4 ms·
Forget about the zero-day for a minute. They should be liable for poor storage practices around sensitive PII. Take for example SSN. With SHA2, there is no goo
by bluejekyll 9y ago
Forget about the zero-day for a minute.
They should be liable for poor storage practices around sensitive PII. Take for example SSN. With SHA2, there is no good reason for them to be stored in plaintext.
If you don't need it, don't store it. For SSN, you just need a function (SHA256+Salt) that would give you a one way mechanism of Creating an identifier that masks the original in an irreversible way.
The prevalence and misuse of SSN as an identifier for people is so out of date at this point and weak. We need something different.
- bga 9y agoIf you're just hashing with SHA2 and a salt, an attacker with a run-of-the-mill GPU could crack any given hashing quite quickly. It might still take quite a bit of time to get all 143 million, but that's fine. Sell off the score in blocks of 10,000 and let the customer know they have to reverse the hashes themselves. BCrypt with lots of rounds would be best.
- bluejekyll 9y agoYes. You're correct of course. We should be treating these like passwords, except that they can't be rotated...
- maxerickson 9y agoIt is an identifier. It isn't really a problem to use it that way. The problems all come from using it for authentication.
- bluejekyll 9y agoI should have made that more clear in my statement. The thing that makes me paranoid is it's use as an authentication method by my bank, et al. With this disclosure, much of what banks and others use to authenticate my identity is now out in the open.
- bodz 9y agoThere's no evidence so far (that I've seen) that points to Equifax storing SSNs in plaintext. The initial reports so far indicate that the exploit scraped the SSNs while it was in use by other systems, and not at rest in a database. Encryption (whether they do it or not) wouldn't have saved the day here. > The prevalence and misuse of SSN as an identifier for people is so out of date at this point and weak. We need something different. I completely agree.