News for hackers. Stuff that matters.

A comment on Hackers who broke into Equifax exploited a flaw in open-source server software. Parent comment

Re:Hackers who broke into Equifax exploited a flaw in open-s... by bluejekyll on Saturday September 09, 2017 @06:04AM (#15206346)
Forget about the zero-day for a minute.

They should be liable for poor storage practices around sensitive PII. Take for example SSN. With SHA2, there is no good reason for them to be stored in plaintext.

If you don't need it, don't store it. For SSN, you just need a function (SHA256+Salt) that would give you a one way mechanism of Creating an identifier that masks the original in an irreversible way.

The prevalence and misuse of SSN as an identifier for people is so out of date at this point and weak. We need something different.

[ Parent | on HN ]
Re:Hackers who broke into Equifax exploited a flaw in open-s... by bodz on Saturday September 09, 2017 @02:35PM (#15208481)
There's no evidence so far (that I've seen) that points to Equifax storing SSNs in plaintext. The initial reports so far indicate that the exploit scraped the SSNs while it was in use by other systems, and not at rest in a database. Encryption (whether they do it or not) wouldn't have saved the day here.

> The prevalence and misuse of SSN as an identifier for people is so out of date at this point and weak. We need something different.

I completely agree.

[ Parent | on HN ]
Re:Hackers who broke into Equifax exploited a flaw in open-s... by bga on Saturday September 09, 2017 @10:19AM (#15207196)
If you're just hashing with SHA2 and a salt, an attacker with a run-of-the-mill GPU could crack any given hashing quite quickly. It might still take quite a bit of time to get all 143 million, but that's fine. Sell off the score in blocks of 10,000 and let the customer know they have to reverse the hashes themselves.

BCrypt with lots of rounds would be best.

[ Parent | on HN ]
Re:Hackers who broke into Equifax exploited a flaw in open-s... by bluejekyll on Saturday September 09, 2017 @11:24AM (#15207505)
Yes. You're correct of course. We should be treating these like passwords, except that they can't be rotated...
[ Parent | on HN ]
Re:Hackers who broke into Equifax exploited a flaw in open-s... by maxerickson on Saturday September 09, 2017 @11:27AM (#15207521)
It is an identifier. It isn't really a problem to use it that way.

The problems all come from using it for authentication.

[ Parent | on HN ]
Re:Hackers who broke into Equifax exploited a flaw in open-s... by bluejekyll on Saturday September 09, 2017 @12:20PM (#15207736)
I should have made that more clear in my statement. The thing that makes me paranoid is it's use as an authentication method by my bank, et al.

With this disclosure, much of what banks and others use to authenticate my identity is now out in the open.

[ Parent | on HN ]