11 ms·
Understanding the ginormous Philippines data breach
- luso_brazilian 11y ago> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and biologically identifying the owner. You don’t get to reset that stuff once it’s been released into the wild! That's one of the biggest dangers in using biometrics as a factor in authentication. Once it leaks (and keeping data safe is one of the hardest task in today's world) there is no changing, no resetting, it is out there and rendered useless at best or a vector for identity theft at worst.
- speeder 11y agoYour username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...
- DanielBMarkham 11y agoYou can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
- mtgx 11y agoUnfortunately, that's not how governments around the world require it right now. Estonia for its e-citizenship program, as well as pretty much all countries requiring a fingerprint for passports store the fingerprints in their own centralized database (that also get shared with other nations). I switched my phone fingerprint to another finger for my phone as soon as I signed-up for a passport.
- DanielBMarkham 11y agoWow. So a piece of plastic the bank gives you with mostly arbitrary numbers on it is better protected than your own fingerprints, which you're stuck with for life? Good grief.
- arviewer 11y agoIn the Netherlands we had a passport with fingerprint, and all data stored by the state. Luckily, this was reversed, and now the fingerprint is only stored in the passport itself. Well, that's what I hope, as the fingerprint needs to be stored temporarily for the time to create the passport. Better, if you don't leave the EU, you can use an identity card that doesn't have the fingerprint. I was lucky enough to have an old passport that just spanned the period in which the fingerprint was stored centrally. Now I have an ID card, but one time in the future I will leave the EU, and then I have to get a password...
- adzm 11y agoHowever, Fingerprints cannot be practically hashed.
- stonemetal 11y agoImages can be hashed(and hashed in such a way that minor changes can still lead to the same hash), so images of fingerprints should be hashable.
- jessaustin 11y agoJust use them as a hash lookup into a keystore. This is intuitively appealing, but do biometrics really boil down to an exact number that we could hash like this? (Genuine questions; I don't know.) It seems more likely to me that biometric measurements would be considered to "match" when they're within particular tolerances. This is an operation you can perform on the original measurements, but not on hashes of those.
- taejo 11y agoThere is a cryptographic tool called a "fuzzy extractor" that solves this problem (c.f. Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data, by Dodis, Reyzen and Smith [0]). At enrollment time, you compute some (non-sensitive) data P = Enroll(biometric). Then every time you compute Recover(P, biometric') you will get the same (high-entropy) output, as long as biometric' is close enough to biometric. [0] https://www.iacr.org/archive/eurocrypt2004/30270518/DRS-ec2004-final.pdf https://www.iacr.org/archive/eurocrypt2004/30270518/DRS-ec20...
- spdustin 11y agoIt is, effectively, what Touch ID does. (It's an over simplification but as an analogy it works)
- newman314 11y agoThis sounds like a good idea on the surface but this just shifts the problem. Ultimately, you still only have 10 fingers (general assumption), and not a large space like 30 char passwords.
- elros 11y agoConsidering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? Here's a list of documents you need to provide fingerprints, off the top of my head: – National identity card (RG), mandatory for all citizens over 18 years of age; – Military conscription certificate (CAM), mandatory for all male citizens over 18 years of age; – Voting card (Título de Eleitor), mandatory for all citizens between 18 and 65 years of age, encouraged for all citizens over 16; – Employment record book (Carteira de Trabalho), mandatory for any formal employment; – Passports Also, as of at least three years ago in the state of Rio de Janeiro, some of these were already computerized.
- speeder 11y agoIn my state these were all just printed on the document (at least last time I had to make documents). You cannot "hack" a piece of paper easily... But with mandatory vote + mandatory fingerprint to vote, you just turn that database in a giant juicy target, an attacker can be sure that all voters will have fingerprints there.
- _asummers 11y agoDo you have any assurances your paper documents were not immediately scanned? Do you know what kind of access controls are enforced on the file cabinet they're stored in? Are they susceptible to a janitor who gets approached by a shady dude with a briefcase of money? The larger point I'm trying to make is that this is no longer something you have control over and have no guarantees about who else has a copy of it, and therefore should not be relying on it being kept secret, and moreover should assume it has been compromised.
- a3n 11y ago> Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? If they already have fingerprints, and now fingerprints are suddenly required for voting, that makes election fraud easier for the government.
- yoodenvranx 11y ago> Once it leaks Leaking? Why do you need a leak? Just follow somebody and wait until he touches something, preferably a glass in a pub or something similar.
- Jarwain 11y agoOne requires targeting a specific individual, but you have a specific goal in mind for those prints. The other involves obtaining several people's fingerprint data. From there, you can figure out what you can actually do with said data
- yoodenvranx 11y agoYou are right, thanks for the answer!
- K0nserv 11y agoThe whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and-you-should-do-so-too.html https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...
- tim333 11y agoThough nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?
- K0nserv 11y agoIt's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible. The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords. Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. 0: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- lallysingh 11y agoIf someone's going to use biometrics, please just use a face picture. People understand that their face is mechanically recognizable, and don't have the same false confidence in pictures that they have in fingerprints.
- robmcm 11y agoMost people have 10 to choose from, 20 if you want, and potentially more if you consider other regions of your skin.
- newman314 11y agoI found this article from Microsoft a while ago that I thought was particularly interesting. https://technet.microsoft.com/en-us/library/cc512578.aspx https://technet.microsoft.com/en-us/library/cc512578.aspx
- make3 11y agoThey should keep a hash of the finger print info, not the info itself. I don't know how it would work, but keeping biometric data for authentification is indeed potentially worse than keeping plain text passwords. Like, the output range of a convnet, or something.
- wiredfool 11y agoThe killer quote for me: I actually had to create five new data classes when loading this breach, that is I’d never seen this information in a breach before: Marital statuses, Biometric data, Physical attributes, Family members' names
- veb 11y agoA friend of mine in the Philippines, a security researcher himself, said to me that "the breach itself isn't really serious -- it's the candidate the breach favors thats the bigger controversy"
- csn 11y agoMy acquaintance tells me the same. Presidential election being less than a month away I can see it being a big thing there, too.
- wsr 11y agoCan you please elaborate on what you mean?
- eco8008 11y agoFake votes.
- MikeNomad 11y agoI find this data breach staggering. With your friend's comment, clearly there is a cultural vector I am completely missing. Also, please expand on their comment re: the event helping a particular candidate. I don't understand how this incident favors / helps a particular candidate over another.
- aangeles 11y agoThere is a fear of mass cheating in the presidential election. 1) survey results published in national TV have a wide margin difference with the results in poll using social media(fb, tweeter) 2) At first comelec don't want to print vote count recipient of voting machine with the alibi that it will make the polling period goes longer. 3) No 3rd party source code review.
- rpgmaker 11y agoI'm am sorry but what kind of security researcher can claim that this breach isn't serious? The electoral implications may be a bigger controversy but to suggest that the breach isn't serious it's insane. What is described in the post is nothing short of a nightmare scenario for anyone, no only security-conscious people.
- mypolopony 11y agoLove it!
- deleted 11y ago[deleted]
- Nutmog 11y agoAlthough this is a lot of data on each person. Each individual field doesn't seem too sensitive on its own. Electoral enrollment status and place you live is usually public information. It should be to prevent vote fraud. Without other ID, you give your passport details to every company that uses it for ID, every airline, even the bouncer at a bar. When you're travelling and don't have the local ID, you use it to get a sim card, bus pass, just about everything. It's not really secret. As for the biometric data, what use would a malicious actor make of that? They can't impersonate you because authentication shouldn't be done with only reproducible biometric data. They could identify you if you're physically touching them, but then they can already see you in person. Mother's middle name according to the article can usually be predicted by her parents names. Family history and names is also public data. Just ask the Mormon church which hoards it.
- lcall 11y agoThe Mormon church is really called the Church of Jesus Christ of Latter-day Saints (of which I'm a member). It sounds like you might be thinking of the affiliated, free genealogy site, http://www.familysearch.org http://www.familysearch.org. It doesn't disclose data on living persons. But you might really enjoy using it to look up your deceased ancestors. My wife loves it. -- A free, fast emacs org-mode replacement which is easier to learn and lets you put the same thing in more than one place at the same time: "Atomic knowledge": http://onemodel.org http://onemodel.org .
- mentatghola 11y agoThe LDS church "hoards" it for a reason. Genealogy and baptisms for the dead.
- wjnc 11y agoWonder how well hashed that FINGER_INFO is? Any chance to reverse engineer a fingerprint that would give the same hash? That would be awesome, but not in a good way. A false passport including working biometrics. Implementing a new hash would require what before adequate coverage, 15 years? You cannot easily imagine blocking a whole country's access to international travel because of a data leak.
- jessaustin 11y agoYou especially couldn't block the Philippines for that reason. Many other nations would cease to operate completely without Filipino labor.
- arviewer 11y ago> You cannot easily imagine blocking a whole country's access to international travel because of a data leak. You cannot do that, not because of the problems for those people, but because it would break trust in the system. It would become apparent how unsafe it is to keep fingerprints stored digitally in a central database. That would be a bigger problem, worldwide. People would demand to get rid of these databases, and I bet many intelligence services would not like that.
- studentrob 11y ago> somehow, last week’s news that 55 million Filipino voters’ data was now out in the wild went largely unnoticed > ... > There’s voting history against names (it appears to just be dates rather than the candidate voted for). So, the data leaked was voter registration info. Actual votes were not in this database. Other headlines would lead a reader to believe actual votes were leaked. For example, "Megabreach: 55 MILLION voters' details leaked in Philippines". Leaking votes alongside emails would be far more injurious than email addresses and family names.
- burkaman 11y agoMaybe in principle, but I think most people would be more upset over personal details and biometric information than they would be over votes.
- studentrob 11y agoYeah I guess people will be upset about what they want. My opinion is the actual votes would be worse. Such data could be used to force someone to vote a certain way, which usurps individuals' freedom of speech. Any leaked biometric data becomes unusable as an authenticator in the future.
- nsns 11y agoAren't votes supposed to be anonymous?
- studentrob 11y agoAbsolutely. My point was some headlines and articles made it sound like votes were disclosed, and you need to dig into the details to discover that's not the case.
- ivanceras 11y agoI hope the banks will be cautious on the possibilities of identity thief on loaning on somebody's account.
- nxzero 11y agoIncreasely wonder why average person trust any party to secure data that literally belongs to them. Are there any startups that are building tech allow end-to-end identity management systems? Seems like a huge market.
- emodendroket 11y agoWhat choice do you have?
- nxzero 11y agoReally depends of the type of data, how it's being used, etc. - is there a specific problem you personally are facing and how big of a problem is it to you?
- rpgmaker 11y agoHis point is that the government asks for this information, maybe as a requirement in order to procure official documents needed for everyday life and business. There's not much to do when the government of your country makes your giving of certain information a requirement. Sure, you could fight it in court but it's very likely that that will not get you very far or produce the official documents you may need. Not all governments were founded with the same libertarian strain as the US.
- emodendroket 11y agoEven in the US, for practical purposes you need to hand your data over to private entities, state governments and, yes, even the federal government, at times.
- nxzero 11y agoFirst, not going to assume that's what the comment meant, but happy to address your comment as is. Basically my position is that I agree it's complex, but I believe possible to address the issue in a way that for all parties (individual,government,3rd-party) that more value is created and less risk exists; this applies universally in my opinion. Any rate, unclear how responding to my question with questions addresses my question other than to assume that the lack of an answer means that there are no startups that address this issue; meaning any solution I've seen requires a central authority to be involved.
- romanr 11y agoSo if I ever traveled to Philippines and scanned fingerprints at the border, anyone in the world can unlock my TouchID?
- kspaans 11y agoThey don't scan your finger prints at the border in the Philippines. And this is a leak of Filipino citizens' demographic data.
- ars 11y agoIt's not quite that easy. But in any case you don't need a data breach to get you fingerprint - it's probably right on the phone. A fingerprint is the weakest form of security out there.
- nmc 11y agoSimilarly, personal records for 50 million Turkish citizens got leaked a few days ago: https://news.ycombinator.com/item?id=11420139 https://news.ycombinator.com/item?id=11420139
- b_emery 11y agoOn an etymological side note, I love the origin of the word ginormous: ginormous |jiˈnôrməs, jī-| adjective informal, humorous extremely large; enormous: ORIGIN 1940s (originally military slang): blend of gigantic and enormous .
- n3far1ous 11y agoI'm a potato...
- n3far1ous 11y agoI'm a potato...