News for hackers. Stuff that matters.
Re:ParkMobile Breach Exposes License Plate Data, Mobile Numb... by KingMachiavelli on Wednesday April 21, 2021 @10:56PM (#26898234)
Honestly it's on the less severe side of data leaks considering what could have been leaked. No location history at least.

Really the only improvement (besides not getting hacked) would be not storing the license plate numbers/vales. They could be hashed just like passwords using bcrypt.

What's interesting is they say the salt values were not stored which is odd as typically password hashes use per input unique salts that have to be stored. Not sure if that means they used an additional salt or if they reused the same salt.

Re:ParkMobile Breach Exposes License Plate Data, Mobile Numb... by timthorn on Thursday April 22, 2021 @05:18AM (#26900559)
I don't think you could hash the registration plates. Users need to see the vehicles that are associated with their account, not least to select the car that the parking session is to be associated with. Although an app could maintain an internal database, the service also has a web interface and the UX that would result from only storing hashed VRNs would be pretty awful.
Re:ParkMobile Breach Exposes License Plate Data, Mobile Numb... by KingMachiavelli on Thursday April 22, 2021 @02:45PM (#26906485)
You could just name the vehicle with a nickname and also have the color, make, and model. I figure most people don't even know their license plate number from memory.

The app could let you "lookup" an existing entry from the license plate since it would then just be checking if the entered plate value matches one of the existing hash values.

I guess the part that would be weird is if your license plate # changed but you kept the same vehicle. e.g kid driver their 'parents' car but one year registers it under their own name.

Re:ParkMobile Breach Exposes License Plate Data, Mobile Numb... by dreadlordbone on Wednesday April 21, 2021 @11:13PM (#26898329)
My guess it they have a static salt for all passwords in code somewhere (newbie mistake I made years ago).
Re:ParkMobile Breach Exposes License Plate Data, Mobile Numb... by jpalomaki on Thursday April 22, 2021 @01:38AM (#26899123)
Static salt is called pepper [1]. It's not a bad idea - but it would be better used with the regular salt.

Some people don't seem to like the idea, but I think it adds an easy additional layer of protection. At least in the past many of the password leaks seemed to be due SQL injections and only leaking the database content. Pepper stored in the code would have protected the passwords.

https://en.wikipedia.org/wiki/Pepper_(cryptography)