Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billion-record stolen Chinese database for sale on breach forum

theregister.com

Post reply on HN
Print view View original

51–60 of 258 posts

Re: Billion-record stolen Chinese database for sale on breach forum

#51

Post by swimfar »

bilekas wrote: post #34
tpaksoy wrote: post #16

Apparently there was a "blogpost" of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: https://archive.ph/mP3bh This is completely unverified though, so take it with a grain of salt.

It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.

When you do this is there a way to completely get rid of the information? Usually you can go back an look at the edit history to see the original post.

Re: Billion-record stolen Chinese database for sale on breach forum

#52

Post by juanani »

MadsRC wrote: post #18
pyinstallwoes wrote: post #4

Earlier quoted context omitted.

In history what have databases of people and state actor interests usually led to if any events are similar?

IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to ident…

No post body was provided.

Re: Billion-record stolen Chinese database for sale on breach forum

#53

Post by gonzo41 »

mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

Covid is a good excuse to wear a mask, and pair it with a set of mirror sun glasses in public. Maybe that's how we live now.

Re: Billion-record stolen Chinese database for sale on breach forum

#54

Post by steelaz »

compumike wrote: post #40
throwaway787544 wrote: post #21

Earlier quoted context omitted.

Starting today, this will be known as "Shanghai'd credentials" and be reason #1 why we use ephemeral credentials (e.g. AWS STS/SSO) rather than static credentials (e.g. IAM Users)

Doesn't the client still need to know a long-lived secret (or a long-lived refresh token) in order to generate the ephemeral credentials?

We got rid of all IAM users used by applications and moved to role-based access. Nowhere in the application do you need to enter AWS credentials. AWS SDK will attempt to discover short-lived credentials for you and will assume the role specified at the infrastructure layer, e.g. in a task definition.

Re: Billion-record stolen Chinese database for sale on breach forum

#56

Post by thriftwy »

mvdwoord wrote: post #25
thriftwy wrote: post #9

Earlier quoted context omitted.

A lot of data may be made public to equalize, similarly to how real estate property rights or car registries may be public.

I would counter that, although it could, some groups will be able to evade it, effectively maintaining their advantage/power. Effectively averaging out the position of middle and lower classes, and lowering their chances of moving up the social ladder?

I'm not sure it would give such a large advantage compared to the cost of hiding

Re: Billion-record stolen Chinese database for sale on breach forum

#57

Post by throwaway4good »

hutzlibu wrote: post #46
throwaway4good wrote: post #44

Who would buy this? How could anyone possibly make money off this data set? I could understand if the Chinese government would pay for it to avoid embarrassment but making the sale public kinda voids that.

"Who would buy this?" Foreign intelligence agencies for classic espionage. If you want to do blackmailing in china, such a DB would be a good start. Otherwise, data brokers. Advertisement, financial credibility, trustworthines of buisness partners etc.

I don't know how it works in China but where I am a person's criminal record is not public but not exactly private either. In the sense that an employer can ask for your criminal record and you have the choice giving a printout of it or not having your job. Making it kind of hard to see how the knowledge of a criminal record could be used to blackmail someeone.

As for "data brokers. Advertisement, financial credibility, trustworthines of buisness partners etc.". Maybe. But these companies would turn themselves into criminals by using or purchasing this information.

Re: Billion-record stolen Chinese database for sale on breach forum

#58

Post by pyinstallwoes »

mvdwoord wrote: post #10
pyinstallwoes wrote: post #4

Earlier quoted context omitted.

In history what have databases of people and state actor interests usually led to if any events are similar?

I would say, impossible to compare. Digital changes the cost of acting upon this information, for good or bad purposes. Obvious comparisons to e.g. the Netherlands' famous over-registering of religion and how the Nazis abused that. But I feel this is long term potentially worse than that. Not in the level of horribleness, but in the effect on society moving forward.

Can you extrapolate that on what the effect on society looks like in your assessment?

Re: Billion-record stolen Chinese database for sale on breach forum

#59

Post by aembleton »

swimfar wrote: post #51
bilekas wrote: post #34

Earlier quoted context omitted.

It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.

When you do this is there a way to completely get rid of the information? Usually you can go back an look at the edit history to see the original post.

Change the keys.

Re: Billion-record stolen Chinese database for sale on breach forum

#60

Post by bilekas »

swimfar wrote: post #51
bilekas wrote: post #34

Earlier quoted context omitted.

It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.

When you do this is there a way to completely get rid of the information? Usually you can go back an look at the edit history to see the original post.

Yeah mods can clear the review history - for this very reason!

But as mentioned below - Still advised to change your keys for obvious reasons

Post reply on HN