Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the "3 billion people" national public data breach

troyhunt.com

Post reply on HN
Print view View original

351–360 of 472 posts

Re: Inside the "3 billion people" national public data breach

#351

Post by makmanalp »

ses1984 wrote: post #342
makmanalp wrote: post #337

Earlier quoted context omitted.

> Someone can just hash every number from 000-00-0000 to 999-99-9999 and figure out mine from that. That's what salts are for, right? It wouldn't be too hard to issue a very large, known, public salt alongside each SSN. > And of course none of the data brokers have much reason to make opt-outs work well, in the absence of legislation and strict enforcement - it's in their commercial interests to say they "can't stop…

If the salt is public, what’s the point, then you can get all the salts, and combine them with every possible ssn, and you’re back where you were before.

No, that is kind of the point of a salt is that it doesn't need to be hidden - it's designed for a scenario where e.g. your database is hacked and they're visible as plaintext: https://en.wikipedia.org/wiki/Salt_(cryptography)

Since the salts are random, unique to each SSN and long: a) you'll find no existing rainbow table that contains the correct plaintext for your SSN hash and b) each SSN now requires its own bruteforcing that is unhelpful for any of the other SSNs

Combine that with a very expensive hashing method like PBKDF2 (I'm sure there's something better by now) and you've made it pretty dang hard for non state actors to bruteforce a significant chunk of SSNs. There's also peppers that involve storing some more global secrets on HSMs.

I'm sure the crypto nerds have like a dozen better methods than what I can come up with but the point is this is not a feasibility issue.

Re: Inside the "3 billion people" national public data breach

#352

Post by John23832 »

ses1984 wrote: post #342
makmanalp wrote: post #337

Earlier quoted context omitted.

> Someone can just hash every number from 000-00-0000 to 999-99-9999 and figure out mine from that. That's what salts are for, right? It wouldn't be too hard to issue a very large, known, public salt alongside each SSN. > And of course none of the data brokers have much reason to make opt-outs work well, in the absence of legislation and strict enforcement - it's in their commercial interests to say they "can't stop…

If the salt is public, what’s the point, then you can get all the salts, and combine them with every possible ssn, and you’re back where you were before.

A salt works by altering altering the encrypted output. It's not a secret (though it's often kept secret for an added layer of obscurity).

Re: Inside the "3 billion people" national public data breach

#353

Post by farceSpherule »

I worked incident response for years, logging thousands of hours of actual on site work with impacted clients.

No on cares.

Clients see this as the cost of doing business and have no incentive to do better. Even after Equifax and OPM.

Until we have a GDPR style law in the U.S. it will continue to be status quo.

Re: Inside the "3 billion people" national public data breach

#354

Post by smileysteve »

d_burfoot wrote: post #345

It's worth remembering that the main reason this kind of data breach is a real problem is mostly due to the incompetence of the IRS. For any serious financial organization, knowing a person's SSN, name, address, etc doesn't allow you to access or withdraw that person's finances. But the stupidity of the IRS means that people are easily targeted by false tax return attacks. File a fake tax return for someone, using th…

But not just the IRS; the banking system, most healthcare providers, states for most of a century, and the credit bureaus for REusing SSN as unique identifier "passwords".

Re: Inside the "3 billion people" national public data breach

#355

Post by eks391 »

spdif899 wrote: post #159
0x2a wrote: post #13

Earlier quoted context omitted.

Permission Slip by Consumer Reports (automated): https://permissionslipcr.com Simple Opt Out (manual list): https://simpleoptout.com

I use permission slip and I am not in the breach as far as I can tell

Did you use a grep command? The file is too large for me to open and I have not used grep before to have confidence with it.

Edit: nvm, ``` findstr /i /r ".000000000." ssn.txt ``` did the trick in powershell, with the zeros replaced with the ssn. Also there is a star after each period that HN has changed to italicize the text instead of showing it.

Re: Inside the "3 billion people" national public data breach

#356

Post by autoexec »

ruthmarx wrote: post #321
autoexec wrote: post #199

Earlier quoted context omitted.

that was the idea behind certain applications and add-ons that would browse around to popular websites and randomly click ads so that marketers couldn't tell your actual interests from fake ones. Unfortunately that strategy is deeply flawed and dangerous because nobody cares if the data they have on you is accurate or not. They still can, and still will, use it against you at every opportunity. Every scrap of data th…

> Every scrap of data they have, accurate or not, can be used to hurt you. What are some examples of inaccurate data, as in completely false data, being able to hurt me?

You can never know what might prejudice someone else against you. Maybe you get flagged as being gay when you aren't, or as holding certain religious or political views that you don't. Extremists, activists, and protestors can go to a data broker and buy up lists of people to harass or attack. Data brokers have already been caught collecting data on people who visited Planned Parenthood locations and selling that data to anti-abortion groups.

You could be incorrectly flagged as having more money than you do, causing companies to charge you more than they charge your neighbors for the exact same items. Discriminatory pricing has been happening for a very long time. Just using a different browser can cause prices for some online services to change. (https://www.bostonglobe.com/business/2014/10/22/online-shopp...) For example, Apple users might be seen as having/spending more money and so the prices they get for hotels and airfare can be higher. Increasingly, brick and mortar stores have been trying to get in on the action too. (https://link.springer.com/article/10.1057/s41272-019-00224-3)

If you have a browser extension that randomly visits sites and clicks on ads. Maybe it clicks a bunch of ads for alcohol or marijuana. Maybe it clicks on ads for mental health services, addiction/recovery services, or suicide hotlines. That data can be used against you in court during a divorce/child custody case. It might make a company less likely to hire you. It might cause your health insurance company to charge you more.

Maybe it clicks on ads for DUI attorneys and suddenly your auto insurance rates go up. The company isn't going to tell that's why. They might not even know why. their algorithm just decided you were more high risk than before.

Every data broker is creating a dossier with your name on it, and they are stuffing it with every scrap of data they can get their hands on. That data can cost you a job or a rental contract (see https://nypost.com/2022/12/20/how-employers-spy-on-your-sear... and https://themarkup.org/locked-out/2020/05/28/access-denied-fa...).

The data being collected on you can get you arrested or questioned by police. (see for example https://www.nbcnews.com/news/us-news/police-google-reverse-k... and worse https://www.nbcnews.com/news/us-news/google-tracked-his-bike...)

Any data for sale, accurate or not, is going to be used against you. The people paying data brokers for information about you aren't doing it because they want to help you. They want to help themselves at your expense. And its insane how many people are buying up that data and using it whenever they feel it might give them even the smallest advantage. Companies are using that data to decide things like how long to leave you on hold when you call them. (https://www.nytimes.com/2019/11/04/business/secret-consumer-...)

Re: Inside the "3 billion people" national public data breach

#358

Post by Aeolun »

mango7283 wrote: post #261
Aeolun wrote: post #185

Earlier quoted context omitted.

Has anyone been able to reverse this base64 encryption? Whatever am I going to do with this?

https://www.base64decode.org/ I hope this helps you

It was a joke, but thank you. The internet needs more helpful people.

Re: Inside the "3 billion people" national public data breach

#359

Post by gosub100 »

tmountain wrote: post #346
NineStarPoint wrote: post #335

Earlier quoted context omitted.

You could freeze your credit, it you wanted to be careful. Realistically though, you should have already been monitoring to check if unexpected things were being done in your name. I’ve presumed that all our SSNs have been out there for years now due to one hack or another, that this hack just makes it indisputable doesn’t change much.

What's required to freeze/unfreeze your credit? Your SSN and address info? All of that is in the breach for millions of people.

Just like a lock on the door, it raises the barrier to a non trivial level. It does not give you a ft Knox level impenetrable fortress.

I recently froze my credit with the big 3 and it was easier than I pictured. I don't know if they slow you down if you try to unfreeze it immediately after clicking "forgot password".

Re: Inside the "3 billion people" national public data breach

#360

Post by Dylan16807 »

akimbostrawman wrote: post #314
Dylan16807 wrote: post #278

Earlier quoted context omitted.

That doesn't make it any less racist! But please give some more details on that. The only case I've heard about was a single attacker who was incorrectly called an immigrant.

It adds context which people who manipulate the overtone window for political games and name calling like to exclude. The person was a immigrants child. Considering there obvious (violent) refusal to integrate they are too an immigrant.

It's completely bonkers to have retaliation like that against a single attack that isn't part of a pattern.

Like, that context arguably makes it worse than if there was no inciting incident, because it's so blatantly blaming a huge group for one person.

Post reply on HN