Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Customs Database Of Traveler Photos Was Hacked And Stolen

buzzfeednews.com

Post reply on HN
Print view View original

161–170 of 207 posts

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#161

Post by DrJokepu »

taneq wrote: post #159
cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

And this is the same group that can force you to give them your social media credentials on entry. Terrific. Edit: Wait, just social media handles/account names, not login details. That's less ridiculous. My mistake.

If someone hacks into the DHS or DOS database and gets your ESTA / visa application information, trust me, your social media handles leaking will be the least of your problems, there's plenty of juicier information about travelers in there already.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#162

Post by maskedinvader »

EForEndeavour wrote: post #154
cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of dat…

I am not going to speak for the OP, but the way I would read it is, don't keep centralized pot of gold,aka centralized servers, don't do dumb lazy things aka plain text passwords, etc, don't collect all that extra data, store data with good encryption,don't trade short term convenience for long term harm , FWIW, my personal view is that we should keep pushing for both , less data and more security for the little data we allow our governments or private companies to collect

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#163

Post by all_blue_chucks »

acdha wrote: post #35
axaxs wrote: post #9

> On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network > CBP ... is closely monitoring all CBP work by the subcontractor What. In the private sector, they'd have been fired and probably legal action levelled against them. Th…

“In the private sector” covers a lot of ground and I have extreme skepticism about your faith in the process unfolding that way: ask yourself how many breaches you’ve been part of and whether anything more than a press release happened along with waiting for the news to die down. How many customers did Experian lose? (In the enterprise software world, I can tell you how epic failure to perform on an 8+ figure contrac…

> How many customers did Experian lose?

Experian didn't lose any customer data, though. They only lost data on their products. Their actual customers had no reason to stop paying for their services.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#164

Post by paul7986 »

all_blue_chucks wrote: post #163
acdha wrote: post #35

Earlier quoted context omitted.

“In the private sector” covers a lot of ground and I have extreme skepticism about your faith in the process unfolding that way: ask yourself how many breaches you’ve been part of and whether anything more than a press release happened along with waiting for the news to die down. How many customers did Experian lose? (In the enterprise software world, I can tell you how epic failure to perform on an 8+ figure contrac…

> How many customers did Experian lose? Experian didn't lose any customer data, though. They only lost data on their products. Their actual customers had no reason to stop paying for their services.

It was Equifax not Experian.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#165

Post by maskedinvader »

DrJokepu wrote: post #161
taneq wrote: post #159

Earlier quoted context omitted.

And this is the same group that can force you to give them your social media credentials on entry. Terrific. Edit: Wait, just social media handles/account names, not login details. That's less ridiculous. My mistake.

If someone hacks into the DHS or DOS database and gets your ESTA / visa application information, trust me, your social media handles leaking will be the least of your problems, there's plenty of juicier information about travelers in there already.

hey at least your insta stories and snapchat stories are safe, hurray to ephemeral messaging ! /sarcasm

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#166

Post by 01100011 »

MrMorden wrote: post #102
savethefuture wrote: post #80

The photos were transferred to a subcontractor’s network and later stolen through a “malicious cyberattack,” a CBP spokesperson told TechCrunch in an email. Anyone think they approved the security of that subcontractor before giving sensitive information to them? More importantantly, why is that type of data leaving CBP in the first place?

Compliance with NIST SP 800-53 is mandatory per statute and DHS policy. That system has an identified ISSO, ISSM, ISSPM, DAO, and AO who are responsible for authority to operate being given. If the paperwork is in place, a government employee signed off on that network's operation. If not, it doesn't have ATO and there's a government employee (the AO or CIO) responsible for allowing a such a network to be connected t…

I worked at a government contractor who was rolling out NIST compliance. Everyone, from IT to engineers, hated it. You can rest assured that as soon as someone isn't looking, they're going to violate it.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#167

Post by oska »

EForEndeavour wrote: post #154
cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of dat…

> an oft-repeated truism that is as useless as "the only winning move is not to play"

Not sure why you see that as useless; it's basically the moral takeaway from Hamlet. There are many situations where it's best to not join in 'the game'.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#168

Post by maerF0x0 »

cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

The goal isnt to prevent it in an absolute sense. The goal is to raise the cost to either above the value of the data contained therein or compared to other direct means, like in person espionage or military actions.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#169

Post by sokoloff »

taneq wrote: post #159
cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

And this is the same group that can force you to give them your social media credentials on entry. Terrific. Edit: Wait, just social media handles/account names, not login details. That's less ridiculous. My mistake.

Credentials or just account names?

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#170

Post by cheschire »

EForEndeavour wrote: post #154
cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of dat…

there are ways to store this information without storing the photos. Developing signatures which are stored and discarding the photos, for example. Consider how a site like haveibeenpwned works.

The photos themselves are pretty useless anyways. A database of images will only ever be searched by an ML algorithm for which signatures should be good enough anyways, or manually, based on highly specific timestamps, by some form of police.

Post reply on HN