Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

French government agency confirms breach as hacker offers to sell data

bleepingcomputer.com

Post reply on HN
Print view View original

61–70 of 168 posts

Re: French government agency confirms breach as hacker offers to sell data

#61

Post by artursapek »

anonym29 wrote: post #26
afarah1 wrote: post #18

Earlier quoted context omitted.

Biometrics is just something else to get leaked, terrible idea because it's even more sensitive (can be used to track you through cameras for example, like used in the Iran war). This problem has long been solved with federated IdPs and MFA - something you own like OTP device/physical token besides something you know like SSN/tax id/password. Most governments prefer biometrics of course because citizen privacy is the…

Biometrics are the only credential you can't roll after compromise.

this is exactly my problem with them

Re: French government agency confirms breach as hacker offers to sell data

#62

Post by a34729t »

Ales375 wrote: post #52
hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

GDPR has solid fines for data breaches, but this doesn't work for government agencies. Just someone else's money going from one government pocket to another. What they need is an automatic firing of the head of the government agency that suffered a breach. No question asked.

I'd go for mandatory caning, on CSPAN

Re: French government agency confirms breach as hacker offers to sell data

#63

Post by concinds »

hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive.

The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose a legally-enforced deadline to fix any issues, with a fine (for private actors) or demotion of the guy in charge of infosec (for state agencies).

Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.

France seems to have had a ton of government hacks in the past year at various levels, so it's sorely needed.

Re: French government agency confirms breach as hacker offers to sell data

#64

Post by dboreham »

throwup238 wrote: post #17
hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

Wait, you don’t even get a month of free credit monitoring?

Fairly sure this is an ironic comment. (Credit monitoring is the useless thing companies give people in the US when their information is leaked -- everyone in the industry knows it's laughably unrelated to private information disclosure).

Re: French government agency confirms breach as hacker offers to sell data

#65

Post by Thaxll »

throwup238 wrote: post #17
hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

Wait, you don’t even get a month of free credit monitoring?

The credit system is not the same in Europe, first of all there is no such thing as credit rating and what not.

People don't have credit card like the one in US and Canada.

The vast majority use a debit card.

Re: French government agency confirms breach as hacker offers to sell data

#66

Post by xp84 »

hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

Hey now, don’t forget the offer of “free credit monitoring for a year” - I feel like at this point I’ve gotten so many of those that if I signed up for them all, I’d have my personal info in twice as many probably-hackable locations as I do already.

Re: French government agency confirms breach as hacker offers to sell data

#67

Post by paulddraper »

hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

> if the only penalty the company/agency gets

What is the penalty for the government?

Re: French government agency confirms breach as hacker offers to sell data

#68

Post by vladvasiliu »

gus_massa wrote: post #29
throwup238 wrote: post #17

Earlier quoted context omitted.

Wait, you don’t even get a month of free credit monitoring?

I'm not sure about France, but here in Argentina all this info is assumed to be public. If you want a credit at a bank or shop, they ask for a physical copy of the national ID [1], probably a photocopy too, an electricity or water bill and perhaps other paperwork that is hard to get (verified phone number???). [1] Do you want my number? It's inside this list: for i in range(1E9): print (i)

It's supposed to be identifying information here. Usually, you can just send copies of those documents, which means that if you're looking to impersonate someone, you can easily produce fakes. And since everyone and their grandmother asks for these, people don't bat an eye and send them.

The coup de grace of security in France is signatures, though. Now, since you can't produce a physical signature over the internet, they'll ask for your phone number and send you a text with a code. Once you've entered it on their web form, you've proved undoubtedly you are who you say you are.

Re: French government agency confirms breach as hacker offers to sell data

#69

Post by jampekka »

Thaxll wrote: post #65
throwup238 wrote: post #17

Earlier quoted context omitted.

Wait, you don’t even get a month of free credit monitoring?

The credit system is not the same in Europe, first of all there is no such thing as credit rating and what not. People don't have credit card like the one in US and Canada. The vast majority use a debit card.

In UK there is. :(

Re: French government agency confirms breach as hacker offers to sell data

#70

Post by dawnerd »

hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

The problem though is when its from a gov agency it validates previous breach data making it more valuable.
Post reply on HN