Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

State Bar of California addresses breach of confidential data

calbar.ca.gov

Post reply on HN
Print view View original

21–30 of 101 posts

Re: State Bar of California addresses breach of confidential data

#21

Post by wslack »

5ESS wrote: post #13
ejb999 wrote: post #6

Doesn't sound like a breach to me - sounds like the state bar association inadvertently gave out the information, and now they are looking for someone to blame - someone else that is.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

It's still a breach if an org misconfigures an API, allowing more records to be available than was indended.

Re: State Bar of California addresses breach of confidential data

#22

Post by d4mi3n »

user3939382 wrote: post #4

This is probably a stupid question to those who work with these concepts often: can all the user data in the DB be hashed with the user’s password so that nothing is gained from a breach? Is this mostly a CPU resource problem or would would jwt architecture preclude that from working? (I haven’t built auth systems for several years)

There's concept similar to what you're describing called crypto-shredding[1]. Hashing isn't a good way ensure the confidentiality of data--just the authenticity--you really want to prefer a solid cryptographic algorithm if your goal is to ensure data remains confidential.

The idea behind crypto shredding is that you have a cryptographic key for each entity in your system and you use that key encrypt all fields for a given record. When it comes time to delete that data, you simply discard the key used to encrypt it. Assuming you've used reasonably good cryptography, this data is now effectively gone.

This is useful in cases where:

* You need to support the right to be forgotten (as defined in the CCPA[2] or GDPR[3]), since all you need to do to "delete" a user's data is to delete the key used to encrypt.

* The data you need to delete exists across multiple data stores/applications/environments and ensuring consistency for the deletion across all these places is difficult. For example: You may have DB backups, long-lived caches, or 3rd party services/vendors that may have copies of this data.

* You want to discard some, but not all, of a user's data. This is important in cases you're required by law to retain specific kinds of information even after a person has required it's deletion. For example, banking and finance companies are required to keep specific records about who they sent money to or performed services for.

1. https://en.wikipedia.org/wiki/Crypto-shredding

2. https://www.oag.ca.gov/privacy/ccpa

3. https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Re: State Bar of California addresses breach of confidential data

#23

Post by akira2501 »

adolph wrote: post #3

Apparently the State Bar has been breaking the law. The State Bar announced today that it is taking urgent action to address a breach of confidential attorney discipline case data that it discovered on February 24. A public website that aggregates nationwide court case records was able to access and display limited case profile data on about 260,000 nonpublic State Bar attorney discipline case records, along with abo…

Is displaying those records in public the violation of the statute? Or was it merely allowing the documents out of their control? Such that.. now they're out, does the website actually have any obligation to follow the "Business and Professions Code?"

Re: State Bar of California addresses breach of confidential data

#24

Post by [deleted] »

LordDragonfang wrote: post #20
5ESS wrote: post #13

Earlier quoted context omitted.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

>Those records were publicly available. The very first paragraph of the article seems to contradict that. Do you have a source that says otherwise?

[deleted]

Re: State Bar of California addresses breach of confidential data

#25

Post by ejb999 »

LordDragonfang wrote: post #20
5ESS wrote: post #13

Earlier quoted context omitted.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

>Those records were publicly available. The very first paragraph of the article seems to contradict that. Do you have a source that says otherwise?

According to the Bar website:

>>>The site owner (of judyrecords) claims that the State Bar’s confidential and public case records were all previously available at a public URL. Is this true?

>>>The State Bar Court website allows the public to search for publicly available case information. The extent to which the external aggregating website was able to obtain nonpublic information that was stored in the Odyssey case management system is still being investigated.

I am inclined to believe judyrecords, until proven otherwise.

Re: State Bar of California addresses breach of confidential data

#26

Post by SllX »

wolverine876 wrote: post #16
coding123 wrote: post #12

Earlier quoted context omitted.

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

Without transparency, including public records, how do we hold the powerful accountable? Court records are public to prevent secret government courts from abusing people (among other reasons). How do we operate a democracy, which depends on citizens controlling their country? And most importantly, who does get access to the records? That exculsive access will give them a lot of power.

Something that stuck out to me about that website is that we really do publish a lot. If you ever had a speeding ticket, that’s a matter of public record now. If you ever had a parking violation, that’s a matter of public record. I mean to be honest, if you just have a car, I can probably find you on that website if I know your name.

Also goes for divorces. By and large I agree with your take, but playing around with the search got me thinking that maybe we just make too much a matter of public record and that some things might just be too noisy, even if it isn’t the biggest privacy violation per se. Still mulling it over though, so I can’t say I’m committed to that position yet, feel free to talk me back.

Re: State Bar of California addresses breach of confidential data

#27

Post by dahfizz »

LordDragonfang wrote: post #20
5ESS wrote: post #13

Earlier quoted context omitted.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

>Those records were publicly available. The very first paragraph of the article seems to contradict that. Do you have a source that says otherwise?

> Was this a hack? And how did this happen?

> We do not know yet. The State Bar’s Odyssey case management system software vendor, Tyler Technologies, has been tasked with investigating what happened, taking the steps needed to rectify the breach, and ensuring something similar does not happen again. The State Bar also retained a team of IT forensics experts to assist in our investigation.

> The site owner claims that the State Bar’s confidential and public case records were all previously available at a public URL. Is this true?

> The State Bar Court website allows the public to search for publicly available case information. The extent to which the external aggregating website was able to obtain nonpublic information that was stored in the Odyssey case management system is still being investigated.

It sounds extremely likely that the state bar had a website misconfigured, and the automated systems of the aggregation site sucked down all the data it was technically (but not legally) given access to.

https://www.calbar.ca.gov/About-Us/News/Data-Breach-Updates

Re: State Bar of California addresses breach of confidential data

#28

Post by Ajedi32 »

stingraycharles wrote: post #9
user3939382 wrote: post #4

This is probably a stupid question to those who work with these concepts often: can all the user data in the DB be hashed with the user’s password so that nothing is gained from a breach? Is this mostly a CPU resource problem or would would jwt architecture preclude that from working? (I haven’t built auth systems for several years)

You could encrypt it with the user’s password instead (rather than hashing it). This is also the approach taken by e.g. password managers, they use your password as a seed for encrypting all your data. The problem is that this would make the database entirely inaccessible unless you have access to the password. That creates quite a lot of friction in the user experience, the user would have to provide his password on…

Users wouldn't need to provide their password on every interaction; just when logging in. The browser could save a derived decryption key in a cookie or local storage and use that to persist the session.

We're basically just discussing end-to-end encryption.

The real reason it's not done more often is that it makes things a lot of things way more complicated from a development perspective. Features like "allow users to send messages to each other" that would normally be really simple to implement suddenly require a whole public key infrastructure and logic to take into account edge cases like "What if the user got a new phone or changed their password and was offline when the message was sent?", or onerous threat models like "What if the server is controlled by an attacker when I sign-in?"

Re: State Bar of California addresses breach of confidential data

#30

Post by ejb999 »

coding123 wrote: post #12
danso wrote: post #2

According to this LA Times [0] story, the records were apparently found on judyrecords.com, a project recently discussed in a Show HN [1] > State Bar officials learned about the posted records on Feb. 24. As of Saturday night, all the confidential information that had been published on the website judyrecords.com — which included case numbers, file dates, information about the types of cases and their statuses, respo…

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

>> we need to entirely change our public records laws... Immediately.

I am certain that many people in government would agree with you - they would LOVE to be able to hide what they are doing and not be held accountable for decisions they make (or don't make). We need more public disclosures, not less, imo.

>>So there are records that were once ‘public’ but are no more, but this database makes them public again.

This website didn't make them public, they just gave others a way to access them - once something is public, and in control of others, it is impossible to make them 'un-public' without violating the 1st amendment.

Post reply on HN