News for hackers. Stuff that matters.

A comment on Unprotected database exposes sensitive data of over 20M Ecuadoreans.

Re:Unprotected database exposes sensitive data of over 20M E... by phasnox on Monday September 16, 2019 @11:14AM (#20984882)
If you think this is bad, there is a horrible security hole in the site of the National Transit Agency.

They have the most imbecile password recovery mechanism: With only the national id of the victim(cedula) you can recover their password!

I'm not talking about RESETING the password, I mean they sent you the literal password that was set during account creation to ANY email you input.

This is the state and reflection of the incompetence, rot and corruption of our current and past Government.

[ Parent | on HN ]
Re:Unprotected database exposes sensitive data of over 20M E... by octosphere on Monday September 16, 2019 @12:56PM (#20986056)
You should report them to Plain Text Offenders[0]. They're doing God's work.

[0] https://plaintextoffenders.com/

[0] https://plaintextoffenders.com/submit

[ Parent | on HN ]
Re:Unprotected database exposes sensitive data of over 20M E... by warp on Monday September 16, 2019 @03:17PM (#20987576)
The SRI (tax office?) publishes convenient CSVs with info on each tax payer, which includes RUC, full name and address.

For self-employed people I believe the RUC is the Cedula with "001" appended. So it is easy to look up the Cedula of many people (I moved to Ecuador in 2014, my info is in that file).

https://www.sri.gob.ec/web/guest/catastros

[ Parent | on HN ]
Re:Unprotected database exposes sensitive data of over 20M E... by phasnox on Monday September 16, 2019 @04:27PM (#20988232)
Oh god, I just grepped and found myself in there.
[ Parent | on HN ]
Re:Unprotected database exposes sensitive data of over 20M E... by orvtech on Monday September 16, 2019 @11:59AM (#20985412)
lovely, I wonder how much the company that did this for them charged
[ Parent | on HN ]
Re:Unprotected database exposes sensitive data of over 20M E... by analreceiver on Monday September 16, 2019 @12:18PM (#20985619)
No they don't, I just checked.
[ Parent | on HN ]
Re:Unprotected database exposes sensitive data of over 20M E... by phasnox on Monday September 16, 2019 @12:56PM (#20986054)
Give me you cedula and I will give you YOUR password.
[ Parent | on HN ]