15 ms·
Lost USB with 460k city residents’ personal data found
- rado 4y agoThe data was encrypted and protected with a password, according to the city. – The Japan Times
- badkitty99 4y ago
- lmm 4y agoNo doubt the password was written on a piece of paper next to the USB. This is the country that loves to send an encrypted attachment and a separate email a minute later with the (weak) password as if that achieves anything.
- tnzk 4y agoOne of the largest banks in Japan once sent over me a piece of paper on which the password I set was written :)
- sva_ 4y agoI once lost my sim card and wanted to lock it, so I called the phone company and they asked me for the first 3 characters of my password to verify myself.
- smcl 4y agoSo I know what you’re thinking but it is at least technically possible that they don’t store it as plaintext - like maybe when you set the password it stored a salted hash of the whole thing, plus also a special hash of the first 3 chars for emergency recovery or locking operations (ie can be used when you show up in-person with the photo ID they have on file). So they’d enter the characters, and compare the hash and you’d then follow password reset process offline. But … while it’s possible, I think we all know they probably just stored it as plaintext :-D
- seoaeu 4y agoStoring a hash of the first three characters still cripples the security. It is trivial to brute force a hash when there’s only 62^3 possibilities. And once you know the first characters, brute forcing the remaining ones is exponentially easier
- smcl 4y agoIt absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it doesn't necessarily mean your password is stored in the clear. But honestly I think any time you're prompted like this for something that might get implemented via storing a password in the clear it probably means it was been implemented that way.
- hnlmorg 4y agoI always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.
- kalleboo 4y agoIt was announced ON THE NEWS that "the password was 13 English characters that had meaning to the staff and policy was to change it yearly". The city name is Amagasaki. Everyone on Twitter is guessing the password was "Amagasaki2022"
- chx 4y agoUnlikely. amagasaki2002 is more likely :P
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- 13of40 4y ago> an encrypted attachment and a separate email It's a useful vector for things like malware because an intermediate scanning service can't examine the attachment without having both emails. If there's a concern about some PII or whatever being intercepted in transit, it should help with that too.
- BiteCode_dev 4y agoWe can't expect the general public to be very good at security. I gave up on PGP, and most of my clients and I don't have an e2e encrypted chat or password manager service in common. But at least I tell them to use a "burn after reading" post on an encrypted pastebin like 0bin.net for the secrets thing to send me. It adds almost no complexity, best case scenario, you increase the security against bots since they would need to parse the link, visit the paste, trigger the Burn After Reading feature, interpret JS, extract the password and use it. That's already a pretty specific bot. Most interceptions, even human, will be detected thanks to the burn after reading. And the password is never stored in the pastebin db since it's encrypted client side. Worst case scenario, it's the same than a plain text email. Not much to loose. It's easy to teach. Requires no install, little skill or tech, works in most corporate setup. It's not good security. But it's better than abysmal security.
- Symbiote 4y agoIt isn't the general public though. It's staff who should be trained to use tools necessary for their job.
- BiteCode_dev 4y agoI'll let you know on a secret: most staff is composed of the general public.
- sys_64738 4y agoWhat is the intent of admitting this? What happened here is utterly appalling and the employee and a few layers of management above should be fired and prosecuted. Haven’t these fools realized the data can be brute forced offline? Are they that stupid to not realize lists of passwords are run against such data?
- jamal-kumar 4y agoIt comes from a culture of honor and taking ultimate responsibility for your mistakes in order to preserve this honor through honesty and integrity, all the same which led to the safe return of the data in the end.
- 0des 4y agoGood morning Jamal. I've got to admit, I really respect that culture of taking ownership of their mistakes. Other companies could take a page out of their book and do a little good.
- jamal-kumar 4y agoYeah, I went to school there when I was a teenager. It was an interesting experience to say the least. Much more social cohesion in some ways but definitely a LOT more bullying than I was used to seeing in North America. I got to be friends with the mean gay kids with shaved eyebrows and hot girls due to where I ended up doing my homestay and it was... wow, those kids were MEAN. Never towards me but a few kids in our classes really got the brunt of it. They were insulting their families to their faces in front of the teacher who just completely ignored this happening right in front of him. It's pretty clear in my travels that there's good and bad in pretty much every culture and every country, and that you should focus and celebrate the good while being highly aware of the flip side of things that might be an issue if you are blind to that.
- nonrandomstring 4y ago> What is the intent of admitting this? Incident response always ends on "lessons learned" and it's rarely productive to hide the facts due to political embarrassment. Earliest disclosure also mitigates against much bigger liabilities as a consequence of a leak. > management above should be fired and prosecuted. And be immediately replaced by management with the same level of understanding and responsibility. > Haven’t these fools realized... No. And this is the key point. The biggest thing by FAR in cybersecurity is education. Ordinary people do not have any working model of the threat landscape and basic operational security because they foolishly, blindly trust technology and services providers. We literally need a second digital literacy revolution. One that undoes a lot of the naive and trusting enthusiasm for digitalisation that we inculcated in the 80s and 90s. Unfortunately that goes against the grain of almost every policy that's active out there today.
- robobro 4y ago> The company explained that the employee had drinks after work and later fell asleep on the street, but when he woke up he realized that he had lost the bag containing the USB. Oh, Japan...
- reaperducer 4y agoIf he had gone to sleep in the train station because the trains stop running at midnight, and someone returned the wayward USB drive to him while he slept, with a little note and a can of Premium Boss for when he woke up all hungover, it would be the most Japan story of the month.
- 0des 4y agoOnly in Japan can you pass out drunk and wake up with presents and a caretaker. Unbelievable.
- Tor3 4y agoThat reminds me.. someone I know very well managed to sleep past the only scheduled stop at a station near his home, and it was the last train for the night. But they helpfully made an unscheduled stop at the next station, just for him, which fortunately still wasn't too far away. Japan, of course. Trains in Japan are always on schedule, as in exactly on schedule, but they have margins to work with and could do that extra stop by just increasing the speed a bit afterwards.
- Cloudef 4y agoAh yes, very common here
- TheOnly92 4y agoThey actually announced the length and the characters (letters/numbers) used in the password in yesterday's press conference, if you could believe it... Many people on the internet guessed what the password probably was (city name + year).
- Zenst 4y agoOnly just read the BBC article saying it was lost, which is only an hour old so clearly they didn't dig deep into this as the found article is three hours old. Shows news is best sourced from multiple sources for the full picture. https://www.bbc.co.uk/news/world-asia-61921222 https://www.bbc.co.uk/news/world-asia-61921222
- ume 4y agoI’ve undertaken information security training in a number of Japanese companies. They all had what I thought was a disproportionate weighting on the “blind drunk salaryman falls asleep on a train and leaves behind a laptop, mobile phone, USB stick etc.” scenario. I stand corrected. Edited for clarity
- iasay 4y agoThat was the usual loss vector when I was in the defence sector as well.
- lelandfe 4y agohttps://gizmodo.com/how-apple-lost-the-iphone-4-5520438 https://gizmodo.com/how-apple-lost-the-iphone-4-5520438 It can happen to Americans as well, as evidenced by an Apple engineer leaving an iPhone prototype at a bar after his birthday. > "I underestimated how good German beer is," he typed into the next-generation iPhone 4
- jamal-kumar 4y agoI always thought they did that "by accident" on purpose kind of thing. Like macrumors was always some kind of marketing ploy.
- zaptrem 4y agoUnlikely seeing as they blacklisted Gizmodo for life and (afaik) practically busted down the door of one of their reporters.
- jamal-kumar 4y agoI must be thinking of when this happened like at least two other times then [1] [1] https://www.cnet.com/tech/tech-industry/apple-loses-another-unreleased-iphone-exclusive/ https://www.cnet.com/tech/tech-industry/apple-loses-another-...
- belter 4y ago
- seba_dos1 4y agoAt work we are dealing with a bug which causes USB XHCI controller to die and become inaccessible after failed runtime resume, and it took me a while to understand how "lost USB" can be related to city resident data.
- sydthrowaway 4y agoWhere do you work
- brentm 4y ago> The company explained that the employee had drinks after work and later fell asleep on the street, but when he woke up he realized that he had lost the bag containing the USB. I respect the honesty but wow, I can't believe any company would spell it out that literally.
- ugjka 4y agoIsn't that Japan?
- tux3 4y agoThey sound a lot more trustworthy to me for owning up to it and spelling it out literally. That makes it sound like an isolated incident that they're able to recognize as a problem publicly. When a company does a standard "we take your privacy very seriously" non-response right after demonstrating that they do not, in fact, take it very seriously, it makes it sound like they're not willing to acknowledge the problem at all.
- xbar 4y agoAgreed. The transparency of the entire event, end to end, becomes a "ho hum, thanks for telling me, i guess" sort of story. Which is, I suppose, why it's on HN. I mean, "guy loses usb with data, finds usb with data" used to happen to me twice on Thursday back when usb was a thing. It was hardly front page news.
- Aeolun 4y ago> That makes it sound like an isolated incident that they're able to recognize as a problem publicly. I think it’s more that 80% of all company employees can symphatize. The situation isn’t all that uncommon (falling asleep on the street and misplacing your stuff somewhere). The fact that this person had a USB stick with the data of ~450k people on was.
- samatman 4y agoGiven how Japanese work culture functions, this is not that different from an American company saying that an employee went to a company happy hour and lost the USB stick in the taxi on the way home. Staggering to a bench and sleeping it off is just, normal. No one is going to pick your pocket, so why not?
- 960design 4y ago
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- O__________O 4y agoFor content, Japan is well known for finding & returning lost items. From 2020: “With an inner-city population fast approaching 14 million people, millions of items go missing here each year. But a staggering number of them find their way home. In 2018, over 545,000 ID cards were returned to their owners by Tokyo Metropolitan Police – 73% of the total number of lost IDs. Likewise, 130,000 mobile phones (83%) and 240,000 wallets (65%) found their way back. Often these items were returned the same day.” Source: https://www.bbc.com/future/article/20200114-why-japan-is-so-successful-at-returning-lost-property https://www.bbc.com/future/article/20200114-why-japan-is-so-...
- seanw444 4y agoA sign of a mannered people. Now let's try it in New York.
- bragr 4y agoNo it's a sign of the overall culture, not the individual. You could do this in New York but it would be so unusual that people would think you are scamming them or just look at you like you grew a second head.
- picture 4y agoI think "a sign of a mannered people" refer to the collective rather than the individual, but it also takes changing the individual to change the collective.
- zzixp 4y agoRelated video: https://www.youtube.com/watch?v=jnL7sJYblGY&t=2s https://www.youtube.com/watch?v=jnL7sJYblGY&t=2s
- elliottkember 4y agoI have a link for you! > A group of 13 research assistants (11 men and 2 women) were recruited for a trip around the world. They traveled to 355 major cities across 40 countries. In each city, they visited banks, theaters, hotels, police stations, and other public spaces and turned in a “lost wallet,” which they claimed to have found on the street, to a nearby employee. https://gizmodo.com/researchers-lost-17-000-wallets-in-hundreds-of-cities-t-1835666685 https://gizmodo.com/researchers-lost-17-000-wallets-in-hundr...
- coffeeblack 4y agoPeople still use external storage media without full disk encryption? How?
- shikoba 4y agoSecurity, who Cares?
- brigandish 4y agoI see that a lot of people are praising the openness of this admission but cynical old me who's lived in Japan a while - a culture that (generally) values appearances over truth - notes that the article mentions that USB was found. I have to wonder if we'd have heard about it if they hadn't.
- johnwalkr 4y agoIt was definitely reported on before it was found.
- brigandish 4y agoAfter a re-read of the article I do believe you are right. Thanks. My cynicism will live to fight another day though!
- deleted 4y ago[deleted]
- duxup 4y agoI had my personal information lost three times at one company when someone at HR decided to go out for drinks, left their laptop in their car and their laptop was stolen. THREE TIMES. When I asked why our personal information was stored on a laptop I was told that I was being "unhelpful". Thankfully not long after the company was acquired and they fired everyone who wasn't directly making products or customer facing or a direct manager of a customer facing or product development employee. It was a pretty stark layoff. I later ran into the new CEO who was super personable and we were chatting and I asked about the acquisition. "We wanted the products, we wanted the support team and engineers, but we knew we didn't want any of the rest, they were not smart people." I liked that guy.
- toyg 4y ago> someone at HR decided to go out for drinks, left their laptop in their car and their laptop was stolen. THREE TIMES. Call me cynical, but I'd say that sentence translates to "someone at HR wanted a new laptop".
- deleted 4y ago[deleted]
- yongjik 4y agoFrom what I heard, the original press conference was a doozy: Reporter: Wasn't the password something insecure like a four-digit number? Officer: No, it's a 13-letter alphanumeric password. Reporter: But if it was totally random wasn't it hard to use? Officer: It's a meaningful English word, followed by a meaningful four-digit number, so it's quite easy to memorize. Reporter: By an English word, you mean something like _password_? Officer: It's not a simple word. It's a word and a number that are related to the City of Amagasaki. Reporter: Do you use a capital letter? Officer: It's grammatically correct, as only the first letter is capital. For god's sake, if you just lost a USB stick with the whole city's personal data, don't spell out how you chose your password!!!
- notRobot 4y agoThis seems like it's out of My Family And Other Animals - 2022 edition.
- pacarvalho 4y agoAt least there was a password lol
- TwistedWave 4y agoAmagasaki2022
- TrainedMonkey 4y ago"Amagasaki2022" is a 13-letter alphanumeric password with meaningful word and four-digit number.
- omoikane 4y agoLast time when something like this happened, it was 2 floppy disks[1], so at least they have improved that bit. [1] "Tokyo police lose 2 floppy disks containing info on public housing applicants" - https://news.ycombinator.com/item?id=29738298 https://news.ycombinator.com/item?id=29738298
- glandium 4y agoThe last thing I heard yesterday about this event is that they found the employee's bag where he presumably left it when he slept. He "just" forgot it there when he woke up... For all the talk about the USB and the handling of data, I so wish it had sparked some conversation about the drinking problem in Japan, but nope, not one bit about that. But you'll regularly hear how dangerous and evil Marijuana is...
- pvaldes 4y agoSounds like a manual about how you fix a minor leak that would pint directly to you, with a big leak that dissociates you from the problem and divert the hounds to chase a random tool. Creating a reasonable doubt that would serve well in case of legal troubles. It seems that exactly the same happens here and there each a few years. If they even were encouraging people to try possible passwords, well... nobody is so dumb. My bet would be that the USB has been hidden in a safe place for some hours but knowing all the time where was.