Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

State Bar of California addresses breach of confidential data

calbar.ca.gov

Post reply on HN
Print view View original

11–20 of 101 posts

Re: State Bar of California addresses breach of confidential data

#11

Post by willcipriano »

user3939382 wrote: post #4

This is probably a stupid question to those who work with these concepts often: can all the user data in the DB be hashed with the user’s password so that nothing is gained from a breach? Is this mostly a CPU resource problem or would would jwt architecture preclude that from working? (I haven’t built auth systems for several years)

That would seem to only work if the user would only be interested in records created by themselves or that were explicitly shared with them. When sharing both users passwords would have to be stored somewhere, either that or the raw content so that it could be reencrypted.

Private key cryptography would be better, maybe encrypt a private key with a password and store that along with the public?

Re: State Bar of California addresses breach of confidential data

#12

Post by coding123 »

danso wrote: post #2

According to this LA Times [0] story, the records were apparently found on judyrecords.com, a project recently discussed in a Show HN [1] > State Bar officials learned about the posted records on Feb. 24. As of Saturday night, all the confidential information that had been published on the website judyrecords.com — which included case numbers, file dates, information about the types of cases and their statuses, respo…

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that.

I think in the era of go in and get things things should be "public".

Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately.

edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that are sealed, but show up in this database. So there are records that were once ‘public’ but are no more, but this database makes them public again.

I think that website should be taken offline immediately.

Re: State Bar of California addresses breach of confidential data

#13

Post by 5ESS »

ejb999 wrote: post #6

Doesn't sound like a breach to me - sounds like the state bar association inadvertently gave out the information, and now they are looking for someone to blame - someone else that is.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

Re: State Bar of California addresses breach of confidential data

#14

Post by krisoft »

mwint wrote: post #5
user3939382 wrote: post #4

This is probably a stupid question to those who work with these concepts often: can all the user data in the DB be hashed with the user’s password so that nothing is gained from a breach? Is this mostly a CPU resource problem or would would jwt architecture preclude that from working? (I haven’t built auth systems for several years)

Hashing would make the content irretrievable; something like XORing with the password would make the password recoverable if you know the content.

XORing with the password sounds just splendid :D Caesar is asking for his cipher back.

That method wouldn't stop a determined 12 year old, let alone a competent attacker. Please use a properly engineered and implemented encryption instead of coming up with harebrained schemes.

Re: State Bar of California addresses breach of confidential data

#15

Post by 5ESS »

coding123 wrote: post #12
danso wrote: post #2

According to this LA Times [0] story, the records were apparently found on judyrecords.com, a project recently discussed in a Show HN [1] > State Bar officials learned about the posted records on Feb. 24. As of Saturday night, all the confidential information that had been published on the website judyrecords.com — which included case numbers, file dates, information about the types of cases and their statuses, respo…

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

Blame the state governments for publishing those records in the first place. Everyone knows that once information is published on the internet there is really no “undo” button. If judyrecords goes down another, perhaps less scrupulous, operator will release another similar site.

Re: State Bar of California addresses breach of confidential data

#16

Post by wolverine876 »

coding123 wrote: post #12
danso wrote: post #2

According to this LA Times [0] story, the records were apparently found on judyrecords.com, a project recently discussed in a Show HN [1] > State Bar officials learned about the posted records on Feb. 24. As of Saturday night, all the confidential information that had been published on the website judyrecords.com — which included case numbers, file dates, information about the types of cases and their statuses, respo…

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

Without transparency, including public records, how do we hold the powerful accountable? Court records are public to prevent secret government courts from abusing people (among other reasons). How do we operate a democracy, which depends on citizens controlling their country?

And most importantly, who does get access to the records? That exculsive access will give them a lot of power.

Re: State Bar of California addresses breach of confidential data

#17

Post by mistrial9 »

coding123 wrote: post #12
danso wrote: post #2

According to this LA Times [0] story, the records were apparently found on judyrecords.com, a project recently discussed in a Show HN [1] > State Bar officials learned about the posted records on Feb. 24. As of Saturday night, all the confidential information that had been published on the website judyrecords.com — which included case numbers, file dates, information about the types of cases and their statuses, respo…

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

please recall a basic motivation for the formation of the United States of America, versus the Kingdom of Britain under George III. In the legal system of Britain, all Crown records are SECRET unless cleared. Under the Federal Laws of the USA, all Federal records are PUBLIC unless classified.

get the idea?

Re: State Bar of California addresses breach of confidential data

#18

Post by gnicholas »

On a related note, the California Bar website employs dark patterns that mislead members into paying inflated annual dues.

When you renew your membership, there are a variety of addon payments you can opt into by checking boxes for these items. Then, on a later page, there are various addon payments that you have to opt out of.

Making things even trickier, these aren't pre-checked boxes, which might lead the user to realize he needs to uncheck them. Instead, there is a list of "adjustments" with a dropdown menu for each. The dropdown defaults to "none", which would lead users to think that they are not paying for an extra item. But when you click on the dropdown, you see the option to "deduct $x" if you don't want to pay the additional fee.

I've never seen a dark pattern like this anywhere else. Perhaps the folks who run the calbar website could spend less time finding ways to trick members into overpaying and more time securing private information.

Re: State Bar of California addresses breach of confidential data

#20

Post by LordDragonfang »

5ESS wrote: post #13
ejb999 wrote: post #6

Doesn't sound like a breach to me - sounds like the state bar association inadvertently gave out the information, and now they are looking for someone to blame - someone else that is.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

>Those records were publicly available.

The very first paragraph of the article seems to contradict that. Do you have a source that says otherwise?

Post reply on HN