Black Hat: GDPR privacy law exploited to reveal personal data • Hacker News Board

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#71

Post by PeterisP » Fri, Aug 09, 2019, 4:35 PM UTC

dmix wrote: post #35

inetknght wrote: post #18

Earlier quoted context omitted.

> we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. This sounds like one of the risks of doing international business. If you can't follow the laws then don't play.

OP sounds like he was trying hard to navigate and follow the law? The problem is he ended up finding no reasonable solution that both protected his users privacy while also following the rules, and was disturbed by the implications of it all considering it was supposed to protect them in the first place. Those are very valid criticisms. Simply dismissing everyone who shows concern about a law as mere law dodgers or f…

One of the intended goals of GDPR is to reduce the processing of personal data - not only that the companies should do it differently, but that at least half of the companies who currently have my data really shouldn't have it in the first place.

It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data. Yes, it raises the barriers for entry in areas where that data is absolutely necessary. But it also makes companies think twice whether it's really necessary and worth it, and that's a good thing.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#72

Post by SolarNet » Fri, Aug 09, 2019, 4:36 PM UTC

lucideer wrote: post #4

> Mr Pavur says he believes he did not break the law himself while conducting the trial This is a bit odd. I know his partner consented to this, but this doesn't seem like it should be enough to make this not identity fraud. Obviously the research Pavur carried out is extremely valuable and the mid-sized companies failing to follow proper procedure are the real problem here, but it still seems like it would be techni…

> I know his partner consented to this, but this doesn't seem like it should be enough to make this not identity fraud.

Most crimes require an intent to commit the crime, with notable exceptions (possession).

His intent was not fraud, it was security research. As demonstrated by getting the permission of the potential victim, and carefully avoiding things like forgery.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#73

Post by SiempreViernes » Fri, Aug 09, 2019, 4:37 PM UTC

Majromax wrote: post #61

SiempreViernes wrote: post #47

Earlier quoted context omitted.

To me it sounds a bit dubious that you can both have a valid reason for keeping personal information about someone and not have a valid way of verifying that you are actually communicating with them. What sort of agreement can you enter with someone if you don't know who they are?

> To me it sounds a bit dubious that you can both have a valid reason for keeping personal information about someone and not have a valid way of verifying that you are actually communicating with them. Suppose I run a matchmaking site that stores a real name, username, and sexual orientation for registered users. To avoid over-collecting data, that's all I require. I don't need strong verification at this stage becau…

So you say you store sexual orientation connected to a real name, that this information is sensitive, and that you have shoddy account security?

If someone wants to download account information they just have to log in and press the button on the appropriate page, and either get the data directly or else some special token to prove account ownership.

If account access is not secure enough, then what business do you have storing the information at all?

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#74

Post by 40acres » Fri, Aug 09, 2019, 4:38 PM UTC

"Generally if it was an extremely large company - especially tech ones - they tended to do really well," he told the BBC.
"Small companies tended to ignore me.

"But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed."

This sums up regulatory compliance across the world quite well.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#75

Post by JumpCrisscross » Fri, Aug 09, 2019, 4:39 PM UTC

tjoff wrote: post #67

Silhouette wrote: post #3

Earlier quoted context omitted.

This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security che…

The email used during registration is sufficient. If you don't have email then username+password. If they don't have that they don't get access to data. They need to be able to prove who they are and reasonably that is the same information that is used during registration. If password is lost then tough luck.

> If password is lost then tough luck

This is your personal opinion of how it should work, not GDPR.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#76

Post by SiempreViernes » Fri, Aug 09, 2019, 4:41 PM UTC

PeterisP wrote: post #66

Majromax wrote: post #61

Earlier quoted context omitted.

> To me it sounds a bit dubious that you can both have a valid reason for keeping personal information about someone and not have a valid way of verifying that you are actually communicating with them. Suppose I run a matchmaking site that stores a real name, username, and sexual orientation for registered users. To avoid over-collecting data, that's all I require. I don't need strong verification at this stage becau…

I don't think that what you describe is incompatible with GDPR. In general GDPR allows and requires you to use 'all reasonable measures to verify the identity', and in your particular scenario requiring the same authentication that you usually use would be considered reasonable, and it's likely the only possible reasonable measure - if what you say is all you store, then it's impossible to distinguish between two dif…

Yeah, there is some weird subtext to the argument, that for some reason account access shouldn't count as secure verification?

I guess this all hinges on the idea that to implement GDPR all you need to do is set up an email adress and handle all requests manually, only to then discover that: actually, identity management via plaintext email is a bit tricky.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#77

Post by Mirioron » Fri, Aug 09, 2019, 4:41 PM UTC

toomuchtodo wrote: post #22

rossng wrote: post #19

This is a reflection of the fact that we have no good way for someone to digitally prove their identity. Some countries are getting close-ish - Denmark's NemID system, for example, is used by a lot of financial institutions. However, there remains no easy way to make ad-hoc verifiable statements like 'I am John Smith and I authorise you to send this data to xyz@example.org'. Governments, please solve this problem! Es…

Hasn't Estonia solved this with their national ID smart card?

Yes. A lot of Estonians use it daily to log in to their bank accounts, give digital signatures, deal with government business, check their health data etc. All you need is your ID card and your PIN codes.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#78

Post by tastetherainbow » Fri, Aug 09, 2019, 4:41 PM UTC

Nullabillity wrote: post #60

TazeTSchnitzel wrote: post #50

Earlier quoted context omitted.

You can install it on your PC or Mac instead if you want, and it is not the only e-ID in Sweden (alas the others aren't so widely adopted, but that should change if/when the new government ID happens). Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept of secure digital ID if someone else could digitally impersonate you with it. Instead, services can choose…

> You can install it on your PC or Mac if you want. 1. Same problem. There is still no Linux client, for example. 2. It's a different API. Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there. 3. Many applications are only useful on the go, such as Swish. > Access delegation not being part of BankID itself is a feature not a deficiency, it would undermine the concept…

>Same problem. There is still no Linux client, for example.

There was[0]. Maybe you can revive it, since it is a pain-point?

>It's a different API.

Having read the BankId specs, they're "different" APIs in only in how the session is initiated. You're still challenged to enter the PIN for the certificate, which prompts the response to the authentication request. In other words, BankId and Mobile Bank Id are presenting the same exact set of data back to the session initiator.

>Most services specifically require Mobile BankID these days. Desktop (regular) BankID won't work there.

I have, as of yet, to run into anything that would not take BankId or Mobile Bank Id.

[0] - https://fribid.se/

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#79

Post by JumpCrisscross » Fri, Aug 09, 2019, 4:42 PM UTC

PeterisP wrote: post #71

dmix wrote: post #35

Earlier quoted context omitted.

OP sounds like he was trying hard to navigate and follow the law? The problem is he ended up finding no reasonable solution that both protected his users privacy while also following the rules, and was disturbed by the implications of it all considering it was supposed to protect them in the first place. Those are very valid criticisms. Simply dismissing everyone who shows concern about a law as mere law dodgers or f…

One of the intended goals of GDPR is to reduce the processing of personal data - not only that the companies should do it differently, but that at least half of the companies who currently have my data really shouldn't have it in the first place. It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to han…

> it also makes companies think twice whether it's really necessary and worth it

The simple fact that someone has an account at a service can be private information. For anything requiring even a modicum of persistence, keeping these data is tough to avoid.

I think most of HN agrees GDPR’s goals are good. It was just sloppily drafted, passed and implemented.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#80

Post by Mirioron » Fri, Aug 09, 2019, 4:43 PM UTC

40acres wrote: post #74

"Generally if it was an extremely large company - especially tech ones - they tended to do really well," he told the BBC. "Small companies tended to ignore me. "But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed." This sums up regulatory compliance across the world quite well.

I think this is part of the reason why GDPR needs an exemption for businesses that are too small. This kind of a flaw will be abused more and more and they'll never be able to close this gap with small and medium businesses.