Billion-record stolen Chinese database for sale on breach forum • Hacker News Board

Re: Billion-record stolen Chinese database for sale on breach forum

#81

Post by chasd00 » Tue, Jul 05, 2022, 7:15 PM UTC

Natfan wrote: post #32

MadsRC wrote: post #18

Earlier quoted context omitted.

IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to ident…

"Fun" fact: It was IBM who helped tabulate data from the 1933 national census, which was then used to identify hundreds of thousands more Jews than would have been found by the Nazi party without their efforts. "Machine-tabulated census data greatly expanded the estimated number of Jews in Germany by identifying individuals with only one or a few Jewish ancestors. Previous estimates of 400,000 to 600,000 were abandon…

Did working with IBM contribute to Hitler’s spiral into insanity? 4/5 joking

Re: Billion-record stolen Chinese database for sale on breach forum

#82

Post by shapefrog » Tue, Jul 05, 2022, 7:15 PM UTC

pyinstallwoes wrote: post #4

mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

In history what have databases of people and state actor interests usually led to if any events are similar?

Spam and phishing calls.

Re: Billion-record stolen Chinese database for sale on breach forum

#83

Post by swader999 » Tue, Jul 05, 2022, 7:19 PM UTC

mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

I just change my name every few years. Makes the job hunt difficult but I like a challenge.

Re: Billion-record stolen Chinese database for sale on breach forum

#84

Post by yellow5 » Tue, Jul 05, 2022, 7:20 PM UTC

t_mann wrote: post #36

MadsRC wrote: post #18

Earlier quoted context omitted.

IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to ident…

Church books were used to find Jews? Do you have a source for that?

No post body was provided.

Re: Billion-record stolen Chinese database for sale on breach forum

#85

Post by cm2012 » Tue, Jul 05, 2022, 7:21 PM UTC

mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

Well, leak can mean a lot of things.

The standard "leak" of names and addresses of people is totally meaningless, though HN "privacy" obsessives blow it out of the water all the time. It's basically public information, we used to have everyone in phone books in the US and almost no one cared.

Cell phone number is a riskier one because of the opportunity for 2FA hacks. It's not hard to get people's cell phone numbers as it is (you can buy direct marketing lists for pennies per person in the US) but its not good to make it easy for hackers.

However this leak in particular appears to go much deeper so it is insidious. Police records are named and who knows what else. That is a genuine privacy issue and sucks for those involved.

Re: Billion-record stolen Chinese database for sale on breach forum

#86

Post by swader999 » Tue, Jul 05, 2022, 7:21 PM UTC

carapace wrote: post #67

mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

> What do we do now? Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". In the "Star Trek" future the people in charge are themselves also subject to the panopticon, and the world is ruled fairly and humanely. (The other name I use for this is the "Tyranny of Mrs. Grundy".) In the "North Korea" future ther…

And CEO's - everyone!

Re: Billion-record stolen Chinese database for sale on breach forum

#87

Post by robonerd » Tue, Jul 05, 2022, 7:28 PM UTC

toomuchtodo wrote: post #41

compumike wrote: post #40

Earlier quoted context omitted.

Doesn't the client still need to know a long-lived secret (or a long-lived refresh token) in order to generate the ephemeral credentials?

It can either use a secret injected into an env var to bootstrap rotating ephemeral/refresh tokens or use a role provided by the environment (which can also provide short lived tokens), depending on your runtime environment and use case (on prem, cloud, k8s, etc). Static, long lived secrets with limited governance that have no conditional access guards are weapons of mass self destruction.

Keeping secrets in environmental variables has always seemed dodgy to me. Unless specifically cleared, they get inherited by all child processes. Maybe there are never any child processes in your application, or that could be desired behavior in some circumstances, but generally it seems like asking for trouble.

Re: Billion-record stolen Chinese database for sale on breach forum

#88

Post by kbenson » Tue, Jul 05, 2022, 7:31 PM UTC

compumike wrote: post #40

throwaway787544 wrote: post #21

Earlier quoted context omitted.

Starting today, this will be known as "Shanghai'd credentials" and be reason #1 why we use ephemeral credentials (e.g. AWS STS/SSO) rather than static credentials (e.g. IAM Users)

Doesn't the client still need to know a long-lived secret (or a long-lived refresh token) in order to generate the ephemeral credentials?

One of the major benefits of ephemeral tokens is that they become less attractive to put into the code, and more attractive to put in a config file/vault that's easier to update and keep secret. This in itself is useful because it makes it less likely that it will be in some source file someone shows, or pushed to some remote repo that at some point has permissions allowed so people can see it.

Re: Billion-record stolen Chinese database for sale on breach forum

#89

Post by thedougd » Tue, Jul 05, 2022, 7:34 PM UTC

compumike wrote: post #40

throwaway787544 wrote: post #21

Earlier quoted context omitted.

Starting today, this will be known as "Shanghai'd credentials" and be reason #1 why we use ephemeral credentials (e.g. AWS STS/SSO) rather than static credentials (e.g. IAM Users)

Doesn't the client still need to know a long-lived secret (or a long-lived refresh token) in order to generate the ephemeral credentials?

You may also setup federated (trusted) relationships. For example, a GitHub Workflow can be trusted to assume an IAM role. In that scenario, there's no long lived secret in scope.

The oidc subject includes the GitHub org, repo, branch, and environment for the IAM assume role policy to match or filter.

Re: Billion-record stolen Chinese database for sale on breach forum

#90

Post by SoylentYellow » Tue, Jul 05, 2022, 7:35 PM UTC

throwaway4good wrote: post #44

Who would buy this? How could anyone possibly make money off this data set? I could understand if the Chinese government would pay for it to avoid embarrassment but making the sale public kinda voids that.

China has foreign call scams just like the US.