Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub sued for aiding hacking in Capital One breach

zdnet.com

Post reply on HN
Print view View original

41–50 of 104 posts

Re: GitHub sued for aiding hacking in Capital One breach

#41

Post by ben509 »

antpls wrote: post #25
nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Any automated detection scheme can be thwarted by encryption as trivial as ROT13.

You could leave a comment in README: "To decrypt, just run 'l33t-xor-crypt --key bob --file hacked-data.txt'" and Github's scanner is none the wiser.

Meanwhile, it will be finding all the false positives already mentioned, especially test suites with fake data.

Re: GitHub sued for aiding hacking in Capital One breach

#42

Post by Arubis »

johnnyAghands wrote: post #37

Honestly, it scares me that this was even filed. Even though we know how ridiculous it is to include Github in this suit, I'm afraid we're going to be left with some weird middle ground that shouldn't even exist to begin with made by people who have no idea how things work trying to fix something that isn't broken.

This might be the first good, non-entitled argument I’ve run across for having some form of software engineering licensure: having qualified people whose technical testimony in court would carry more weight than Larry McSues-a-lot.

Re: GitHub sued for aiding hacking in Capital One breach

#43

Post by jcims »

criddell wrote: post #28
noego wrote: post #7

> The lawsuit said GitHub had an obligation under California law and industry standards to keep off or remove the Social Security numbers and personal information from its site. The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data > The lawsuit alleges that by allowing the hacker to store information on its servers, GitHub violat…

> But if the rationale is accepted, it will need to be applied universally to startups and SMBs as well. I don't think that's necessarily true.

Can you expand on that? There may be selective enforcement but a hundred million ssn’s on any platform causes the same amount of damage. If you’re going to hold the platform accountable for preventing it what’s the rationale for excluding a small player? You’d just drive this activity their way.

Re: GitHub sued for aiding hacking in Capital One breach

#44

Post by wolf550e »

nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

SSNs don't have a checksum like credit card numbers do (or like national identity card numbers do), because the SSN is not meant to be used the way it is used.

https://www.youtube.com/watch?v=Erp8IAUouus

Re: GitHub sued for aiding hacking in Capital One breach

#45

Post by jakelazaroff »

cgb223 wrote: post #29
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Wait... Given enough SSNs as training data, could someone make an ML model that churns our mostly valid SSNs? Because that could be really really bad

No need to get that involved:

for (let i = 0; i Every single valid social security number, and several (e.g. 000-00-0000) that probably aren't. You can store the whole thing in about a gig.

Re: GitHub sued for aiding hacking in Capital One breach

#46

Post by antpls »

BoorishBears wrote: post #33
antpls wrote: post #25

Earlier quoted context omitted.

Detecting plain SSN numbers wouldn't be difficult with a combination of regex, machine learning and human verification. Even if hackers could just encode the SSN numbers, it would at least mitigate the spreading of PII. Edit : I don't care about the downvotes, I care about privacy. Enough of the argument "but wait, can't you imagine the cost?", well if you can't afford to protect people's privacy, don't do business a…

Are you seriously entertaining the idea that Github should pour resources into developing a SSN detection pipeline? Why don't they also flag repositories with lots of names, those are PII. Too many addresses? That's a red flag. Why would you even for a second entertain this nonsense? Non-technical people who think this: https://github.com/Hack-with-Github/Awesome-Hacking is a smoking gun to prove Github as a company…

Per EU's GDPR, and maybe the future California Consumer Privacy Act, yes : GitHub should do everything they can to preserve people's privacy. Including maybe flagging and reviewing projects which process PII.

GitHub is popular enough that less technical people also browse it, in particular young people looking to learn.

Re: GitHub sued for aiding hacking in Capital One breach

#47

Post by dahfizz »

colejohnson66 wrote: post #39
nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

I’m reminded of a webpage that claimed to know your pin for your credit card; just do a find in page to see! In reality, it just had all 10,000 possible numbers listed in numerical order

Pro tip: lots of banks let you set a pin longer than 4 digits.

Re: GitHub sued for aiding hacking in Capital One breach

#48

Post by dantillberg »

colejohnson66 wrote: post #39
nickjj wrote: post #14

> The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data I don't see how they can expect to enforce this with 100% accuracy. SSNs do have a fixed format but other things could potentially follow the same format. For example what if you had a library that lets you configure randomly generated codes in a XXX-XX-XXXX format and it jus…

I’m reminded of a webpage that claimed to know your pin for your credit card; just do a find in page to see! In reality, it just had all 10,000 possible numbers listed in numerical order

Once you search for it, then the web page could actually know.

Re: GitHub sued for aiding hacking in Capital One breach

#49

Post by ForHackernews »

twunde wrote: post #15
ForHackernews wrote: post #8

Earlier quoted context omitted.

> As someone who thinks the world will be a far better place if we had decentralized dumb platforms Then you should be very much in favour of assigning expensive liability to companies running these centralized platforms. If it becomes extremely expensive or legally risky to maintain a big centralized database, that opens a window for free, open source federated protocols to fill that gap. Consider: You can sue Megau…

Ah, but you can sue anyone using BitTorrent the protocol and sue the creators of the protocol

Yeah, good luck with that. If you're lucky, you'll win a judgement for both the defendant's Playstation and his Xbox. I'm sure white shoe law firms will be beating down your door to represent you in that suit.
Post reply on HN