News for hackers. Stuff that matters.

A comment on Claimed AT&T hack of 70M customer records including SSN, name, address. Parent comment

Re:Claimed AT&T hack of 70M customer records including SSN, ... by zug_zug on Friday August 20, 2021 @02:15PM (#28249478)
Proposed alternative - you get your own private-key as an identifier. Nobody ever can ask for the private key, they can only ask for a signed message that proves identity. Thus a lot of categories of fraud are no longer possible because there is no shared reusable number in the event of a leak.
[ Parent | on HN ]
Re:Claimed AT&T hack of 70M customer records including SSN, ... by discardable_dan on Friday August 20, 2021 @02:27PM (#28249636)
In Denmark, you are issued a one-time pad. You get a new one with some frequency. If you lose it, you are issued a new one.

In that case, third parties could use a government website to get a row/col and ask you to verify, and the website could say yes/no. Yes, there is a risk of your one-time pad being stolen, but it is no greater than the current risk that any US citizen's tax documents or SS card can be stolen.

[ Parent | on HN ]
Re:Claimed AT&T hack of 70M customer records including SSN, ... by xxpor on Friday August 20, 2021 @03:58PM (#28250692)
How do they bootstrap the verification when you say you lost your key?
[ Parent | on HN ]
Re:Claimed AT&T hack of 70M customer records including SSN, ... by discardable_dan on Friday August 20, 2021 @05:01PM (#28251370)
You can read more here: https://www.wikiprocedure.com/index.php/Denmark_-_Replace_Lo...
[ Parent | on HN ]
Re:Claimed AT&T hack of 70M customer records including SSN, ... by mjevans on Friday August 20, 2021 @05:14PM (#28251480)
That's an annoying denial of service attack; and you would typically do this by making the burn require very little authentication and the recovery a visit to a local government office, such as the police or a court.
[ Parent | on HN ]
Re:Claimed AT&T hack of 70M customer records including SSN, ... by sillysaurusx on Friday August 20, 2021 @02:24PM (#28249591)
What do you do when you lose your private key?

Who issues the private key? "get" implies it comes from somewhere, i.e. a CA system.

If the government is the CA system, and your private key is your identity, how do you establish your identity in the event that you lost your key?

The nice thing about SSNs being immutable is that none of these are concerns. (It's also the bad thing about SSNs being immutable.)

[ Parent | on HN ]
Re:Claimed AT&T hack of 70M customer records including SSN, ... by azinman2 on Friday August 20, 2021 @02:34PM (#28249710)
That and I can memorize my SSN.

We do have one thing in the US that’s physical proof, and that’s your birth certificate. But I’m sure people lose them and they can be pretty easily fabricated.

[ Parent | on HN ]