News for hackers. Stuff that matters.
Re:Detailed Financial Histories Exposed for Thousands by zeta0134 on Saturday December 02, 2017 @03:39PM (#15833931)
Because unlike an SSN, you never hand out your private key. Ever. Instead, you encrypt things with your private key, and whomever you are validating your key to looks up the public key, decrypts your message, and has their proof.

The public keys can be stolen all day long and they're the only part of the equation that needs to be stored anywhere long term. The private keys are just that; truly private, and ideally extremely difficult to steal.

Yes, there will need to be a public service to manage the public keys, and yes this will be able to be compromised in some dangerous ways, but not quite so dangerous as "Whoops, everyone's SSNs are lost, now any attacker can impersonate them because that's all they needed."

Re:Detailed Financial Histories Exposed for Thousands by Spivak on Saturday December 02, 2017 @04:01PM (#15834063)
If you think they're going to be difficult to steal you're crazy. They will sit unsecured on personal computers in some folder on the Desktop waiting for any malware to scoop them up. They will overnight beclem the highest value target for hackers.

This is even before we talk about how to handle the huge number of people who will lose or delete them.

Tech can't solve this prpblem. Any system that requires a secret won't be.

Re:Detailed Financial Histories Exposed for Thousands by danieldk on Saturday December 02, 2017 @04:58PM (#15834365)
They will sit unsecured on personal computers in some folder on the Desktop waiting for any malware to scoop them up. They will overnight beclem the highest value target for hackers.

Most modern phones have secure elements that can generate and store a private key that cannot be extracted through software. Also, it is easy to set up things such that a physical confirmation is required to sign something (this is eg. what some U2F keys or touch ID do).

Of course, you still need a procedure to map public keys to identities and people need to secure their phones in order to prevent someone stealing the phone to make signatures.

But using the secure element of a phone for various forms of authentication is orders of magnitude safer than relying on a credit card or social security number.

Re:Detailed Financial Histories Exposed for Thousands by mtgx on Saturday December 02, 2017 @04:28PM (#15834186)
You give everyone smart cards/tokens with bruteforce-limited PINs on them. That's where the private key will reside.

The "only" other problem that will remain is that you will need a secure supply-chain, otherwise this will happen:

http://www.zdnet.com/article/id-card-security-spain-is-facin...

https://www.reuters.com/article/us-gemalto-cybercrime/hack-g...

If you do something like this you actually need to be serious about it and establish a rigorous vetting/auditing process -- not just hand the contract to whoever donated the most to your election campaign.

Maybe set-up a 3-year long NIST competition or something, like they do when choosing new crypto standards, and establish the winner this way.

The other side of the equation, allowing services to interface with these cards securely, is already being solved by the FIDO 2.0 spec.

Re:Detailed Financial Histories Exposed for Thousands by madeofpalk on Saturday December 02, 2017 @04:53PM (#15834330)
...how do you get the private key off the card and into my future banks website when I apply for a credit card?
Re:Detailed Financial Histories Exposed for Thousands by vel0city on Saturday December 02, 2017 @05:31PM (#15834561)
With smart cards (EMV, PIV, etc.), cryptographic functions executed on secret materials are usually handled on the card. The host sends the data to be encrypted or signed to the card, requests the card to process it, and then reads the encrypted results or signature. Often, there are no ways to get the chip to send the private key off of the device. Once the private key is generated or loaded onto the device, it can only be erased or written over.

Standards like FIDO and others allow for browsers and websites to utilize these cryptographic functions of smart cards in ways to handle website authentication. The technology exists for smartcards to handle authentication, it is simply a matter of us moving to this technology.

Re:Detailed Financial Histories Exposed for Thousands by madeofpalk on Saturday December 02, 2017 @05:36PM (#15834590)
So I need a smart card reader?
Re:Detailed Financial Histories Exposed for Thousands by vel0city on Sunday December 03, 2017 @05:22PM (#15839997)
That depends on the chosen smart card technology. Some smart cards are USB devices in themselves, such as YubiKeys or associated FIDO-certified devices. Otherwise, you may want or need a smart card reader to read cards in a similar format to what you see on chip-based credit cards.

USB smart card readers are fairly cheap. Many business-focused laptops have been available with smart card reader options for many years.

Re:Detailed Financial Histories Exposed for Thousands by astura on Saturday December 02, 2017 @06:29PM (#15834933)
Yes, they are cheap though (~$10) and they sell keyboards with built in smart card readers.
Re:Detailed Financial Histories Exposed for Thousands by icebraining on Saturday December 02, 2017 @06:26PM (#15834908)
Yes.
Re:Detailed Financial Histories Exposed for Thousands by filoleg on Saturday December 02, 2017 @05:07PM (#15834423)
The same way you can currently do it with smartcards. When you insert your smartcard into the reader, it is being treated as a certificate. Most major browsers support this, I can vouch for Chrome and Firefox personally, as I use a smartcard for auth in them on a fairly regular basis.
Re:Detailed Financial Histories Exposed for Thousands by jimktrains2 on Saturday December 02, 2017 @06:53PM (#15835068)
Do you have any information on how you've set that up and which cards and readers you use? I've been thinking about playing around with a similar concept.
Re:Detailed Financial Histories Exposed for Thousands by bogomipz on Saturday December 02, 2017 @06:54PM (#15835073)
So then who manages the HSM infra? I feel like there few good choices but maybe someone like Neustar would be a good fit?
Re:Detailed Financial Histories Exposed for Thousands by astura on Saturday December 02, 2017 @04:52PM (#15834319)
Um... They would be in the form of smart card+pin, not a file on desktop.
Re:Detailed Financial Histories Exposed for Thousands by mycall on Saturday December 02, 2017 @06:23PM (#15834886)
They would be on physical keystores, like a TREZOR bitcoin wallet.
Re:Detailed Financial Histories Exposed for Thousands by lostlogin on Saturday December 02, 2017 @03:48PM (#15833997)
This would be ideal, but imagine trying to implement it. 4 digit banking PIN numbers are already regularly forgotten, even when chosen by the user.