News for hackers. Stuff that matters.
Re:I'm Testifying to Congress about Data Breaches – What Sho... by specialist on Tuesday November 21, 2017 @07:20PM (#15753042)
"I do not think the government should mandate specific practices; it's too complicated, too fast-changing, and too hard to police."

I disagree.

Breeches are inevitable. "when", not "if". Today, for interop, all demographic data must be stored as plaintext, because we don't have national identifiers.

The only fix is to issue globally unique identifiers. Then we can encrypt demographic data at rest. Greatly mitigating the damage of breeches.

That's why we need a federal level solution.

Re:I'm Testifying to Congress about Data Breaches – What Sho... by icebraining on Wednesday November 22, 2017 @02:10AM (#15754932)
The only fix is to issue globally unique identifiers. Then we can encrypt demographic data at rest. Greatly mitigating the damage of breeches.

How does that follow? I work in a country with such identifiers, and I don't see the connection.

By the way, just because such identifiers exist, doesn't mean people are keen on giving them out to every company, and in fact, asking and storing it is frowned upon by our national data protection commission, unless you have a good reason to do so (just like any other personal data).

Re:I'm Testifying to Congress about Data Breaches – What Sho... by specialist on Wednesday November 22, 2017 @05:45PM (#15761344)
Just like passwords, you don't store the identifiers as-is, which is a rule that is easy to explain, enforce.

Translucent Databases: Confusion, Misdirection, Randomness, Sharing, Authentication And Steganography To Defend Privacy

http://a.co/hTfRPP9

http://www.wayner.org/node/39

Re:I'm Testifying to Congress about Data Breaches – What Sho... by otakucode on Wednesday November 22, 2017 @11:16AM (#15757935)
There is no need for a single centralized identifier. Each need for an identifier has its own requirements, things like ensuring a person has been served only once, ensuring every person has been served at least once, ensuring every participant meets some criteria, etc. There is no need for, for example, the social security administration to be able to cross-reference with the drivers license registry. It makes no sense, and would be pretty dangerous, to create a single identifier that invites cross-relation of a persons entire existence into an easily-profileable bundle.
Re:I'm Testifying to Congress about Data Breaches – What Sho... by specialist on Wednesday November 22, 2017 @01:53PM (#15759382)
You perfectly articulated the opposition to Real ID. I usedto share your views.

Then I created regional health exchanges and worked in election integrity policy (voter registration databases).

Without guids, there is no way to both link demographic records across systems AND encrypt those records at rest.

I’d be okay with a handful of id (guid) issuing authorities per use case. Voting, health care, pension, etc.

I very much wanted infratructure for faceted identities (personas) which could not be correlated. But now I don’t think such a thing is possible. I believe, but cannot prove, that Big Data will always win the privacy vs deanonymization arm’s race.

PS- Corps like Facebook, Lexis/Nexus, NSA, etc have already uniquely identified everyone living and dead. My proposal daylights that fact, restoring power to the people, and insisting that our data is encrypted at rest.