so as it becomes even more mandatory you're stuck carrying around an iOS or Android device, even if your primary phone is something like a Librem 5. It also doesn't support anyway to delegate access, either to people ("my partner should have access to this bank account") or computers ("I want to back up my incoming govt. messages automatically").

You can install it on your PC or Mac instead if you want, and it is not the only e-ID in Sweden (alas the others aren't so widely adopted, but that should change if/when the new government ID happens). Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Instead, services can choose…