Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

State Bar of California addresses breach of confidential data

calbar.ca.gov

Post reply on HN
Print view View original

51–60 of 101 posts

Re: State Bar of California addresses breach of confidential data

#51

Post by entelechy0 »

mwint wrote: post #5
user3939382 wrote: post #4

This is probably a stupid question to those who work with these concepts often: can all the user data in the DB be hashed with the user’s password so that nothing is gained from a breach? Is this mostly a CPU resource problem or would would jwt architecture preclude that from working? (I haven’t built auth systems for several years)

Hashing would make the content irretrievable; something like XORing with the password would make the password recoverable if you know the content.

Right, which is why you would never XOR in this manner, and would hash instead. You don't want the password or content retrievable that easily.

Re: State Bar of California addresses breach of confidential data

#52

Post by xbar »

reset-password wrote: post #50

Why is it so impossible for these people/organizations to accept that they made a mistake and own up to it? The entire response by the State Bar of California is nothing but a deflection of blame that rests solely on themselves and their chosen vendor(s). What are they going to do next, call Missouri's governor and ask for the playbook to follow? The humans behind the scenes at the bar are looking incredibly pathetic…

Agreed.

Closing with "Law enforcement has been notified" doubles-down on "we published everything but maybe if we can get somebody charged for a bogus crime then we won't look so stupid."

Re: State Bar of California addresses breach of confidential data

#53

Post by KarlKemp »

reset-password wrote: post #50

Why is it so impossible for these people/organizations to accept that they made a mistake and own up to it? The entire response by the State Bar of California is nothing but a deflection of blame that rests solely on themselves and their chosen vendor(s). What are they going to do next, call Missouri's governor and ask for the playbook to follow? The humans behind the scenes at the bar are looking incredibly pathetic…

They are lawyers. „Pathetic“ is the after-shave they use. “Liability” is the nickname for the kid they secretly loath. “Blame” is a verb.

Re: State Bar of California addresses breach of confidential data

#54

Post by sva_ »

danso wrote: post #2

According to this LA Times [0] story, the records were apparently found on judyrecords.com, a project recently discussed in a Show HN [1] > State Bar officials learned about the posted records on Feb. 24. As of Saturday night, all the confidential information that had been published on the website judyrecords.com — which included case numbers, file dates, information about the types of cases and their statuses, respo…

Let me guess... judyrecords.com collected these by iterating over some chronological id that didn't properly check if someone has read rights.

edit: would love to check, but[0]

> The State Bar Court Portal will be unavailable from February 25th to February 28th due to maintenance activities. During this time the Case Search and Court Calendar functionality will not be available.

[0] https://apps.statebarcourt.ca.gov/dockets.aspx via https://www.statebarcourt.ca.gov/Public-Records-Information

Re: State Bar of California addresses breach of confidential data

#55

Post by uoaei »

wslack wrote: post #21
5ESS wrote: post #13

Earlier quoted context omitted.

It wasn’t a breach. Those records were publicly available. It’s a shame the site’s operator complied with the takedown request. Unfortunately that’s what happens when you use a US hosting provider and domain. In the interest of transparency, site operator should consider migrating the site to a provider outside of US jurisdiction and/or making torrents of the record data that can’t be simply taken down.

It's still a breach if an org misconfigures an API, allowing more records to be available than was indended.

Mens rea is honestly a mistake.

I don't care what the org "intended" to do. The org assumed the responsibility of providing an API and with it the responsibility of securing private data. They failed and should be held culpable.

Boeing doesn't call it a "cyberattack" when their altitude control systems fail because of poor design.

Re: State Bar of California addresses breach of confidential data

#56

Post by thrashh »

ejb999 wrote: post #37
djbusby wrote: post #34

Earlier quoted context omitted.

What's the point of sealed records then? How would that be managed? We should let citizens have some privacy right?

If they were sealed, they shouldn't be made public until they become unsealed (if ever) - but if they were public at some point, they are for all intents and purposes public forever. Very hard to make something private, after it has been out in the public.

Plenty of things become super hard to find after no one cares about it anymore. High profile cases aren’t like that but most things are not high profile.

Just because you can’t make something 100% perfect doesn’t mean you shouldn’t try. Locks aren’t unbreakable. Seatbelts won’t always save you. Your cloud service won’t always stay up. Yet we use and build all these things and no one has an issue with it.

And for all intents and purposes, if court records are meant to be hidden to protect someone’s future chance of success, by all means we should do what we can.

Re: State Bar of California addresses breach of confidential data

#57

Post by nisegami »

wolverine876 wrote: post #16
coding123 wrote: post #12

Earlier quoted context omitted.

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

Without transparency, including public records, how do we hold the powerful accountable? Court records are public to prevent secret government courts from abusing people (among other reasons). How do we operate a democracy, which depends on citizens controlling their country? And most importantly, who does get access to the records? That exculsive access will give them a lot of power.

>Court records are public to prevent secret government courts from abusing people

Except of course, when "national security" is involved.

Re: State Bar of California addresses breach of confidential data

#58

Post by sacrosancty »

wolverine876 wrote: post #16
coding123 wrote: post #12

Earlier quoted context omitted.

I thought something was off about that site. I doesn't seem fair or legal to just publish that data like that. I think in the era of go in and get things things should be "public". Now in the search engine age and data available at your fingertips we need to entirely change our public records laws... Immediately. edit: In fact a HN User said this with NO REPLY from the author of that Show HN: I have some records that…

Without transparency, including public records, how do we hold the powerful accountable? Court records are public to prevent secret government courts from abusing people (among other reasons). How do we operate a democracy, which depends on citizens controlling their country? And most importantly, who does get access to the records? That exculsive access will give them a lot of power.

It's possible to be both not public enough to ruin people's lives and public enough for journalists or concerned individuals to find. In New Zealand, voter registration details are, by law, available to look at but not to copy. Anyone can walk in to a public library anonymously and rifle through the book but the book is chained to the desk and you're not allowed to photocopy it or take photos. Also, it's only present in the local libraries near where the voters live.

Re: State Bar of California addresses breach of confidential data

#59

Post by lazide »

TedDoesntTalk wrote: post #47
ejb999 wrote: post #30

Earlier quoted context omitted.

>> we need to entirely change our public records laws... Immediately. I am certain that many people in government would agree with you - they would LOVE to be able to hide what they are doing and not be held accountable for decisions they make (or don't make). We need more public disclosures, not less, imo. >>So there are records that were once ‘public’ but are no more, but this database makes them public again. This…

> once something is public, and in control of others, it is impossible to make them 'un-public' without violating the 1st amendment. I do not think that is accurate.

Can you be more specific?

How do you propose someone could stop someone from releasing a record they acquired publicly, exactly?

Seize it? Prohibit someone from saying something they found out via a public route on penalty of fine or prison?

Re: State Bar of California addresses breach of confidential data

#60

Post by Ajedi32 »

kelseyfrog wrote: post #42
Ajedi32 wrote: post #40

Earlier quoted context omitted.

End to end encrypted with what key? What if the user changed their password? What if they got a new phone? What if the server is only pretending the user got a new phone to trick you into leaking your messages? All of those problems are solvable, but "simply" is hardly the word I'd use to describe designing a secure end-to-end encrypted application. It's way, way more development effort than just "hash user passwords…

Sorry, still not following. I wrote not E2E encrypted. I'm struggling to understand why messages that are not E2E encrypted would require key management.

Sorry, misread.

Yes, you could symmetrically encrypt the tiny portion of personal data that needs to be read solely by you without much added complexity.

However, with few exceptions (password managers, backups, personal notes, etc), the whole point of uploading data to an online service is to allow it to be shared with other people or services. Once that happens, you need all those complicated key management and security systems I just talked about. It's effectively end-to-end encryption.

Post reply on HN