4 ms·

The data was encrypted and protected with a password, according to the city. – The Japan Times

by rado 4y ago

badkitty99 4y ago
lmm 4y ago
No doubt the password was written on a piece of paper next to the USB. This is the country that loves to send an encrypted attachment and a separate email a minute later with the (weak) password as if that achieves anything.
- tnzk 4y ago
  One of the largest banks in Japan once sent over me a piece of paper on which the password I set was written :)
  - sva_ 4y ago
    I once lost my sim card and wanted to lock it, so I called the phone company and they asked me for the first 3 characters of my password to verify myself.
    - smcl 4y ago
      So I know what you’re thinking but it is at least technically possible that they don’t store it as plaintext - like maybe when you set the password it stored a salted hash of the whole thing, plus also a special hash of the first 3 chars for emergency recovery or locking operations (ie can be used when you show up in-person with the photo ID they have on file). So they’d enter the characters, and compare the hash and you’d then follow password reset process offline. But … while it’s possible, I think we all know they probably just stored it as plaintext :-D
      - seoaeu 4y ago
        Storing a hash of the first three characters still cripples the security. It is trivial to brute force a hash when there’s only 62^3 possibilities. And once you know the first characters, brute forcing the remaining ones is exponentially easier
        smcl 4y ago
        It absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it doesn't necessarily mean your password is stored in the clear. But honestly I think any time you're prompted like this for something that might get implemented via storing a password in the clear it probably means it was been implemented that way.
        hnlmorg 4y ago
        I always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.
- kalleboo 4y ago
  It was announced ON THE NEWS that "the password was 13 English characters that had meaning to the staff and policy was to change it yearly". The city name is Amagasaki. Everyone on Twitter is guessing the password was "Amagasaki2022"
  - chx 4y ago
    Unlikely. amagasaki2002 is more likely :P
    - deleted 4y ago
      [deleted]
- deleted 4y ago
  [deleted]
- 13of40 4y ago
  > an encrypted attachment and a separate email It's a useful vector for things like malware because an intermediate scanning service can't examine the attachment without having both emails. If there's a concern about some PII or whatever being intercepted in transit, it should help with that too.
  - BiteCode_dev 4y ago
    We can't expect the general public to be very good at security. I gave up on PGP, and most of my clients and I don't have an e2e encrypted chat or password manager service in common. But at least I tell them to use a "burn after reading" post on an encrypted pastebin like 0bin.net for the secrets thing to send me. It adds almost no complexity, best case scenario, you increase the security against bots since they would need to parse the link, visit the paste, trigger the Burn After Reading feature, interpret JS, extract the password and use it. That's already a pretty specific bot. Most interceptions, even human, will be detected thanks to the burn after reading. And the password is never stored in the pastebin db since it's encrypted client side. Worst case scenario, it's the same than a plain text email. Not much to loose. It's easy to teach. Requires no install, little skill or tech, works in most corporate setup. It's not good security. But it's better than abysmal security.
    - Symbiote 4y ago
      It isn't the general public though. It's staff who should be trained to use tools necessary for their job.
      - BiteCode_dev 4y ago
        I'll let you know on a secret: most staff is composed of the general public.
sys_64738 4y ago
What is the intent of admitting this? What happened here is utterly appalling and the employee and a few layers of management above should be fired and prosecuted. Haven’t these fools realized the data can be brute forced offline? Are they that stupid to not realize lists of passwords are run against such data?
- jamal-kumar 4y ago
  It comes from a culture of honor and taking ultimate responsibility for your mistakes in order to preserve this honor through honesty and integrity, all the same which led to the safe return of the data in the end.
  - 0des 4y ago
    Good morning Jamal. I've got to admit, I really respect that culture of taking ownership of their mistakes. Other companies could take a page out of their book and do a little good.
    - jamal-kumar 4y ago
      Yeah, I went to school there when I was a teenager. It was an interesting experience to say the least. Much more social cohesion in some ways but definitely a LOT more bullying than I was used to seeing in North America. I got to be friends with the mean gay kids with shaved eyebrows and hot girls due to where I ended up doing my homestay and it was... wow, those kids were MEAN. Never towards me but a few kids in our classes really got the brunt of it. They were insulting their families to their faces in front of the teacher who just completely ignored this happening right in front of him. It's pretty clear in my travels that there's good and bad in pretty much every culture and every country, and that you should focus and celebrate the good while being highly aware of the flip side of things that might be an issue if you are blind to that.
- nonrandomstring 4y ago
  > What is the intent of admitting this? Incident response always ends on "lessons learned" and it's rarely productive to hide the facts due to political embarrassment. Earliest disclosure also mitigates against much bigger liabilities as a consequence of a leak. > management above should be fired and prosecuted. And be immediately replaced by management with the same level of understanding and responsibility. > Haven’t these fools realized... No. And this is the key point. The biggest thing by FAR in cybersecurity is education. Ordinary people do not have any working model of the threat landscape and basic operational security because they foolishly, blindly trust technology and services providers. We literally need a second digital literacy revolution. One that undoes a lot of the naive and trusting enthusiasm for digitalisation that we inculcated in the 80s and 90s. Unfortunately that goes against the grain of almost every policy that's active out there today.

The data was encrypted and protected with a password, according to the city. – The Japan Times

by rado 4y ago

The data was encrypted and protected with a password, according to the city. – The Japan Times

badkitty99 4y ago

lmm 4y ago

No doubt the password was written on a piece of paper next to the USB. This is the country that loves to send an encrypted attachment and a separate email a minute later with the (weak) password as if that achieves anything.

tnzk 4y ago
One of the largest banks in Japan once sent over me a piece of paper on which the password I set was written :)
- sva_ 4y ago
  I once lost my sim card and wanted to lock it, so I called the phone company and they asked me for the first 3 characters of my password to verify myself.
  - smcl 4y ago
    So I know what you’re thinking but it is at least technically possible that they don’t store it as plaintext - like maybe when you set the password it stored a salted hash of the whole thing, plus also a special hash of the first 3 chars for emergency recovery or locking operations (ie can be used when you show up in-person with the photo ID they have on file). So they’d enter the characters, and compare the hash and you’d then follow password reset process offline. But … while it’s possible, I think we all know they probably just stored it as plaintext :-D
    - seoaeu 4y ago
      Storing a hash of the first three characters still cripples the security. It is trivial to brute force a hash when there’s only 62^3 possibilities. And once you know the first characters, brute forcing the remaining ones is exponentially easier
      - smcl 4y ago
        It absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it doesn't necessarily mean your password is stored in the clear. But honestly I think any time you're prompted like this for something that might get implemented via storing a password in the clear it probably means it was been implemented that way.
        hnlmorg 4y ago
        I always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.
kalleboo 4y ago
It was announced ON THE NEWS that "the password was 13 English characters that had meaning to the staff and policy was to change it yearly". The city name is Amagasaki. Everyone on Twitter is guessing the password was "Amagasaki2022"
- chx 4y ago
  Unlikely. amagasaki2002 is more likely :P
  - deleted 4y ago
    [deleted]
deleted 4y ago
[deleted]
13of40 4y ago
> an encrypted attachment and a separate email It's a useful vector for things like malware because an intermediate scanning service can't examine the attachment without having both emails. If there's a concern about some PII or whatever being intercepted in transit, it should help with that too.
- BiteCode_dev 4y ago
  We can't expect the general public to be very good at security. I gave up on PGP, and most of my clients and I don't have an e2e encrypted chat or password manager service in common. But at least I tell them to use a "burn after reading" post on an encrypted pastebin like 0bin.net for the secrets thing to send me. It adds almost no complexity, best case scenario, you increase the security against bots since they would need to parse the link, visit the paste, trigger the Burn After Reading feature, interpret JS, extract the password and use it. That's already a pretty specific bot. Most interceptions, even human, will be detected thanks to the burn after reading. And the password is never stored in the pastebin db since it's encrypted client side. Worst case scenario, it's the same than a plain text email. Not much to loose. It's easy to teach. Requires no install, little skill or tech, works in most corporate setup. It's not good security. But it's better than abysmal security.
  - Symbiote 4y ago
    It isn't the general public though. It's staff who should be trained to use tools necessary for their job.
    - BiteCode_dev 4y ago
      I'll let you know on a secret: most staff is composed of the general public.

sys_64738 4y ago

What is the intent of admitting this? What happened here is utterly appalling and the employee and a few layers of management above should be fired and prosecuted. Haven’t these fools realized the data can be brute forced offline? Are they that stupid to not realize lists of passwords are run against such data?

jamal-kumar 4y ago
It comes from a culture of honor and taking ultimate responsibility for your mistakes in order to preserve this honor through honesty and integrity, all the same which led to the safe return of the data in the end.
- 0des 4y ago
  Good morning Jamal. I've got to admit, I really respect that culture of taking ownership of their mistakes. Other companies could take a page out of their book and do a little good.
  - jamal-kumar 4y ago
    Yeah, I went to school there when I was a teenager. It was an interesting experience to say the least. Much more social cohesion in some ways but definitely a LOT more bullying than I was used to seeing in North America. I got to be friends with the mean gay kids with shaved eyebrows and hot girls due to where I ended up doing my homestay and it was... wow, those kids were MEAN. Never towards me but a few kids in our classes really got the brunt of it. They were insulting their families to their faces in front of the teacher who just completely ignored this happening right in front of him. It's pretty clear in my travels that there's good and bad in pretty much every culture and every country, and that you should focus and celebrate the good while being highly aware of the flip side of things that might be an issue if you are blind to that.
nonrandomstring 4y ago
> What is the intent of admitting this? Incident response always ends on "lessons learned" and it's rarely productive to hide the facts due to political embarrassment. Earliest disclosure also mitigates against much bigger liabilities as a consequence of a leak. > management above should be fired and prosecuted. And be immediately replaced by management with the same level of understanding and responsibility. > Haven’t these fools realized... No. And this is the key point. The biggest thing by FAR in cybersecurity is education. Ordinary people do not have any working model of the threat landscape and basic operational security because they foolishly, blindly trust technology and services providers. We literally need a second digital literacy revolution. One that undoes a lot of the naive and trusting enthusiasm for digitalisation that we inculcated in the 80s and 90s. Unfortunately that goes against the grain of almost every policy that's active out there today.