Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

State Bar of California addresses breach of confidential data

calbar.ca.gov

Post reply on HN
Print view View original

31–40 of 101 posts

Re: State Bar of California addresses breach of confidential data

#31

Post by johnmarcus »

user3939382 wrote: post #4

This is probably a stupid question to those who work with these concepts often: can all the user data in the DB be hashed with the user’s password so that nothing is gained from a breach? Is this mostly a CPU resource problem or would would jwt architecture preclude that from working? (I haven’t built auth systems for several years)

The data is read by more than one person, so this likely wouldn't work.

Also, I'm not sure this is an actual breach. I think they accidentally published the data themselves, that's the vibe I'm getting from reading between the lines. It's like the code maybe missed checking a flag that would exclude private records from showing.

Re: State Bar of California addresses breach of confidential data

#32

Post by 5ESS »

ejb999 wrote: post #25
LordDragonfang wrote: post #20

Earlier quoted context omitted.

>Those records were publicly available. The very first paragraph of the article seems to contradict that. Do you have a source that says otherwise?

According to the Bar website: >>>The site owner (of judyrecords) claims that the State Bar’s confidential and public case records were all previously available at a public URL. Is this true? >>>The State Bar Court website allows the public to search for publicly available case information. The extent to which the external aggregating website was able to obtain nonpublic information that was stored in the Odyssey case…

It’s pretty gross that they won’t admit they made a mistake and instead choose to mislead the public using deceptive language.

Re: State Bar of California addresses breach of confidential data

#33

Post by kelseyfrog »

Ajedi32 wrote: post #28
stingraycharles wrote: post #9

Earlier quoted context omitted.

You could encrypt it with the user’s password instead (rather than hashing it). This is also the approach taken by e.g. password managers, they use your password as a seed for encrypting all your data. The problem is that this would make the database entirely inaccessible unless you have access to the password. That creates quite a lot of friction in the user experience, the user would have to provide his password on…

Users wouldn't need to provide their password on every interaction; just when logging in. The browser could save a derived decryption key in a cookie or local storage and use that to persist the session. We're basically just discussing end-to-end encryption. The real reason it's not done more often is that it makes things a lot of things way more complicated from a development perspective. Features like "allow users…

Not exactly following. Couldn't DMs simply not be E2E encrypted while maintaining encryption for personal info?

Re: State Bar of California addresses breach of confidential data

#34

Post by djbusby »

ejb999 wrote: post #30
coding123 wrote: post #12

Earlier quoted context omitted.

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

>> we need to entirely change our public records laws... Immediately. I am certain that many people in government would agree with you - they would LOVE to be able to hide what they are doing and not be held accountable for decisions they make (or don't make). We need more public disclosures, not less, imo. >>So there are records that were once ‘public’ but are no more, but this database makes them public again. This…

What's the point of sealed records then? How would that be managed? We should let citizens have some privacy right?

Re: State Bar of California addresses breach of confidential data

#35

Post by oh_sigh »

SllX wrote: post #26
wolverine876 wrote: post #16

Earlier quoted context omitted.

Without transparency, including public records, how do we hold the powerful accountable? Court records are public to prevent secret government courts from abusing people (among other reasons). How do we operate a democracy, which depends on citizens controlling their country? And most importantly, who does get access to the records? That exculsive access will give them a lot of power.

Something that stuck out to me about that website is that we really do publish a lot. If you ever had a speeding ticket, that’s a matter of public record now. If you ever had a parking violation, that’s a matter of public record. I mean to be honest, if you just have a car, I can probably find you on that website if I know your name. Also goes for divorces. By and large I agree with your take, but playing around with…

I have owned a car in NY, FL, and CA, have been married, and have received parking violations in all 3 of those states, and my very unique name is not present at all on that website.

Re: State Bar of California addresses breach of confidential data

#36

Post by ejb999 »

5ESS wrote: post #32
ejb999 wrote: post #25

Earlier quoted context omitted.

According to the Bar website: >>>The site owner (of judyrecords) claims that the State Bar’s confidential and public case records were all previously available at a public URL. Is this true? >>>The State Bar Court website allows the public to search for publicly available case information. The extent to which the external aggregating website was able to obtain nonpublic information that was stored in the Odyssey case…

It’s pretty gross that they won’t admit they made a mistake and instead choose to mislead the public using deceptive language.

Yep, not unlike the other recent story where someone scraped a website and ended up pulling in SSN's and other personal information that was on the page, but not visible (but in the html) - and then the government threatened to prosecute the person who reported the problem.

A perfect example why MORE public information is better than less.

Re: State Bar of California addresses breach of confidential data

#37

Post by ejb999 »

djbusby wrote: post #34
ejb999 wrote: post #30

Earlier quoted context omitted.

>> we need to entirely change our public records laws... Immediately. I am certain that many people in government would agree with you - they would LOVE to be able to hide what they are doing and not be held accountable for decisions they make (or don't make). We need more public disclosures, not less, imo. >>So there are records that were once ‘public’ but are no more, but this database makes them public again. This…

What's the point of sealed records then? How would that be managed? We should let citizens have some privacy right?

If they were sealed, they shouldn't be made public until they become unsealed (if ever) - but if they were public at some point, they are for all intents and purposes public forever. Very hard to make something private, after it has been out in the public.

Re: State Bar of California addresses breach of confidential data

#38

Post by wolverine876 »

SllX wrote: post #26
wolverine876 wrote: post #16

Earlier quoted context omitted.

Without transparency, including public records, how do we hold the powerful accountable? Court records are public to prevent secret government courts from abusing people (among other reasons). How do we operate a democracy, which depends on citizens controlling their country? And most importantly, who does get access to the records? That exculsive access will give them a lot of power.

Something that stuck out to me about that website is that we really do publish a lot. If you ever had a speeding ticket, that’s a matter of public record now. If you ever had a parking violation, that’s a matter of public record. I mean to be honest, if you just have a car, I can probably find you on that website if I know your name. Also goes for divorces. By and large I agree with your take, but playing around with…

I agree there are limits; there are no absolutes in anything. We don't have absolute free speech: you can't slander, commit fraud, conspire to commit a crime, incite a deadly stampede, etc.

I think the main concern is that the more powerful the actor (e.g., government is very powerful) the more important transparancy is, and the more vulnerable the actor, the more important privacy is.

For example, if an Apple (picking a random company) employee complains to authorities about dangerous working conditions, that employee may be very vulnerable - Apple could blacklist them; other businesses, if they learned of the complaint, could do the same, not wanting a 'troublemaker'. And that employee may be financially vulnerable, needing the job; their privacy should be maintained if possible. But Apple and the government are both powerful and there should be transparency about the working conditions, investigation, and outcome.

Re: State Bar of California addresses breach of confidential data

#39

Post by stefan_ »

cyral wrote: post #10

> We apologize to anyone who is affected by the website’s unlawful display of nonpublic data Sounds like Missouri teachers SSN leak again... The website that judyrecords scraped, discipline.calbar.ca.gov, contained all of these "nonpublic" records for anyone to see.

It can be legal for you to scrape something yet very illegal to reproduce it.

This applies even more when the site you scraped didn't have permission to show the data in the first place. Their mistake does not rise to be your permission; if it was my data, I would have as much a claim against you as them. "The software did it" is not an excuse.

Re: State Bar of California addresses breach of confidential data

#40

Post by Ajedi32 »

kelseyfrog wrote: post #33
Ajedi32 wrote: post #28

Earlier quoted context omitted.

Users wouldn't need to provide their password on every interaction; just when logging in. The browser could save a derived decryption key in a cookie or local storage and use that to persist the session. We're basically just discussing end-to-end encryption. The real reason it's not done more often is that it makes things a lot of things way more complicated from a development perspective. Features like "allow users…

Not exactly following. Couldn't DMs simply not be E2E encrypted while maintaining encryption for personal info?

End to end encrypted with what key? What if the user changed their password? What if they got a new phone? What if the server is only pretending the user got a new phone to trick you into leaking your messages?

All of those problems are solvable, but "simply" is hardly the word I'd use to describe designing a secure end-to-end encrypted application. It's way, way more development effort than just "hash user passwords with bcrypt and don't allow access without the password", which is why it's rarely done unless E2E encryption is a major selling point of the application.

Post reply on HN