18 ms·

Black Hat: GDPR privacy law exploited to reveal personal data

397 points by jfk13 7y ago

jfk13 7y ago
This is pretty appalling, really: "Overall, of the 83 firms known to have held data... 24% supplied personal information without verifying the requester's identity." Want someone else's personal data? No need to "hack into" any systems; just ask for it!
- Silhouette 7y ago
  This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security checks, that's one thing, but what if they don't or they claim to have forgotten their password etc? Even if someone were willing to send us "strong" ID, we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. At best, we could find an image of a passport/driving licence/whatever from that person's country and see if what they've sent us looks about right and matches any personal details we do have for the data subject. Our disturbing conclusion was that if someone did ever send us certain types of request in connection with certain accounts, there might be no action we could safely take to resolve the situation that would definitely be lawful. If we get scammed by fake ID then we're breaking the law. If we don't accept ID that is real and comply with the subject request, we're also breaking the law. Fortunately the affected services aren't doing anything particularly exciting or risky with personal data either, so it seems unlikely that any serious harm would come to anyone whatever happened in our case. However, the same basic issue surely affects many other data controllers/processors, and they won't necessarily be such unlikely targets as the research here shows. I haven't yet found any practical guidance from the regulators on what would be considered reasonable in this sort of situation.
  - bsimpson 7y ago
    Government officials created an untenable law in the name of the technological boogey man?! </mild-shock>
    - AstralStorm 7y ago
      Not bogey. Misuse of personal days it's happening daily, but the law is not exactly super great. Better than nothing I suppose.
      - drusepth 7y ago
        I think whether the current implementation of GDPR is better than nothing is still up for debate. The intention is mostly good, but the execution leaves an immense amount to be desired (as evidenced by common threads like this) and disproportionately affects/burdens small businesses.
    - fixitfixit 7y ago
      Hey now. Mass surveillance, data breaches, and non-consensual data sale are absolutely issues, and will continue to be. This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. Maybe we wouldn’t have to deal with the GDPR if we treated data as a liability from the beginning.
      - Silhouette 7y ago
        This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. I agree there are real dangers, but I don't think blaming it entirely on the tech industry is fair. The financial services industry has been profiling as much as it could get away with forever. Government security services and the like obviously do this sort of thing as well. Modern technology has made these things easier and surely provides a generous source of additional data to both of the above groups, and targeted ads have created another not entirely welcome variation on the theme, but modern technology is hardly the original source of creepy data-hoarding behaviour.
  - 7y ago
- segmondy 7y ago
  Verifying identity is a very hard problem.
  - inxdz 7y ago
    That should not lead to an "open by default" policy.
    - mlindner 7y ago
      Maybe European regulators should have considered that before writing this law.
      - Avamander 7y ago
        They did by writing the eIDAS regulation.
    - deleted 7y ago
      [deleted]
  - noxToken 7y ago
    Understood, but: So, when one train operator asked for a photocopy of a passport, he convinced it instead to accept a postmarked envelope addressed to the "victim". A postmarked envelope? This is baffling to me.
    - Theodores 7y ago
      The art of social engineering. The person doing this was a dab-hand at it or else they would not have done what they did. You can have a plausible excuse for not having your passport - left at parent's house or accidentally in storage. Driver's license - "I am a cyclist!" Electricity bill - "My housemate pays all the bills!" Bank statement - "I only do online banking!" Electoral roll? - "Don't vote!" But HR sent me a letter about an update to the company pension plan - will that do? Yes! - sends through postmarked envelope picture. By that stage the confidence trick has succeeded so 'we know the guy and he is legit'. You can get this far to get a mobile phone contract which counts as good as a utility bill in terms of supplementary proof of ID. This can then be used to get a deposit only bank account for 'savings'. This can then be just about enough ID to have almost created a person!!! But with GDPR social engineering you can have it all so much easier. There was so much panic about GDPR and purging every decent contact from the company newsletter list that no company thought through a thing about how to deal with GDPR information requests. Hubris at its finest.
- paxys 7y ago
  From a business’s perspective it's a lot worse to get sued for not complying with GDPR rather than for a side effect of complying with it.
lucideer 7y ago
> Mr Pavur says he believes he did not break the law himself while conducting the trial This is a bit odd. I know his partner consented to this, but this doesn't seem like it should be enough to make this not identity fraud. Obviously the research Pavur carried out is extremely valuable and the mid-sized companies failing to follow proper procedure are the real problem here, but it still seems like it would be technically illegal.
- dmix 7y ago
  Regardless it would then be a bad law since almost all criminal law looks at intent and reasonable expectations of how a citizen should act. We don’t need to keep replaying the vilification of security researcher game just because it involves the flawed gov systems imposed on technology itself instead of just technology. The end goal is the same, the privacy and security of end users.
  - mLuby 7y ago
    Agreed. I hope any jury would nullify such a law. AKA "perverse verdict" in the UK?
    - dmix 7y ago
      I’d never trust a jury for any highly technical matter such as this. Prosecutors have shown they can be highly effectively at spinning even the most basic security research into sounding like serious criminal behaviour (like punishing someone with serious jail time for incrementing the id number in a URL and finding other users personal profiles completely unprotected). You only gamble on juries for stuff like murder trials and similar basic crimes.
    - gowld 7y ago
      Juries can't nullifiy laws. They can nullify verdicts.
      - mLuby 7y ago
gen3 7y ago
> "But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed." I wonder if there is a market for selling GDPR compliance / advising services. Some company that makes sure your doing everything right, and inspects the requests for validity.
- ceejayoz 7y ago
  There are quite a few firms offering compliance / advisory services, including ones that'll host the data request forms etc. for you. I'm not aware of any willing to take on the liability of verifying identities as part of that, though.
  - gen3 7y ago
    Do you know of any companies that handle the whole process, similar to how stripe handles the whole purchasing process?
    - ceejayoz 7y ago
      I'm sure one of the major consulting shops like Accenture would be willing to do it (poorly, and for insane amounts of money, of course). I'm not aware of any SaaS style offerings, though.
    - laurentb 7y ago
      replyed to the wrong comment, see parent comment for my reply :)
    - PeterisP 7y ago
      Can you elaborate by what do you mean with "the whole process"? If you have some internal processes that handle the data, then you can't really separate and outsource the "GDPR part" without outsourcing the whole business process that handles the data - e.g. if you ship goods, then handling of adresses can't (IMHO) be separated from the shipping, if you run a website, then the handling of all the related privacy issues can't be separated from running the website. Furthermore, even if you outsource the whole business process that handles sensitive data, you're still the 'controller' of the data, and you still carry full responsibility for it - you can and should have legal arrangements with the processor to recoup your damages/costs if they screw up, but you're the party that's directly liable, and if the processor can't/won't pay, that's solely your problem. You can outsource certain parts of GDPR compliance - such as handling the paperwork and managing the customer enquiries properly, but it's hard(impossible?) to separate "the whole process" from the rest of your business.
VMG 7y ago
who could have thought
- deleted 7y ago
  [deleted]
csomar 7y ago
This is horrible. So right now, in order to get access to data for a certain person, you need to hack your way through a few of the potential services he is using and drive from there. 1. The data might have things like IDs (ie: Crypto exchanges). 2. You can use that data to ask for more data. If you got a copy of his passport, now you can ask for more with this new piece. 3. Looks like some people still store passwords in plain text or don't mind exchanging that over email. This means some of these service might reveal a password to you. 4. With that, you can start hacking into other accounts. You also have loads of knowledge about the person, so you might be able to guess his password. 5. Now you have access to his email, dropbox, banking details and maybe even lock him out. Right about time: https://en.wikipedia.org/wiki/Cobra_effect https://en.wikipedia.org/wiki/Cobra_effect
- davidhyde 7y ago
  One of the major goals of GDPR is to discourage firms from retaining personal data in the first place. It did not used to cost them anything so they kept it regardless of its use. Now that there are big risks to keeping it these firms have to think twice about it. This "cobra effect" is one more reason NOT to retain personal information in the first place.
  - testvox 7y ago
    And yet other laws require the collection and retention of sensitive user data, in particular any service that allows for transmission of large amounts of money (crypto exchanges were a good example).
    - aforwardslash 7y ago
      That is well covered within GDPR scope. Retaining data to fulfill legal obligations is allowed. One common related example is invoice data.
      - AnthonyMouse 7y ago
        But then "just don't keep the data" is not an effective response to these attacks of requesting someone else's data.
rossng 7y ago
This is a reflection of the fact that we have no good way for someone to digitally prove their identity. Some countries are getting close-ish - Denmark's NemID system, for example, is used by a lot of financial institutions. However, there remains no easy way to make ad-hoc verifiable statements like 'I am John Smith and I authorise you to send this data to xyz@example.org'. Governments, please solve this problem! Essentially: combine NemID with Keybase and build a UI that normal citizens can understand.
- giancarlostoro 7y ago
  > Governments, please solve this problem! I would prefer governments to solve it with competent Software Engineers in the mix and maybe other professionals from the finances and IT security industries, but never one single large entity.
  - rossng 7y ago
    Of course. There are plenty of different ways to build such a platform (or contract it out) - I'm not advocating any in particular. The UK has a rather interesting example in the GOV.UK Verify service, which federates the identity verification and authentication out to third parties. The user can then choose which provider (e.g. Barclays, Post Office) they want to prove their identity through. Experian is also one of the providers, which perhaps illustrates some of the flaws with this design...
  - jsgo 7y ago
    I didn't take that as he wanted legislative representatives and the like to solve it, so much as to make it a matter of focus to enlist the kinds of people you're recommending to provide a solution like this. Personally, I really feel we need a private/public-key kind of system in place for certain things like Social Security Numbers (SSNs) in the US. Such that if a leak also includes an SSN (essentially a public key), it could then be regenerated and some apparatus to manage filtering it to the parties it was assigned to prevent needing to redistribute it manually as a consumer/user (like using your Google, Facebook, or whatever OpenID as credentials for another site and it is stored in the account showing that it is being used as such). If they could automatically detect said public keys being exposed and automate the resetting and distribution process, even better (users should still be able to manually do it if they feel it is compromised though).
triangleman 7y ago
This is a great thing that the hacker noticed. It sounds like we really need more OpenID style auth and a lot more limited-lease access to personal data, and more tools to store our own data.
jedberg 7y ago
The main benefit of GDPR is that it forced companies to audit their policies and procedures to have slightly more hygienic data practices. The downside is that it made social engineering easier. What this guy did was nothing new. But now those businesses were compelled to help him instead of ignore him until he pestered them enough. Good job government regulators! You just made the most common fraud even easier!
camjohnson26 7y ago
This is the problem with overly aggressive legislation. The big companies performed well, the small companies ignored the law, and the medium sized companies tried to comply and failed. You can’t legislate good behavior because people will always find a way around the laws. The legal philosophy behind GDPR seems to be nothing more than to make everyone a criminal and then choose who to prosecute, and in that case why have laws at all rather than letting law enforcement punish whoever they choose? At the end of the day this incentivizes big companies to comply with the laws because they can afford the necessary legal teams and the laws provide a moat to their entrenched power. It incentivizes small companies to ignore the laws just like the move fast and break things mentality of Silicon Valley. The people it hurts are the medium sized, growing companies who are best positioned to fight the big monopolies but are now being held back by well meaning but over burdensome legislation. The good side of GDPR is that it’s trying to advocate for consumer privacy, which overall is a good thing. The issue is that it’s not a legal problem. In the same way you can’t declare drugs to be illegal and expect the supply of drugs to instantly disappear, you can’t declare misuse of data illegal and expect the same. As long as the data has value there will be a market for it, so why not draft sensible regulations instead of trying to solve the problem with laws.
- PeterisP 7y ago
  I wouldn't agree that the medium sized companies tried to comply with the GDPR and failed. Yes, they tried to comply with that particular request but the failures suggest that they didn't even try to be GDPR compliant in the first place - if they had done so, then they would have had assigned a data protection officer who would have long ago asked themselves the question "what do we do in case of a personal information request?", and written down a reasonable process for handling such requests, possibly consulting with the local data protection agency. That would count as "trying", as it was their duty to have done this a year and a half ago. It's basic 'table stakes', a precondition to being permitted to handle personal data at all. If they started thinking about "how do we verify identities" only on day they received the request from this researcher, then that's not trying to comply, that's being grossly negligent.
  - 7y ago
buboard 7y ago
It appears to me that you can’t opt out of the right to access or right of deletion. Not even temporarily.
jwildeboer 7y ago
“Bad implementation of GDPRs information rights” would be the more correct but less clickbaity headline IMHO. The funny twist being that these bad implementations are a GDPR violation too and can be punishable under GDPR.
- grapehut 7y ago
  Even if done correctly, they are just verifying that you bothered to get a photoshopped passport with the targets name in it.
  - Avamander 7y ago
    Basically every country needs to run their own PKI for its citizens to even have any hope to legally prove they are who they are. I've so far seen a single well-working solution to the authentication and authorization problem and that is the Estonian ID-card PKI, others are trying to implement it (Finland, Latvia, actually even the EU) but they're basically nearly two decades behind.
- dwild 7y ago
  The funny twist is that it seems pretty hard/even impossible to handle GDPR laws and could be punishable under GDPR to have enough verification. All you know about a user is its name. How can you verify someone identity while still not being "overly burdensome" (which is required by GDPR)?
thekyle 7y ago
When I first heard about the GDPR I imagined that this kind of thing might happen. https://devrant.com/rants/1400805/you-know-gdpr-compliance-is-going-to-create-a-whole-new-form-of-scam-where-scamm https://devrant.com/rants/1400805/you-know-gdpr-compliance-i...
kmlx 7y ago
this is peanuts. one eu country government decided it needed approval under gdpr from hospital patients before treatment/surgery/etc. this denied service to a bunch of (tech) illiterate people, bringing the budget back in line. another one: due to gdpr, violent thugs hired by the police to hurt protesters cannot be named. it would apparently trample on their rights. gdpr is, as forecasted, a complete mess. a mess that is exploited by corrupt eu governments to great effect.
arendtio 7y ago
Aren't companies under the GDPR obliged to report [1] if the got hacked/a data breach? Sounds to me as if quite a few just got hacked via social engineering... [1] https://blog.netwrix.com/2018/04/19/gdpr-rules-of-data-breach-notification-how-to-report-personal-data-loss-and-avoid-fines/ https://blog.netwrix.com/2018/04/19/gdpr-rules-of-data-breac...
40acres 7y ago
"Generally if it was an extremely large company - especially tech ones - they tended to do really well," he told the BBC. "Small companies tended to ignore me. "But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed." This sums up regulatory compliance across the world quite well.
- Mirioron 7y ago
  I think this is part of the reason why GDPR needs an exemption for businesses that are too small. This kind of a flaw will be abused more and more and they'll never be able to close this gap with small and medium businesses.
  - blub 7y ago
    1. Such an exception would be used by large companies to evade the law. 2. Small and medium companies are also committing privacy abuses.
    - Mirioron 7y ago
      1. You can make late companies unable to evade the law. 2. Yeah? But according to this article GDPR actually makes small and medium companies even more dangerous to trust with your information.
deleted 7y ago
[deleted]
jokoon 7y ago
GDPR is not a perfect law, but I think it's a great leverage to use when negotiating against US companies if you're a EU country. I mean at some point, EU countries will get tired of the US going a little too far. It's about being able to negotiate, and with the digital age and the massive ad market, it only makes sense for the EU to protect itself after brexit and the cambridge analytica stories.
mlindner 7y ago
And Europeans wonder why Americans hate the GDPR laws. Overreaching regulation will be implemented in a least-effort method.
Teknoman117 7y ago
Can anyone here who's experienced with GDPR's provisions talk about the extent any given company is allowed to go to verify the identity of someone requesting information? I'd hate it if someone pulls a "I'd like to be forgotten" request on me without said organization absolutely verifying my identity. If would seem that if they complied, they wouldn't be able to undo the operation...
tzs 7y ago
A lot of the risk of this kind of thing could be greatly reduced if the law were changed so that for data that you should already have about yourself the company only has to tell you whether they have that data. For example, I know my birth date. A company that also has my birth date should be able to just tell me that they have my birth date. They should not have to tell me the actual date. Most of the data mentioned in the article is like this: credit card information, login and password information, social security number, stays in hotels, train journeys, high school grades, and maiden name. Companies like credit reporting agencies that keep such data and share it with others would need to be an exception, so that you could check that they aren't giving out incorrect information about you.
tripzilch 7y ago
Yes. This just shows the problem that was already there. The GDPR is fundamentally a thing about having the responsibility to handle people's data properly The companies that failed, obviously cannot handle the responsibility of managing personal data without it getting into the hands of the wrong people and they shouldn't have had it in the first place. It's much harder to test but this is a good indicator that they probably also don't have controls to manage employee access.
anbop 7y ago
I can’t believe a drivers license scan is all that is needed for many companies. That means that losing my wallet on the street effectively means that someone can go get my entire digital history. Why not require the user to request this data while signed in to the service?

397 points by jfk13 7y ago

This is pretty appalling, really: "Overall, of the 83 firms known to have held data... 24% supplied personal information without verifying the requester's identity." Want someone else's personal data? No need to "hack into" any systems; just ask for it!

Silhouette 7y ago
This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security checks, that's one thing, but what if they don't or they claim to have forgotten their password etc? Even if someone were willing to send us "strong" ID, we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. At best, we could find an image of a passport/driving licence/whatever from that person's country and see if what they've sent us looks about right and matches any personal details we do have for the data subject. Our disturbing conclusion was that if someone did ever send us certain types of request in connection with certain accounts, there might be no action we could safely take to resolve the situation that would definitely be lawful. If we get scammed by fake ID then we're breaking the law. If we don't accept ID that is real and comply with the subject request, we're also breaking the law. Fortunately the affected services aren't doing anything particularly exciting or risky with personal data either, so it seems unlikely that any serious harm would come to anyone whatever happened in our case. However, the same basic issue surely affects many other data controllers/processors, and they won't necessarily be such unlikely targets as the research here shows. I haven't yet found any practical guidance from the regulators on what would be considered reasonable in this sort of situation.
- bsimpson 7y ago
  Government officials created an untenable law in the name of the technological boogey man?! </mild-shock>
  - AstralStorm 7y ago
    Not bogey. Misuse of personal days it's happening daily, but the law is not exactly super great. Better than nothing I suppose.
    - drusepth 7y ago
      I think whether the current implementation of GDPR is better than nothing is still up for debate. The intention is mostly good, but the execution leaves an immense amount to be desired (as evidenced by common threads like this) and disproportionately affects/burdens small businesses.
  - fixitfixit 7y ago
    Hey now. Mass surveillance, data breaches, and non-consensual data sale are absolutely issues, and will continue to be. This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. Maybe we wouldn’t have to deal with the GDPR if we treated data as a liability from the beginning.
    - Silhouette 7y ago
      This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. I agree there are real dangers, but I don't think blaming it entirely on the tech industry is fair. The financial services industry has been profiling as much as it could get away with forever. Government security services and the like obviously do this sort of thing as well. Modern technology has made these things easier and surely provides a generous source of additional data to both of the above groups, and targeted ads have created another not entirely welcome variation on the theme, but modern technology is hardly the original source of creepy data-hoarding behaviour.
- 7y ago
segmondy 7y ago
Verifying identity is a very hard problem.
- inxdz 7y ago
  That should not lead to an "open by default" policy.
  - mlindner 7y ago
    Maybe European regulators should have considered that before writing this law.
    - Avamander 7y ago
      They did by writing the eIDAS regulation.
  - deleted 7y ago
    [deleted]
- noxToken 7y ago
  Understood, but: So, when one train operator asked for a photocopy of a passport, he convinced it instead to accept a postmarked envelope addressed to the "victim". A postmarked envelope? This is baffling to me.
  - Theodores 7y ago
    The art of social engineering. The person doing this was a dab-hand at it or else they would not have done what they did. You can have a plausible excuse for not having your passport - left at parent's house or accidentally in storage. Driver's license - "I am a cyclist!" Electricity bill - "My housemate pays all the bills!" Bank statement - "I only do online banking!" Electoral roll? - "Don't vote!" But HR sent me a letter about an update to the company pension plan - will that do? Yes! - sends through postmarked envelope picture. By that stage the confidence trick has succeeded so 'we know the guy and he is legit'. You can get this far to get a mobile phone contract which counts as good as a utility bill in terms of supplementary proof of ID. This can then be used to get a deposit only bank account for 'savings'. This can then be just about enough ID to have almost created a person!!! But with GDPR social engineering you can have it all so much easier. There was so much panic about GDPR and purging every decent contact from the company newsletter list that no company thought through a thing about how to deal with GDPR information requests. Hubris at its finest.
paxys 7y ago
From a business’s perspective it's a lot worse to get sued for not complying with GDPR rather than for a side effect of complying with it.

lucideer 7y ago

> Mr Pavur says he believes he did not break the law himself while conducting the trial This is a bit odd. I know his partner consented to this, but this doesn't seem like it should be enough to make this not identity fraud. Obviously the research Pavur carried out is extremely valuable and the mid-sized companies failing to follow proper procedure are the real problem here, but it still seems like it would be technically illegal.

dmix 7y ago
Regardless it would then be a bad law since almost all criminal law looks at intent and reasonable expectations of how a citizen should act. We don’t need to keep replaying the vilification of security researcher game just because it involves the flawed gov systems imposed on technology itself instead of just technology. The end goal is the same, the privacy and security of end users.
- mLuby 7y ago
  Agreed. I hope any jury would nullify such a law. AKA "perverse verdict" in the UK?
  - dmix 7y ago
    I’d never trust a jury for any highly technical matter such as this. Prosecutors have shown they can be highly effectively at spinning even the most basic security research into sounding like serious criminal behaviour (like punishing someone with serious jail time for incrementing the id number in a URL and finding other users personal profiles completely unprotected). You only gamble on juries for stuff like murder trials and similar basic crimes.
  - gowld 7y ago
    Juries can't nullifiy laws. They can nullify verdicts.
    - mLuby 7y ago

gen3 7y ago

> "But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed." I wonder if there is a market for selling GDPR compliance / advising services. Some company that makes sure your doing everything right, and inspects the requests for validity.

ceejayoz 7y ago
There are quite a few firms offering compliance / advisory services, including ones that'll host the data request forms etc. for you. I'm not aware of any willing to take on the liability of verifying identities as part of that, though.
- gen3 7y ago
  Do you know of any companies that handle the whole process, similar to how stripe handles the whole purchasing process?
  - ceejayoz 7y ago
    I'm sure one of the major consulting shops like Accenture would be willing to do it (poorly, and for insane amounts of money, of course). I'm not aware of any SaaS style offerings, though.
  - laurentb 7y ago
    replyed to the wrong comment, see parent comment for my reply :)
  - PeterisP 7y ago
    Can you elaborate by what do you mean with "the whole process"? If you have some internal processes that handle the data, then you can't really separate and outsource the "GDPR part" without outsourcing the whole business process that handles the data - e.g. if you ship goods, then handling of adresses can't (IMHO) be separated from the shipping, if you run a website, then the handling of all the related privacy issues can't be separated from running the website. Furthermore, even if you outsource the whole business process that handles sensitive data, you're still the 'controller' of the data, and you still carry full responsibility for it - you can and should have legal arrangements with the processor to recoup your damages/costs if they screw up, but you're the party that's directly liable, and if the processor can't/won't pay, that's solely your problem. You can outsource certain parts of GDPR compliance - such as handling the paperwork and managing the customer enquiries properly, but it's hard(impossible?) to separate "the whole process" from the rest of your business.

VMG 7y ago

who could have thought

deleted 7y ago
[deleted]

csomar 7y ago

This is horrible. So right now, in order to get access to data for a certain person, you need to hack your way through a few of the potential services he is using and drive from there. 1. The data might have things like IDs (ie: Crypto exchanges). 2. You can use that data to ask for more data. If you got a copy of his passport, now you can ask for more with this new piece. 3. Looks like some people still store passwords in plain text or don't mind exchanging that over email. This means some of these service might reveal a password to you. 4. With that, you can start hacking into other accounts. You also have loads of knowledge about the person, so you might be able to guess his password. 5. Now you have access to his email, dropbox, banking details and maybe even lock him out. Right about time: https://en.wikipedia.org/wiki/Cobra_effect https://en.wikipedia.org/wiki/Cobra_effect

davidhyde 7y ago
One of the major goals of GDPR is to discourage firms from retaining personal data in the first place. It did not used to cost them anything so they kept it regardless of its use. Now that there are big risks to keeping it these firms have to think twice about it. This "cobra effect" is one more reason NOT to retain personal information in the first place.
- testvox 7y ago
  And yet other laws require the collection and retention of sensitive user data, in particular any service that allows for transmission of large amounts of money (crypto exchanges were a good example).
  - aforwardslash 7y ago
    That is well covered within GDPR scope. Retaining data to fulfill legal obligations is allowed. One common related example is invoice data.
    - AnthonyMouse 7y ago
      But then "just don't keep the data" is not an effective response to these attacks of requesting someone else's data.

rossng 7y ago

This is a reflection of the fact that we have no good way for someone to digitally prove their identity. Some countries are getting close-ish - Denmark's NemID system, for example, is used by a lot of financial institutions. However, there remains no easy way to make ad-hoc verifiable statements like 'I am John Smith and I authorise you to send this data to xyz@example.org'. Governments, please solve this problem! Essentially: combine NemID with Keybase and build a UI that normal citizens can understand.

giancarlostoro 7y ago
> Governments, please solve this problem! I would prefer governments to solve it with competent Software Engineers in the mix and maybe other professionals from the finances and IT security industries, but never one single large entity.
- rossng 7y ago
  Of course. There are plenty of different ways to build such a platform (or contract it out) - I'm not advocating any in particular. The UK has a rather interesting example in the GOV.UK Verify service, which federates the identity verification and authentication out to third parties. The user can then choose which provider (e.g. Barclays, Post Office) they want to prove their identity through. Experian is also one of the providers, which perhaps illustrates some of the flaws with this design...
- jsgo 7y ago
  I didn't take that as he wanted legislative representatives and the like to solve it, so much as to make it a matter of focus to enlist the kinds of people you're recommending to provide a solution like this. Personally, I really feel we need a private/public-key kind of system in place for certain things like Social Security Numbers (SSNs) in the US. Such that if a leak also includes an SSN (essentially a public key), it could then be regenerated and some apparatus to manage filtering it to the parties it was assigned to prevent needing to redistribute it manually as a consumer/user (like using your Google, Facebook, or whatever OpenID as credentials for another site and it is stored in the account showing that it is being used as such). If they could automatically detect said public keys being exposed and automate the resetting and distribution process, even better (users should still be able to manually do it if they feel it is compromised though).

triangleman 7y ago

This is a great thing that the hacker noticed. It sounds like we really need more OpenID style auth and a lot more limited-lease access to personal data, and more tools to store our own data.

jedberg 7y ago

The main benefit of GDPR is that it forced companies to audit their policies and procedures to have slightly more hygienic data practices. The downside is that it made social engineering easier. What this guy did was nothing new. But now those businesses were compelled to help him instead of ignore him until he pestered them enough. Good job government regulators! You just made the most common fraud even easier!

camjohnson26 7y ago

This is the problem with overly aggressive legislation. The big companies performed well, the small companies ignored the law, and the medium sized companies tried to comply and failed. You can’t legislate good behavior because people will always find a way around the laws. The legal philosophy behind GDPR seems to be nothing more than to make everyone a criminal and then choose who to prosecute, and in that case why have laws at all rather than letting law enforcement punish whoever they choose? At the end of the day this incentivizes big companies to comply with the laws because they can afford the necessary legal teams and the laws provide a moat to their entrenched power. It incentivizes small companies to ignore the laws just like the move fast and break things mentality of Silicon Valley. The people it hurts are the medium sized, growing companies who are best positioned to fight the big monopolies but are now being held back by well meaning but over burdensome legislation. The good side of GDPR is that it’s trying to advocate for consumer privacy, which overall is a good thing. The issue is that it’s not a legal problem. In the same way you can’t declare drugs to be illegal and expect the supply of drugs to instantly disappear, you can’t declare misuse of data illegal and expect the same. As long as the data has value there will be a market for it, so why not draft sensible regulations instead of trying to solve the problem with laws.

PeterisP 7y ago
I wouldn't agree that the medium sized companies tried to comply with the GDPR and failed. Yes, they tried to comply with that particular request but the failures suggest that they didn't even try to be GDPR compliant in the first place - if they had done so, then they would have had assigned a data protection officer who would have long ago asked themselves the question "what do we do in case of a personal information request?", and written down a reasonable process for handling such requests, possibly consulting with the local data protection agency. That would count as "trying", as it was their duty to have done this a year and a half ago. It's basic 'table stakes', a precondition to being permitted to handle personal data at all. If they started thinking about "how do we verify identities" only on day they received the request from this researcher, then that's not trying to comply, that's being grossly negligent.
- 7y ago

buboard 7y ago

It appears to me that you can’t opt out of the right to access or right of deletion. Not even temporarily.

jwildeboer 7y ago

“Bad implementation of GDPRs information rights” would be the more correct but less clickbaity headline IMHO. The funny twist being that these bad implementations are a GDPR violation too and can be punishable under GDPR.

grapehut 7y ago
Even if done correctly, they are just verifying that you bothered to get a photoshopped passport with the targets name in it.
- Avamander 7y ago
  Basically every country needs to run their own PKI for its citizens to even have any hope to legally prove they are who they are. I've so far seen a single well-working solution to the authentication and authorization problem and that is the Estonian ID-card PKI, others are trying to implement it (Finland, Latvia, actually even the EU) but they're basically nearly two decades behind.
dwild 7y ago
The funny twist is that it seems pretty hard/even impossible to handle GDPR laws and could be punishable under GDPR to have enough verification. All you know about a user is its name. How can you verify someone identity while still not being "overly burdensome" (which is required by GDPR)?

thekyle 7y ago

When I first heard about the GDPR I imagined that this kind of thing might happen. https://devrant.com/rants/1400805/you-know-gdpr-compliance-is-going-to-create-a-whole-new-form-of-scam-where-scamm https://devrant.com/rants/1400805/you-know-gdpr-compliance-i...

kmlx 7y ago

this is peanuts. one eu country government decided it needed approval under gdpr from hospital patients before treatment/surgery/etc. this denied service to a bunch of (tech) illiterate people, bringing the budget back in line. another one: due to gdpr, violent thugs hired by the police to hurt protesters cannot be named. it would apparently trample on their rights. gdpr is, as forecasted, a complete mess. a mess that is exploited by corrupt eu governments to great effect.

arendtio 7y ago

Aren't companies under the GDPR obliged to report [1] if the got hacked/a data breach? Sounds to me as if quite a few just got hacked via social engineering... [1] https://blog.netwrix.com/2018/04/19/gdpr-rules-of-data-breach-notification-how-to-report-personal-data-loss-and-avoid-fines/ https://blog.netwrix.com/2018/04/19/gdpr-rules-of-data-breac...

40acres 7y ago

"Generally if it was an extremely large company - especially tech ones - they tended to do really well," he told the BBC. "Small companies tended to ignore me. "But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed." This sums up regulatory compliance across the world quite well.

Mirioron 7y ago
I think this is part of the reason why GDPR needs an exemption for businesses that are too small. This kind of a flaw will be abused more and more and they'll never be able to close this gap with small and medium businesses.
- blub 7y ago
  1. Such an exception would be used by large companies to evade the law. 2. Small and medium companies are also committing privacy abuses.
  - Mirioron 7y ago
    1. You can make late companies unable to evade the law. 2. Yeah? But according to this article GDPR actually makes small and medium companies even more dangerous to trust with your information.

deleted 7y ago

[deleted]

jokoon 7y ago

GDPR is not a perfect law, but I think it's a great leverage to use when negotiating against US companies if you're a EU country. I mean at some point, EU countries will get tired of the US going a little too far. It's about being able to negotiate, and with the digital age and the massive ad market, it only makes sense for the EU to protect itself after brexit and the cambridge analytica stories.

mlindner 7y ago

And Europeans wonder why Americans hate the GDPR laws. Overreaching regulation will be implemented in a least-effort method.

Teknoman117 7y ago

Can anyone here who's experienced with GDPR's provisions talk about the extent any given company is allowed to go to verify the identity of someone requesting information? I'd hate it if someone pulls a "I'd like to be forgotten" request on me without said organization absolutely verifying my identity. If would seem that if they complied, they wouldn't be able to undo the operation...

tzs 7y ago

A lot of the risk of this kind of thing could be greatly reduced if the law were changed so that for data that you should already have about yourself the company only has to tell you whether they have that data. For example, I know my birth date. A company that also has my birth date should be able to just tell me that they have my birth date. They should not have to tell me the actual date. Most of the data mentioned in the article is like this: credit card information, login and password information, social security number, stays in hotels, train journeys, high school grades, and maiden name. Companies like credit reporting agencies that keep such data and share it with others would need to be an exception, so that you could check that they aren't giving out incorrect information about you.

tripzilch 7y ago

Yes. This just shows the problem that was already there. The GDPR is fundamentally a thing about having the responsibility to handle people's data properly The companies that failed, obviously cannot handle the responsibility of managing personal data without it getting into the hands of the wrong people and they shouldn't have had it in the first place. It's much harder to test but this is a good indicator that they probably also don't have controls to manage employee access.

anbop 7y ago

I can’t believe a drivers license scan is all that is needed for many companies. That means that losing my wallet on the street effectively means that someone can go get my entire digital history. Why not require the user to request this data while signed in to the service?