Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the "3 billion people" national public data breach

troyhunt.com

Post reply on HN
Print view View original

371–380 of 472 posts

Re: Inside the "3 billion people" national public data breach

#371

Post by rjmunro »

ses1984 wrote: post #342
makmanalp wrote: post #337

Earlier quoted context omitted.

> Someone can just hash every number from 000-00-0000 to 999-99-9999 and figure out mine from that. That's what salts are for, right? It wouldn't be too hard to issue a very large, known, public salt alongside each SSN. > And of course none of the data brokers have much reason to make opt-outs work well, in the absence of legislation and strict enforcement - it's in their commercial interests to say they "can't stop…

If the salt is public, what’s the point, then you can get all the salts, and combine them with every possible ssn, and you’re back where you were before.

"all the salts" * "all the SSNs" becomes a very big number. With a large enough but still reasonably sized salt, you can engineer it so that hashing all combinations takes an amount of time greater than the age of the universe even if you use all the computers in the world.

Re: Inside the "3 billion people" national public data breach

#372

Post by rjmunro »

laweijfmvo wrote: post #344
adelie wrote: post #35

Earlier quoted context omitted.

my understanding is that there's a bit of a catch-22 with data removal - if you request that a data broker remove ALL of your information, it's impossible for them to keep you from reappearing in their sources later on because that would require them to retain your information (so they can filter you out if you appear again).

1. They could be required to store a private copy of the removal requests, data that they can't sell (not ideal) 2. Sounds like "data brokers" that sell private information just shouldn't exist...

> They could be required to store a private copy of the removal requests

They would leak that in the next data breach.

Re: Inside the "3 billion people" national public data breach

#373

Post by rqtwteye »

Dalewyn wrote: post #288
bhaney wrote: post #84

Earlier quoted context omitted.

I'd be worried about legal repercussions if we were talking about the latest Disney movie, but this is merely the private information of a billion people. Never seen IP law give much of a crap about that before.

1 pirated Disney movie is a tragedy. 3,000,000,000 leaked Social Security Numbers is a statistic. -Joseph "Social Credit" Stalin ...Is it obvious I, as an American who can confirm my SSN (and whatever else) was leaked by this, sincerely couldn't care less because this is leak incident number 897165176548795647564576415671? That $10 UberEats gift card from CrowdStrike would be more valuable than another batch of Free…

UberEats gift cards are the ultimate passive aggressive “fuck you”. To use them, you need to spend at least another 10 to actually get something

Re: Inside the "3 billion people" national public data breach

#374

Post by slg »

dingnuts wrote: post #368
_uhtu wrote: post #365

Earlier quoted context omitted.

This comment is shockingly misguided. The IRS doesn't have the authority to mandate the creation of a secure national ID system and enforce it's use by the financial system. Only congress has the ability to really do that. The IRS collects revenue. Even if it did have that authority, it doesn't have the budget to accomplish that goal.

isn't it funny how no government service is ever at fault, it's always just a problem of funding? The IRS is good, just under funded. Public schools are good, just under funded. The NHS is good, just under funded. The roads are good, just under funded except then funding is raised, and it's still a problem of funding. and inevitably, it's the evil side of the government (you know the one) that is to blame, even if th…

This is neither a problem of funding or any government service being at fault. This is the fault of American culture. A national ID system sounds too scary to too many Americans. Politicians aren't going to waste their political capital on pushing through something so unpopular. It really isn't any more complicated than that. There is a huge desire for some sort of national ID system and SSNs are the closest we got so they filled the vacuum. It is silly to blame that on the IRS. It is a societal failure.

Re: Inside the "3 billion people" national public data breach

#375

Post by blackguardx »

d_burfoot wrote: post #345

It's worth remembering that the main reason this kind of data breach is a real problem is mostly due to the incompetence of the IRS. For any serious financial organization, knowing a person's SSN, name, address, etc doesn't allow you to access or withdraw that person's finances. But the stupidity of the IRS means that people are easily targeted by false tax return attacks. File a fake tax return for someone, using th…

What you describe might be out of date. Someone tried to use my identity to file a fake tax return. The IRS caught it and now I get issued a PIN every tax season for kinda-sorta two factor auth.

Re: Inside the "3 billion people" national public data breach

#377

Post by LeifCarrotson »

Sylamore wrote: post #349
ryanisnan wrote: post #62

Earlier quoted context omitted.

You probably are posting this as a joke, but without a clear technical solution to this problem, flooding the industry with bullshit data seems like a great avenue.

That has been my strategy for the last decade or so, Unless I have a solid reason to I never use my real name when placing orders and generally never the same fake name twice, always use a virtual credit card, if it's a non-physical product I don't even use my real address. I have some old phones I throw pre-paid sim cards into when I need to do number confirmation. The goal is to create a little consistent linkable…

I do the same, I worry that eventually someone's going to need to see my driver's license and refuse me because my ancient account info doesn't match.

"It says here that this shipment is for Firstname Lastname at 1 Main St, Yourcity, born January 1st in the same year as you. Your license has a different address and different birth day and month, so you're not the same person."

Re: Inside the "3 billion people" national public data breach

#378

Post by kaiwenwang »

diggan wrote: post #369
Vicinity9635 wrote: post #363

Earlier quoted context omitted.

I dug into this a little and one of the files is 164GB. How do you even work with these files? That is, how would I search for my SSN on my windows box?

That's not even that big? `cat big_file | grep -v my_term` would go line-by-line and show any lines matching your query. If you're doing a lot of queries, you'd probably want to index it, so you throw it into a sqlite database with the usual SQL utils. Edit: I missed you said Windows. Probably Powershell have similar utilities, so you can do `ReadFileLineByLine \r \d big_file | ReturnHitBySearchTerm \v \t \s my_term`…

Using sift on a 100GB txt file still takes multiple minutes. I haven't tried ag, but grep is supposedly slower.

Re: Inside the "3 billion people" national public data breach

#379

Post by jonathanlb »

dingnuts wrote: post #368
_uhtu wrote: post #365

Earlier quoted context omitted.

This comment is shockingly misguided. The IRS doesn't have the authority to mandate the creation of a secure national ID system and enforce it's use by the financial system. Only congress has the ability to really do that. The IRS collects revenue. Even if it did have that authority, it doesn't have the budget to accomplish that goal.

isn't it funny how no government service is ever at fault, it's always just a problem of funding? The IRS is good, just under funded. Public schools are good, just under funded. The NHS is good, just under funded. The roads are good, just under funded except then funding is raised, and it's still a problem of funding. and inevitably, it's the evil side of the government (you know the one) that is to blame, even if th…

In the private sector, OKRs and KPIs are used to track performance and provide metrics on whether a company is meeting its goals. Boards review these metrics and decide on additional investments based on thorough cost/benefit analyses.

I imagine it's similar in the public sector, where funding is determined by the needs of the public, political considerations, long-term planning, and so on.

Re: Inside the "3 billion people" national public data breach

#380

Post by vineyardmike »

kube-system wrote: post #108
vineyardmike wrote: post #72

Earlier quoted context omitted.

> Even something as simple as SSN + DOB runs into loads of potential formatting and data entry issues you'll have to perfectly solve You don’t have to solve it perfectly to be an improvement. Also this is BS. Not every bit of data is perfectly formatted and structured but both of your examples are structured data. You can 100% reliably and deterministically hash this data. There’s so much in your argument that can be…

> You don’t have to solve it perfectly to be an improvement. They don't want to solve your problem. You aren't their customer. They want to comply with the letter of the request in as much as it covers their own butt in terms of regulatory requirements and/or political optics.

The “solution” mentioned is political. A requirement that data on an individual is properly deleted when presented with the data would be “good”. A requirement that captures every nuance of mistakes would be “perfect”.

Hashing a birthday and SSN is deterministic. We could deterministically keep that data deleted. This would be better than we have today, and could be done reliably and affordably.

The companies can easily be required (by law) to implement the “good” solution. Everyone complaining it’s not “perfect” is stopping “good”.

Post reply on HN