11 ms·

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any q

by chaps 2y ago

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html https://mchap.io/that-time-the-city-of-seattle-accidentally-...

doctorpangloss 2y ago
What are the administrators of CANVAS hiding?
- chaps 2y ago
  Hard to say. One of my personal drivers for this lawsuit is a tip I received that said that Chicago has a list of vendors whose tickets are dropped in the back-end. When I requested that info, the city said they had no such list. I trust my source, so having schema information could help figure out the extent and if they were lying.
  - noboostforyou 2y ago
    Considering how much they fought to not release the schema, there's probably a column named "exempt_from_penalty" or something equally obvious.
    - thaumasiotes 2y ago
      If they lose in court they have to pay court-determined attorneys' fees. That might be sufficient to get them to appeal automatically. This is a tension you sometimes see discussed in the context of wrongful imprisonment, where one faction says that if you get tossed in jail for 30 years over something there was never any evidence that you did, the state should have to pay a penalty, and another faction says that if you penalize the state for randomly imprisoning innocent people, those people will never be allowed out of jail.
  - MBCook 2y ago
    Well that certainly sounds suspicious. But it could also provide more damming evidence of targeting groups, people skimming the till, bribes to make tickets go away, all sort of fun shenanigans. And boy they’re fighting suspiciously hard. Good luck.
    - Muromec 2y ago
      Bribes are most certainly not logged in the system under the "bribes" column or codified in any way. The data discovered through foi could show some patterns which are suggestive of bribes, but the actual thing is negotiated "off chain".
      - MBCook 2y ago
        That’s what I meant. For example, people who have a suspicious number of tickets dismissed. Or perhaps certain employees that dismiss a suspicious number.
  - 9dev 2y ago
    Earnest question: If you suspect them of lying on the issue, why would you trust them to release the full schema in response to the FOIA request, and not just omit any possibly incriminating columns?
    - lmm 2y ago
      By that logic there's no point investigating any crime or doing any kind of audit. You increase the costs of covering up, and put them in a dilemma - remember this is exactly what brought down Nixon.
    - cyanydeez 2y ago
      Many times the people answering the requests aren't part of the conspiracy to commit random acts of malice. Sometimes they're roped into it under threat of termination. And often times, the denials eventually lead to significant reorg once judges and Congress can revise laws to fix the ambiguities.
    - jrockway 2y ago
      It's always a possibility that some low level official not in on the scam sees the FOIA request before management tells them not to work on it. The more you ask for, the less filtering there is going to be, simply because of how people work. If you're running the scam, you don't want to tell low level employees about it, because they have no incentive not to blow the whistle.
    - Muromec 2y ago
      Because this is not how government works. Most of the time it's not a heavily entranched conspiracy. Once the request is approved to go through by the legal department, some technician will happily give you everything you want and it won't be censored or tampered with in process.
    - tptacek 2y ago
      How is this different from literally any other FOIA transaction, computer-y or otherwise?
      - 2y ago
- butlike 2y ago
  'ethnicity' header, 'net_income' header... wouldn't doubt chicago could be cave man enough to do this
hathawsh 2y ago
Kudos to you for enduring through this fight! We can only achieve transparency when people choose not to be complacent. Thank you. What do you think are the next steps?
- chaps 2y ago
  My first step is to actually finish my post :) But after that, getting a reasonable law passed to fix this now-broken nonsense.
mmaunder 2y ago
Thanks for fighting the good fight for us all!
hn_user82179 2y ago
This older post was such a fantastic read, thanks for sharing your story!
- layoric 2y ago
  It's dated from ~2 weeks ago... is there other date information I am missing?
  - hn_user82179 2y ago
    ah no, I just said "older" since OP said it was older and I wanted to distinguish from the SQL post that this post is about
  - zettabomb 2y ago
    The HN post [0] is from February 9th, 2025, but the post the person you replied to was referencing [1] is from October 19th, 2018. [0] https://sockpuppet.org/blog/2025/02/09/fixing-illinois-foia/ https://sockpuppet.org/blog/2025/02/09/fixing-illinois-foia/ [1] https://mchap.io/that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html https://mchap.io/that-time-the-city-of-seattle-accidentally-...
notjulianjaynes 2y ago
Damn, this is impressive. I've been fighting with a state agency since December for 17,000 emails. I don't think I've ever tried to request emails and received zero push-back, but a $33 million estimate just, chef's kiss
maCDzP 2y ago
Have you tried looking for information from the developer about CANVAS? With any luck the developer has support documentation online that describes CANVAS and maybe you'll be able to narrow down your FOIA request.
- manquer 2y ago
  I think the point of the lawsuit is less about CANVAS schema itself and more about the ability of the government to hide this kind of information from FOIA requests.
foota 2y ago
> Normally, a flustered public records officer would just reject a giant request for being for “unduly burdensome”… but this sort of estimate is practically unheard of. So much so that other FOIA nerds have told me that this is the second biggest request they've ever seen. The passive aggression is thick. Needless to say, it's not something I'm willing to pay for! Welcome to Seattle :-)
- geoduck14 2y ago
  > that's the second biggest FOIA request I've ever seen! -Guybrush, from The Secret of Monkey Island
foota 2y ago
Out of curiosity, could you ask for something like "one row of data from every table in the CANVAS database"?
- mbreese 2y ago
  This is a technical solution to a people problem. My reading is that the city doesn’t want to give up this information. If that’s the case, a technical solution wouldn’t work, no matter how easy it is. And given that this has already gone to the Illinois Supreme Court (and lost), the only solution is what is discussed at the end: updating the law.
  - foota 2y ago
    I agree this is something of a technical solution, but the court wasn't interpreting whether you could ask for rows from a database, but whether you could ask for the schema directly. I don't think the court had the option of saying "you can't ask for the schema, but asking for a sample row is ok".
    - chaps 2y ago
      The short answer is yes, you can do this. I've seen this work for emails, where the request is basically, "Give me the most recent email of blah@gov.com". And yeah, the plan was to eventually submit a batch of requests using the table names, similar to `SELECT * FROM {table_name_from_schema_request} LIMIT 1`, but one FOIA request per-table.
      - cyanydeez 2y ago
        Seems like you could asked for a verbally masked description? Like an enigma coda specific to the FOIA. "Describe to me the columns, in simple non-programmatic english, and what the purpose of the table is for, for each table related to parking tickets" Essentially a human to schema DSL That is only technically decipherable by the admin of the database. Then you're not having actual code and only the admin could decipher. But yah, as you said, if the humans don't want to disclose their foibles, how the request is filled is technically meaningless.
dataflow 2y ago
I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how the "files" (records) are laid out on the "file system" (database tables). For example, denormalization is very analogous to inlining of data in a file record. The notion that filesystems are effectively databases itself is a well known one too. How do you argue they aren't analogous?
- ic4l 2y ago
  I agree with you. Knowing the exact column names can speed up an attack and, in some cases, make it more feasible. Why don’t they just request disclosure of what’s actually stored and allow renaming of the columns? It seems odd that knowing the exact column names would be necessary if the goal is simply to understand what data is being stored and its intended purpose.
  - lIl-IIIl 2y ago
    I wonder if that would be considered a "new report", which they don't have to provide.
    - philipov 2y ago
      They can either have their cake or eat it. If they don't want to obfuscate the column names, they have to provide the data with the original ones.
    - deleted 2y ago
      [deleted]
  - thaumasiotes 2y ago
    > Knowing the exact column names can speed up an attack and, in some cases, make it more feasible. If I'm looking at a database, I like knowing column names, but I like knowing table names more.
ra 2y ago
They can produce a report using english language labels instead of the db column names. Their argument isn't fact it's vexatious obstenance.
- hennell 2y ago
  As mentioned in the post FOIA tends to only include existing records/information, it doesn't extend to producing new work. So producing a new report would be considered too much work. (But fighting a lawsuit to not reveal the schema is fine )
gwerbret 2y ago
Very interesting case! Just one question: to what extent do changes in database schemata fall under FOIA in Illinois? That is, if they should change the database schema to conceal whatever it is they're fighting tooth and nail to hide, are they compelled to retain detailed information about that change? Or can they later present you (should the legislation pass) with a cleaned-up, nothing-to-see-here updated version?
qingcharles 2y ago
Matt, you do the Lord's work. Bear in mind that Matt technically lost this, even with the backing of some of the absolute best civil rights lawyers in the country, Loevy and Loevy, fighting on his behalf. This shows you the absurd difficulty in fighting city hall, especially if you're crazy enough to do it without representation. The one thing working in our favor is what is proposed in TFA: change the law. Once the state Supreme Court has ruled you're hosed unless you can get an amendment. Illinois has a very strong history of amending its FOIA statute, although a proportion of those changes are to further protect information from disclosure, not always on the side of sunshine. Another change that needs to happen is strong punishment for bodies who lose these fights. In Illinois this is limited to a "$5000 civil penalty" against the body. What is a civil penalty? It's vaguely defined. They used to throw the money to the plaintiff, but in the later cases I fought they simply awarded the money to the county. As one State's Attorney said to me "I don't care if I lose every case, I just write a check out to myself." (one final note: be careful what you wish for when you litigate, you can end up with an appellate decision like this that solidifying in law the exact thing you were fighting. It's nobody's fault, but it happens. I ended up with one absurd decision that removed prisoners' rights rather than enhanced them.)
- tptacek 2y ago
  A losing public body is also generally on the hook for attorney's fees, which can be considerable. But the general problem here is that the public bodies are all spending someone else's money, so the real deterrent you have is how much of their time you can credibly threaten to eat up with legal actions.
  - qingcharles 2y ago
    That's true, as long as you are represented. I knew one lawyer in Illinois who would sit in FOIA court and take all the non-represented persons aside and offer to take their cases and split the attorney fees 50/50. I believe it isn't strictly above-board, but it is a solution to a problem. People don't like being put under oath, so you can somewhat temper a public body's future refusals by deposing them or sticking as many of them on the stand. Especially with depositions, if you aren't represented then you can't be giving any attorney discipline for asking completely outrageous questions to force the deponent to admit crimes etc under oath.
monksy 2y ago
What I want to know: How much malort does the city expensive a year?
rnewme 2y ago
The footer links to dead x account.
waitwhatwhoa 2y ago
When can we submit witness slips? Is there a mailing list for updates we can join? Good luck!
mcnichol 2y ago
I don't want to take away any steam from your sails but giving bad information in regards to case law shouldn't be taken lightly. Your "expert witness" did you a disservice. Schema is very much a critical field in terms of AuthZ privileges. Just knowing the structure is not far off from knowing the max entropy a password may hold. In regards to InfoSec, table structure is the recon phase which limits effort and minimizes time. Someone with that much time in security knows DBs will be hacked, not if but when. Time is an incredibly important tool which is why we have expirations on so many authN and authZ windows of attack. I'm glad that you are challenging them but I believe a credible engineer would have made mince meat of your expert and hurt the rest of us who want to see you successful. It's possible rewriting certain statutes can help us but there is no company worth its salt that would share DB schema.
- thayne 2y ago
  > Just knowing the structure is not far off from knowing the max entropy a password may hold Not if the password is hashed, as it should be. Unless the schema somehow indicates that it uses a hash algorithm such as bcrypt that has a maximum password length. And even then, if they pre-hash the password, the password itself could have more entropy than that. And if there is a maximum password length, then you can probably figure that out via other means, like it being listed in the requirements when you set your password. It does tell you the size of the hash of the password, but if the maximum entropy is sufficiently high, as it should be, then it doesn't really matter; it would still be impractical to brute force. > there is no company worth its salt that would share DB schema So you are saying that every company with a self-hosted or open source product that uses a database isn't worth their salt? If your DB is running on a customer's infrastructure, that customer will by necessity have access to the schema. And likewise if the source code for a product is publicly available it is trivial to determine the schema.
  - mcnichol 2y ago
    I'm not arguing the complexity of hacking a password, I'm familiar. So instead of responding with rainbow tables or how knowing the schema informs you the location of salts for the salted hash (which is the actual proper way), I'll just point to an example. Look at how RSA is implemented. Look at the intentional obscurity of S tables and lack of detailed information. There is a reason information is withheld. DB schema is just that, information that increases increases the threat. And running a DB on someone's infrastructure doesn't necessarily give you access. You need to read up on AuthN and AuthZ. If you listed an open source example I'd take the time to poke holes in your strawman argument but you honestly just need to take a step back and think about what you are really arguing. Do you really think not having the schema is as inconsequential as having the schema when attacking something? I mean what is the first step most folks do in reverse engineering? I honestly can't believe I'm having to say this.

by chaps 2y ago

doctorpangloss 2y ago

What are the administrators of CANVAS hiding?

chaps 2y ago
Hard to say. One of my personal drivers for this lawsuit is a tip I received that said that Chicago has a list of vendors whose tickets are dropped in the back-end. When I requested that info, the city said they had no such list. I trust my source, so having schema information could help figure out the extent and if they were lying.
- noboostforyou 2y ago
  Considering how much they fought to not release the schema, there's probably a column named "exempt_from_penalty" or something equally obvious.
  - thaumasiotes 2y ago
    If they lose in court they have to pay court-determined attorneys' fees. That might be sufficient to get them to appeal automatically. This is a tension you sometimes see discussed in the context of wrongful imprisonment, where one faction says that if you get tossed in jail for 30 years over something there was never any evidence that you did, the state should have to pay a penalty, and another faction says that if you penalize the state for randomly imprisoning innocent people, those people will never be allowed out of jail.
- MBCook 2y ago
  Well that certainly sounds suspicious. But it could also provide more damming evidence of targeting groups, people skimming the till, bribes to make tickets go away, all sort of fun shenanigans. And boy they’re fighting suspiciously hard. Good luck.
  - Muromec 2y ago
    Bribes are most certainly not logged in the system under the "bribes" column or codified in any way. The data discovered through foi could show some patterns which are suggestive of bribes, but the actual thing is negotiated "off chain".
    - MBCook 2y ago
      That’s what I meant. For example, people who have a suspicious number of tickets dismissed. Or perhaps certain employees that dismiss a suspicious number.
- 9dev 2y ago
  Earnest question: If you suspect them of lying on the issue, why would you trust them to release the full schema in response to the FOIA request, and not just omit any possibly incriminating columns?
  - lmm 2y ago
    By that logic there's no point investigating any crime or doing any kind of audit. You increase the costs of covering up, and put them in a dilemma - remember this is exactly what brought down Nixon.
  - cyanydeez 2y ago
    Many times the people answering the requests aren't part of the conspiracy to commit random acts of malice. Sometimes they're roped into it under threat of termination. And often times, the denials eventually lead to significant reorg once judges and Congress can revise laws to fix the ambiguities.
  - jrockway 2y ago
    It's always a possibility that some low level official not in on the scam sees the FOIA request before management tells them not to work on it. The more you ask for, the less filtering there is going to be, simply because of how people work. If you're running the scam, you don't want to tell low level employees about it, because they have no incentive not to blow the whistle.
  - Muromec 2y ago
    Because this is not how government works. Most of the time it's not a heavily entranched conspiracy. Once the request is approved to go through by the legal department, some technician will happily give you everything you want and it won't be censored or tampered with in process.
  - tptacek 2y ago
    How is this different from literally any other FOIA transaction, computer-y or otherwise?
    - 2y ago
butlike 2y ago
'ethnicity' header, 'net_income' header... wouldn't doubt chicago could be cave man enough to do this

hathawsh 2y ago

Kudos to you for enduring through this fight! We can only achieve transparency when people choose not to be complacent. Thank you. What do you think are the next steps?

chaps 2y ago
My first step is to actually finish my post :) But after that, getting a reasonable law passed to fix this now-broken nonsense.

mmaunder 2y ago

Thanks for fighting the good fight for us all!

hn_user82179 2y ago

This older post was such a fantastic read, thanks for sharing your story!

layoric 2y ago
It's dated from ~2 weeks ago... is there other date information I am missing?
- hn_user82179 2y ago
  ah no, I just said "older" since OP said it was older and I wanted to distinguish from the SQL post that this post is about
- zettabomb 2y ago
  The HN post [0] is from February 9th, 2025, but the post the person you replied to was referencing [1] is from October 19th, 2018. [0] https://sockpuppet.org/blog/2025/02/09/fixing-illinois-foia/ https://sockpuppet.org/blog/2025/02/09/fixing-illinois-foia/ [1] https://mchap.io/that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html https://mchap.io/that-time-the-city-of-seattle-accidentally-...

notjulianjaynes 2y ago

Damn, this is impressive. I've been fighting with a state agency since December for 17,000 emails. I don't think I've ever tried to request emails and received zero push-back, but a $33 million estimate just, chef's kiss

maCDzP 2y ago

Have you tried looking for information from the developer about CANVAS? With any luck the developer has support documentation online that describes CANVAS and maybe you'll be able to narrow down your FOIA request.

manquer 2y ago
I think the point of the lawsuit is less about CANVAS schema itself and more about the ability of the government to hide this kind of information from FOIA requests.

foota 2y ago

> Normally, a flustered public records officer would just reject a giant request for being for “unduly burdensome”… but this sort of estimate is practically unheard of. So much so that other FOIA nerds have told me that this is the second biggest request they've ever seen. The passive aggression is thick. Needless to say, it's not something I'm willing to pay for! Welcome to Seattle :-)

geoduck14 2y ago
> that's the second biggest FOIA request I've ever seen! -Guybrush, from The Secret of Monkey Island

foota 2y ago

Out of curiosity, could you ask for something like "one row of data from every table in the CANVAS database"?

mbreese 2y ago
This is a technical solution to a people problem. My reading is that the city doesn’t want to give up this information. If that’s the case, a technical solution wouldn’t work, no matter how easy it is. And given that this has already gone to the Illinois Supreme Court (and lost), the only solution is what is discussed at the end: updating the law.
- foota 2y ago
  I agree this is something of a technical solution, but the court wasn't interpreting whether you could ask for rows from a database, but whether you could ask for the schema directly. I don't think the court had the option of saying "you can't ask for the schema, but asking for a sample row is ok".
  - chaps 2y ago
    The short answer is yes, you can do this. I've seen this work for emails, where the request is basically, "Give me the most recent email of blah@gov.com". And yeah, the plan was to eventually submit a batch of requests using the table names, similar to `SELECT * FROM {table_name_from_schema_request} LIMIT 1`, but one FOIA request per-table.
    - cyanydeez 2y ago
      Seems like you could asked for a verbally masked description? Like an enigma coda specific to the FOIA. "Describe to me the columns, in simple non-programmatic english, and what the purpose of the table is for, for each table related to parking tickets" Essentially a human to schema DSL That is only technically decipherable by the admin of the database. Then you're not having actual code and only the admin could decipher. But yah, as you said, if the humans don't want to disclose their foibles, how the request is filled is technically meaningless.

dataflow 2y ago

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how the "files" (records) are laid out on the "file system" (database tables). For example, denormalization is very analogous to inlining of data in a file record. The notion that filesystems are effectively databases itself is a well known one too. How do you argue they aren't analogous?

ic4l 2y ago
I agree with you. Knowing the exact column names can speed up an attack and, in some cases, make it more feasible. Why don’t they just request disclosure of what’s actually stored and allow renaming of the columns? It seems odd that knowing the exact column names would be necessary if the goal is simply to understand what data is being stored and its intended purpose.
- lIl-IIIl 2y ago
  I wonder if that would be considered a "new report", which they don't have to provide.
  - philipov 2y ago
    They can either have their cake or eat it. If they don't want to obfuscate the column names, they have to provide the data with the original ones.
  - deleted 2y ago
    [deleted]
- thaumasiotes 2y ago
  > Knowing the exact column names can speed up an attack and, in some cases, make it more feasible. If I'm looking at a database, I like knowing column names, but I like knowing table names more.

ra 2y ago

They can produce a report using english language labels instead of the db column names. Their argument isn't fact it's vexatious obstenance.

hennell 2y ago
As mentioned in the post FOIA tends to only include existing records/information, it doesn't extend to producing new work. So producing a new report would be considered too much work. (But fighting a lawsuit to not reveal the schema is fine )

gwerbret 2y ago

Very interesting case! Just one question: to what extent do changes in database schemata fall under FOIA in Illinois? That is, if they should change the database schema to conceal whatever it is they're fighting tooth and nail to hide, are they compelled to retain detailed information about that change? Or can they later present you (should the legislation pass) with a cleaned-up, nothing-to-see-here updated version?

qingcharles 2y ago

Matt, you do the Lord's work. Bear in mind that Matt technically lost this, even with the backing of some of the absolute best civil rights lawyers in the country, Loevy and Loevy, fighting on his behalf. This shows you the absurd difficulty in fighting city hall, especially if you're crazy enough to do it without representation. The one thing working in our favor is what is proposed in TFA: change the law. Once the state Supreme Court has ruled you're hosed unless you can get an amendment. Illinois has a very strong history of amending its FOIA statute, although a proportion of those changes are to further protect information from disclosure, not always on the side of sunshine. Another change that needs to happen is strong punishment for bodies who lose these fights. In Illinois this is limited to a "$5000 civil penalty" against the body. What is a civil penalty? It's vaguely defined. They used to throw the money to the plaintiff, but in the later cases I fought they simply awarded the money to the county. As one State's Attorney said to me "I don't care if I lose every case, I just write a check out to myself." (one final note: be careful what you wish for when you litigate, you can end up with an appellate decision like this that solidifying in law the exact thing you were fighting. It's nobody's fault, but it happens. I ended up with one absurd decision that removed prisoners' rights rather than enhanced them.)

tptacek 2y ago
A losing public body is also generally on the hook for attorney's fees, which can be considerable. But the general problem here is that the public bodies are all spending someone else's money, so the real deterrent you have is how much of their time you can credibly threaten to eat up with legal actions.
- qingcharles 2y ago
  That's true, as long as you are represented. I knew one lawyer in Illinois who would sit in FOIA court and take all the non-represented persons aside and offer to take their cases and split the attorney fees 50/50. I believe it isn't strictly above-board, but it is a solution to a problem. People don't like being put under oath, so you can somewhat temper a public body's future refusals by deposing them or sticking as many of them on the stand. Especially with depositions, if you aren't represented then you can't be giving any attorney discipline for asking completely outrageous questions to force the deponent to admit crimes etc under oath.

monksy 2y ago

What I want to know: How much malort does the city expensive a year?

rnewme 2y ago

The footer links to dead x account.

waitwhatwhoa 2y ago

When can we submit witness slips? Is there a mailing list for updates we can join? Good luck!

mcnichol 2y ago

I don't want to take away any steam from your sails but giving bad information in regards to case law shouldn't be taken lightly. Your "expert witness" did you a disservice. Schema is very much a critical field in terms of AuthZ privileges. Just knowing the structure is not far off from knowing the max entropy a password may hold. In regards to InfoSec, table structure is the recon phase which limits effort and minimizes time. Someone with that much time in security knows DBs will be hacked, not if but when. Time is an incredibly important tool which is why we have expirations on so many authN and authZ windows of attack. I'm glad that you are challenging them but I believe a credible engineer would have made mince meat of your expert and hurt the rest of us who want to see you successful. It's possible rewriting certain statutes can help us but there is no company worth its salt that would share DB schema.

thayne 2y ago
> Just knowing the structure is not far off from knowing the max entropy a password may hold Not if the password is hashed, as it should be. Unless the schema somehow indicates that it uses a hash algorithm such as bcrypt that has a maximum password length. And even then, if they pre-hash the password, the password itself could have more entropy than that. And if there is a maximum password length, then you can probably figure that out via other means, like it being listed in the requirements when you set your password. It does tell you the size of the hash of the password, but if the maximum entropy is sufficiently high, as it should be, then it doesn't really matter; it would still be impractical to brute force. > there is no company worth its salt that would share DB schema So you are saying that every company with a self-hosted or open source product that uses a database isn't worth their salt? If your DB is running on a customer's infrastructure, that customer will by necessity have access to the schema. And likewise if the source code for a product is publicly available it is trivial to determine the schema.
- mcnichol 2y ago
  I'm not arguing the complexity of hacking a password, I'm familiar. So instead of responding with rainbow tables or how knowing the schema informs you the location of salts for the salted hash (which is the actual proper way), I'll just point to an example. Look at how RSA is implemented. Look at the intentional obscurity of S tables and lack of detailed information. There is a reason information is withheld. DB schema is just that, information that increases increases the threat. And running a DB on someone's infrastructure doesn't necessarily give you access. You need to read up on AuthN and AuthZ. If you listed an open source example I'd take the time to poke holes in your strawman argument but you honestly just need to take a step back and think about what you are really arguing. Do you really think not having the schema is as inconsequential as having the schema when attacking something? I mean what is the first step most folks do in reverse engineering? I honestly can't believe I'm having to say this.