Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One’s breach was inevitable, because we did nothing after Equifax

techcrunch.com

Post reply on HN
Print view View original

131–140 of 161 posts

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#131

Post by sangnoir »

ianlevesque wrote: post #122
sangnoir wrote: post #119

Earlier quoted context omitted.

> This will work for a time, but what happens when the next breach occurs? The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. > Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed. Even…

Careful what you wish for with the low-tech solution. One of the most effective vectors for phone number port-out scams is just showing up to a local cell phone shop and presenting a fake id. Often this is completely free for the attacker since they can just opt to have a new phone added to the account on credit too.

The assessment doesn't need to be based on a potentially counterfeit ID the subject brings, in my hypothetical scheme. It's probably be better to do out-of-band verification with the private/public provider of the ID (State or DMV, for example)

edit: if the value of identity were to be elevated, then the physical security at these locations would be increased to the level of banks or cash-handling facilities to increase the cost of failed attempts at impersonation (to the level similar to attempted cash heists). Infact, the local phone shops should be barred/disincentivized from doing auth badly themselves and should outsource this function, just like they do with creditworthiness.

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#132

Post by Majromax »

SamuelAdams wrote: post #111
rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

I agree, SSN's are a poor form of authentication. What's missing from these conversations is realistic approaches to fixing it. It's a lot like healthcare: plenty of people want to get rid of Obamacare, but they fail to explain what will replace it. > For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such. This will work for…

> I agree, SSN's are a poor form of authentication. What's missing from these conversations is realistic approaches to fixing it.

SSNs are a poor form of authentication because they're ostensibly secret but re-used everywhere. It's just like a password in that regard: no password is secure against reuse, no matter how strong it is on paper.

A minimal change would be to allow/encourage single-use SSN-equivalents, generated on demand by a central authority. That is, someone would give a different "SSN" to their employer, their bank, the IRS, and their cable company (for credit check).

That still provides a point of vulnerability, but that is far better than the current system where a single credit application form is a global compromise. If a single-use number is compromised, it could be easily revoked without affecting the person otherwise. Likewise, numbers could easily be generated with short expiry dates to make use from stored credentials impossible.

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#133

Post by ac29 »

SamuelAdams wrote: post #127
sangnoir wrote: post #119

Earlier quoted context omitted.

> This will work for a time, but what happens when the next breach occurs? The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. > Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed. Even…

> The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. In that case, we already have this today: At the state level, most citizens have a Drivers license or State ID, both of which have a unique ID. At the federal level, all US passports have a unique Passport Number. Grant…

The Real ID Act [0] effectively made all state ID's into national ID's. All but 6 states are already compliant, and the last 6 will likely become compliant by next year, lest their citizens become unable to use domestic air travel without a passport.

[0] https://en.wikipedia.org/wiki/Real_ID_Act

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#134

Post by ben509 »

buboard wrote: post #50

What guarantees does Amazon sell to AWS clients regarding the security of their data?

Up front, I worked at AWS on the CloudHSM team, don't work at AWS any more. I am not a lawyer. This is all my opinion from a very brief analysis.

The customer agreement[4] states:

> 3.1 AWS Security. Without limiting Section 10 or your obligations under Section 4.2, we will implement reasonable and appropriate measures designed to help you secure Your Content against accidental or unlawful loss, access or disclosure.

> 10. Disclaimers. THE SERVICE OFFERINGS ARE PROVIDED “AS IS.”

It goes on with the usual shouty disclaimers.

The service terms[3] state (I'm specifically citing IAM here because it's how you handle a ton of authentication):

> 19.3 You are responsible for maintaining the secrecy and security of the User Credentials (other than any key that we expressly permit you to use publicly). You are solely responsible, and we have no liability, for any activities that occur under the User Credentials, regardless of whether such activities are undertaken by you, your employees, agents, subcontractors or customers, or any other third party.

My read on it:

AWS generally gives you tools to secure your data, and it's largely up to you how you want to do it.

The docs state that if you set IAM to allow or deny access to a service to an authenticated entity, then IAM will do that. If you set up a VPC and shut off a port through a security group, it's going to be locked down.

AWS has a slew of services, and these things can interact in surprising ways. So reading the permissions, you're often wondering[1], "what permissions do I need" and it's not always clear what a permission grants.

To summarize, then, the AWS documentation at a low level gives you some very technical instructions, and at a high level will generally recommend best practices[2].

I will say that IAM is good stuff and works, the issue is the sheer complexity of configuring it all, and a few footguns thrown in for good measure. But AWS should look at adding "security agreements" similar to their Service Level Agreements that guarantee availability.

[1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_perm...

[2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practi...

[3]: https://aws.amazon.com/service-terms/

[4]: https://aws.amazon.com/agreement/

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#135

Post by mindslight »

rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

In the US especially, there is a very good reason to oppose any such measure - there is no political will to implement restrictions on how private companies could use that system.

The setup for these breaches is entirely due to companies being able to require your SSN for whatever purpose, and indefinitely store it basically however they'd like. Either the government should have never assigned a mandatory unique identifier to every individual, or there should have been strict laws about what purposes it could be requested/used for, how it could be stored, and steep statutory liability for screwing those up.

But the political attitude in the US is to have the government do the bare minimum and private companies will take up the charge. However for many subjects the resulting mix is the worst of both worlds - given the tiniest hook into governmental power, the private sector eagerly implements totalitarian solutions for which there is no opting out.

Presently, the naive legal mandates of SSN's, driver's license numbers, and license plates are being heavily abused to enable pervasive corporate surveillance. These existing identifiers already make too good of keys for cross-linking every other ill-gotten datum on a person. The main thing that keeps every single business from demanding these identifiers is people's ambiguous worry of just handing them out, due to their technical shortcomings. Imagine going to a grocery store and having to present your national electronic ID to get the sale prices, with no alternative.

previously: https://news.ycombinator.com/item?id=19880374

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#136

Post by homonculus1 »

dwild wrote: post #117
homonculus1 wrote: post #47

Earlier quoted context omitted.

Similar to constant surveillance, the psychological implications of mandatory ID are horrifying. It tips the scale from "You are born free, but you must fulfill certain obligations to cooperate with others" to "You exist first and foremost through the lens of the government. You are not permitted to live outside the bureaucratic abstraction of you."

> "You exist first and foremost through the lens of the government. You are not permitted to live outside the bureaucratic abstraction of you." Aren't we already at that point?

Sort of, but generally not on the minute-to-minute basis that is being forced to carry government identification at all times. And in cases where that may de facto be the case, e.g. being a minority near a border, that's already abhorrent. That whole paradigm should be reversed rather than further generalized.

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#137

Post by scient »

unclesams-uncle wrote: post #108
rocqua wrote: post #87

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies.…

The Belgians have this tool called "itsme" which acts as authentication manager/digital signature tool with authorized partners. After validating your ID, you can use the app to do 2FA with most major services in the country, including almost every bank and financial institution. https://www.itsme.be/en/ A program like this could go a long way in the US to help cut down on the issue you describe.

You should look into Estonian ID card program. Its exactly what should be done.

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#138

Post by tzs »

giancarlostoro wrote: post #3

I said this on the other HN thread about CapitalOne but I found it ridiculous that Aaron Swartz was facing a hefty sentence and the culprit behind this hack last I checked is facing up to 5 years??? What the heck? For every person exposed in this hack is a single victim to be added. Not to mention the numerous indirectly affected people part of small businesses. Aaron Swartz hacked some ebooks by comparison harming o…

That hefty sentence commonly mentioned for Swartz was using the whale sushi number [1], not a number he actually had even a remote chance of getting [2] [3].

[1] https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...

[2] https://www.popehat.com/2013/03/24/three-things-you-may-not-...

[3] http://volokh.com/2013/01/16/the-criminal-charges-against-aa...

Re: Capital One’s breach was inevitable, because we did nothing after Equifax

#140

Post by NoodleIncident »

asark wrote: post #109
howard941 wrote: post #80

Earlier quoted context omitted.

> they fall into the (unfortunately) too big to fail category They're absolutely not too big to fail. Equifax or FB? Other than the unfortunate employees and their families, does anyone give a shit? No. No one suffers. To the contrary, thinning sick herd members helpfully invigorates the health of the surviving individuals. What these organization are are in too many pockets to be too big to jail. It's a trope but it…

The failure of Facebook might well be stimulative to employment and the economy. Imagine the wave of startups and new initiatives from other companies trying to compete in all the areas Facebook's in now. And unlike banks no significant part of the broader economy is at risk if facebook.com and instagram.com start 404ing forever tomorrow. A hiccup in the "influencer" economy, such as it is, which is negligible anyway…

That just sounds like breaking windows to ensure more work for glassmakers to me. You're also ignoring the value Facebook ads provide to every business who advertises on that platform.
Post reply on HN