Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Black Hat: GDPR privacy law exploited to reveal personal data

bbc.co.uk

Post reply on HN
Print view View original

121–130 of 239 posts

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#121

Post by dgzl »

tom_mellior wrote: post #113
csomar wrote: post #17

This is horrible. So right now, in order to get access to data for a certain person, you need to hack your way through a few of the potential services he is using and drive from there. 1. The data might have things like IDs (ie: Crypto exchanges). 2. You can use that data to ask for more data. If you got a copy of his passport, now you can ask for more with this new piece. 3. Looks like some people still store passwo…

Interesting that you consistently refer to the target as "he" as if women weren't a major target of this kind of campaign.

Some people refer to hypothetical people in stories as the same sex as the person describing the story. I'm not positive, but I imagine the parent is also a "he". I don't consider this important at all, and I think you're being pedantic.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#123

Post by tremon »

Silhouette wrote: post #3
jfk13 wrote: post #2

This is pretty appalling, really: "Overall, of the 83 firms known to have held data... 24% supplied personal information without verifying the requester's identity." Want someone else's personal data? No need to "hack into" any systems; just ask for it!

This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security che…

I'm not sure it should be this hard. If all you know about a customer is his e-mail address and site password, then you can only verify the user's identity by e-mail address and password. A "strong" ID only helps if you have prior information about that ID stored on your end.

Likewise, it stands to reason that you shouldn't provide information about a user at e-mail request only, without proof that said user also knows the password to your site. You could even create a policy that a user cannot do GDPR requests for up to seven days following a e-mail password reset action, to mitigate the account hijack situation.

As for data processors, who have no direct relationship with end users, the safest policy is to not collect personally-identifying information at all, only use the data controller's surrogate identity. And if you must collect PII, then use that previously stored data to verify the user, not an ID card that you have no way of validating. If you only have the natural address of the user (for example, you're a shipping company), then only offer to send the data to that known address, or make the user prove his residence (e.g. utility bills); if you only know a bank account number, ask for a (sufficiently-redacted) bank statement to that effect, etc.

A government-issued ID is only worth asking for if you can verify it.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#124

Post by PeterisP »

JumpCrisscross wrote: post #104
AstralStorm wrote: post #94

Earlier quoted context omitted.

GDPR does not care about privacy. It cares about personal identification. Such as full name and address, and a bunch of other protected things. Why would any random service request, process or more importantly store these?

> Why would any random service request, process or more importantly store these? So they can identify users for purposes of complying with GDPR? (For example, to handle the data requests highlighted in this post.)

The GDPR recitals do not recommend gathering additional data solely to be able to fulfill these requests.

See https://gdpr-info.eu/recitals/no-64/ and https://gdpr-info.eu/recitals/no-57/ - the key part is "A controller should not retain personal data for the sole purpose of being able to react to potential requests."

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#125

Post by SpicyLemonZest »

PeterisP wrote: post #98
codechicago277 wrote: post #36

This is the problem with overly aggressive legislation. The big companies performed well, the small companies ignored the law, and the medium sized companies tried to comply and failed. You can’t legislate good behavior because people will always find a way around the laws. The legal philosophy behind GDPR seems to be nothing more than to make everyone a criminal and then choose who to prosecute, and in that case why…

I wouldn't agree that the medium sized companies tried to comply with the GDPR and failed. Yes, they tried to comply with that particular request but the failures suggest that they didn't even try to be GDPR compliant in the first place - if they had done so, then they would have had assigned a data protection officer who would have long ago asked themselves the question "what do we do in case of a personal informati…

I’m very skeptical of the idea that, if they didn’t account for this particular attack vector, that must mean nobody thought about GDPR at all. If someone came to me to write a DSR plan, I’d be thinking about how to reliably enumerate all the places we might have personal data, not how to verify that people aren’t impostors. (Does your DSR plan also have to prevent spearphishing your DBAs?)

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#126

Post by yrro »

Silhouette wrote: post #3
jfk13 wrote: post #2

This is pretty appalling, really: "Overall, of the 83 firms known to have held data... 24% supplied personal information without verifying the requester's identity." Want someone else's personal data? No need to "hack into" any systems; just ask for it!

This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security che…

> If we get scammed by fake ID then we're breaking the law.

The person who committed fraud by providing a fake ID is breaking the law. I'd think that a regulator would take into account when deciding whether it would be in the public interest to prosecute you.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#127

Post by ghostpepper »

tom_mellior wrote: post #113
csomar wrote: post #17

This is horrible. So right now, in order to get access to data for a certain person, you need to hack your way through a few of the potential services he is using and drive from there. 1. The data might have things like IDs (ie: Crypto exchanges). 2. You can use that data to ask for more data. If you got a copy of his passport, now you can ask for more with this new piece. 3. Looks like some people still store passwo…

Interesting that you consistently refer to the target as "he" as if women weren't a major target of this kind of campaign.

You could equally have praised the OP for not stereotyping.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#128

Post by Silhouette »

PeterisP wrote: post #71
dmix wrote: post #35

Earlier quoted context omitted.

OP sounds like he was trying hard to navigate and follow the law? The problem is he ended up finding no reasonable solution that both protected his users privacy while also following the rules, and was disturbed by the implications of it all considering it was supposed to protect them in the first place. Those are very valid criticisms. Simply dismissing everyone who shows concern about a law as mere law dodgers or f…

One of the intended goals of GDPR is to reduce the processing of personal data - not only that the companies should do it differently, but that at least half of the companies who currently have my data really shouldn't have it in the first place. It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to han…

It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data.

That's not a reasonable strategy at all. Any company doing more than selling basic goods in person for cash probably needs to process some level of personal data for legitimate reasons. In fact, it will probably be legally required to do so in several respects.

It's all very well arguing that you want to reduce processing of personal data, but I think what you really mean is that you want to reduce processing of personal data in ways you don't like. Some amount of processing of personal data about you is always going to be necessary, and indeed essential to your vital interests and the normal functioning of society.

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#129

Post by Matticus_Rex »

gjvnq wrote: post #109
Silhouette wrote: post #3

Earlier quoted context omitted.

This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security che…

I think I have a "legally safe", but slow, solution: 1. The user requests information about them but claims that they lost the password and the email address. 2. The company sends a form (in English) that basically asks for the information on the id (name, date of birth, etc) and the information being requested (ex: password reset). 3. The user prints this form, fills it out and attach a copy of their ID. 4. The user…

Nope, that's not legally safe -- we've been told by data authorities that the verification methods cannot be "overly burdensome" to the data subject.

I live in dread of subject access requests (and thankfully have only had one, and it happened to be really easy to verify).

Re: Black Hat: GDPR privacy law exploited to reveal personal data

#130

Post by tialaramex »

gowld wrote: post #90
csomar wrote: post #17

This is horrible. So right now, in order to get access to data for a certain person, you need to hack your way through a few of the potential services he is using and drive from there. 1. The data might have things like IDs (ie: Crypto exchanges). 2. You can use that data to ask for more data. If you got a copy of his passport, now you can ask for more with this new piece. 3. Looks like some people still store passwo…

This is not a problem with GDPR. This is a problem with organizations (companies and governments) treating publicly data as private keys.

Not private keys, secret keys. "A Secret is something you tell one other person [So I'm telling you]".

But yes, that's exactly the problem, the Credit Reference Agencies actually sell this as a service. They think it's a big improvement, and if they're right that ought to be terrifying - what was being done before this crap? "Nothing" is likely to be the depressing answer.

"Hey, we can tell if this is really Dave Smith, because we'll ask "How much did you spend on your credit card in May?" and the real Dave knows the answer, and so do we. Well yes, and so does anybody who saw Dave's card statement, and people at Dave's bank, and the card company, and... also when Dave answers $849.28 that won't match and gets a bad user experience. Oh you mean the _other_ credit card. Yeah, Dave only spent $30.26 on that, he mostly uses it to buy fuel for his jet ski... So you try to solve this "How much did you spent on the VISA ending 4282 in May?" now you've given away a useful fact to an adversary. Idiots.

Post reply on HN