Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Source code of Swedish e-government services has been leaked

darkwebinformer.com

Post reply on HN
Print view View original

111–120 of 263 posts

Re: Source code of Swedish e-government services has been leaked

#111

Post by ROllerozxa »

ivell wrote: post #106
picafrost wrote: post #72

Earlier quoted context omitted.

I think this is good to highlight for non-Scandinavians. Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings. Personal identification numbers do not tend to be considered private in the same…

How do they have handle identity thefts, spams, etc.? There are so many ways to misuse these data. Are the residents not concerned about this?

> How do they handle identity thefts

By just accepting it as a normal fact of life that you will have some random stuff ordered in your name sooner or later with an invoice you'll have to dispute. Happened to a relative of mine, police do not care unless they order things above a certain value, without a police report you cannot get free ID protection, and then you'll have to sit for a long time in phone queues trying to cancel a subscription for a streaming service or whatever they ordered while get thrown around by support reps who go "you SURE you or someone in your family didn't order this?"

Re: Source code of Swedish e-government services has been leaked

#112

Post by PeterisP »

ivell wrote: post #106
picafrost wrote: post #72

Earlier quoted context omitted.

I think this is good to highlight for non-Scandinavians. Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings. Personal identification numbers do not tend to be considered private in the same…

How do they have handle identity thefts, spams, etc.? There are so many ways to misuse these data. Are the residents not concerned about this?

The root cause of identity theft in USA and some other places is the lack of "proper" national identity and the associated use of various personal "secrets" (not that secret) for identity verification because there are no good easy other ways.

Businesses in Scandinavia and many other countries would not treat someone knowing your personal information as any evidence of identity (because it's not); having all that information is not sufficient to impersonate you there - identity theft does happen but it would require stealing or forging physical documents or actual credentials to things like bank accounts; knowing all of what your mother or spouse would know is not enough to e.g. get credit or get valuable goods in your name.

Re: Source code of Swedish e-government services has been leaked

#113

Post by bondarchuk »

boxed wrote: post #108
ivell wrote: post #106

Earlier quoted context omitted.

How do they have handle identity thefts, spams, etc.? There are so many ways to misuse these data. Are the residents not concerned about this?

It's just a unique ID of a person, it's not a password. I don't see how you can be confused by this.

It's also "anyone's brokerage account holdings, addresses, phone numbers" according to the comment that this subthread of the conversation is about.

Re: Source code of Swedish e-government services has been leaked

#114

Post by einr »

ptx wrote: post #110
einr wrote: post #88

Earlier quoted context omitted.

To the best of my understanding it means that a system made by CGI for digital signing of documents (as in: you get something like a PDF from a government agency and need to digitally sign it and send it back) has had its source code and/or some data belonging to it leaked. Skatteverket, the Swedish tax authority, has been quoted in media as confirming that they use CGI's system for digital document signing but that…

So if no data was leaked from the tax agency or from the users, then the leaked "digital signing documents" must have belonged to the only remaining party, which is CGI, so perhaps they were just some marketing documents about the benefits of their digital signing service?

The original phrasing from the attacker, from the website that put the data up for download/sale, was ”documents (for electronic signing)” which implies that they’re documents that would be signed in said system. I would take all of this with a large helping of salt though. CGI claims it’s not real production data anyway; maybe it is and maybe it’s not.

The best case scenario is in line with what CGI claims: these are lorem ipsum fake docs from an old git repo for a test instance of the system.

Re: Source code of Swedish e-government services has been leaked

#115

Post by teroshan »

elwebmaster wrote: post #59

Anything taxpayer funded should be open source to begin with.

Similarly taxpayer funded contracts for any type of infrastructure (obviously I have digital infrastructure powered by proprietary solutions in mind) should only be awarded if interoperability is guaranteed to prevent lock-in and abuse.

Re: Source code of Swedish e-government services has been leaked

#116

Post by vodkapump »

arcticfox wrote: post #107
ale wrote: post #104

Earlier quoted context omitted.

Yes and no. You get notified if someone else actually asks for your revenue info and so in practice nobody actually does it.

Is this not trivial to get a random person to check stuff for you in exchange for making requests for them (on people they are interested in)? Or is that illegal?

There's paid services that pull it for you, most charging around 100nok (10eur) per lookup.[1]

Media is also allowed to pull "top" lists like the 100 people with the most income in a city, 100 people with the most wealth in a city, etc.

[1] https://sjekkskatt.no/

Re: Source code of Swedish e-government services has been leaked

#117

Post by ExoticPearTree »

corroclaro wrote: post #18

This keeps happening in Europe with these mega-IT suppliers repeatedly getting exposed using very bad development practices. Sweden most recently had a major breach back in 2024 when the other large IT services supplier TietoEvry had their data centres breached and claimed "not actually an issue of security". Several government organisations / regional authorities and companies were down. Last I heard several medical…

The probleme here is that what tends to happen is that the security requirements are relatively vague and once the customer has signed the acceptance, good luck.

And signing up with a big company is good way to cover your behind, because "if they with all their people and knowledge could not do it...". Basically the mantra or "Nobody was ever fired for buying Cisco".

Re: Source code of Swedish e-government services has been leaked

#118

Post by ExoticPearTree »

vladms wrote: post #33
corroclaro wrote: post #18

This keeps happening in Europe with these mega-IT suppliers repeatedly getting exposed using very bad development practices. Sweden most recently had a major breach back in 2024 when the other large IT services supplier TietoEvry had their data centres breached and claimed "not actually an issue of security". Several government organisations / regional authorities and companies were down. Last I heard several medical…

> Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity So what you think would be the solution ? From what I see (both public tender or not), I would claim that "any large IT project/company will suffer from security issues", so not sure what is the added value to single out a process (the…

Split giant projects into small ones, award it to better smaller companies, require interoperability via API that is clearly documented and ask for around the clock security monitoring and patching. The last things being the same thing you do at any decent private company.

IBM or Accenture or whoever don't need to be the only ones winning tenders.

Re: Source code of Swedish e-government services has been leaked

#119

Post by matsemann »

rebolek wrote: post #12

Maybe they should go open source from the start, then there's nothing to leak. P.S.: And strangers will sometimes help you find vulnerabilities (and sometimes be very obnoxious but that's not open source's fault).

When I worked for the government in Norway, it slowly changed to all code being developed in the open. 3k repos here now: https://github.com/orgs/navikt/repositories

When I started it was a big security theater. Had to develop on thin clients with no external internet access, for instance. Then they got some great people in charge that modernized everything.

Only drawback is when you quit, you have to make sure to unsubscribe from everything, hehe. When quitting a private company I was just removed from the github org. Here I was as well, but I was still subscribed to lots of repos, issues, PRs,heh.

Post reply on HN