News for hackers. Stuff that matters.
Re:Hacker steals government ID database for Argentina's enti... by bobsmooth on Tuesday October 19, 2021 @06:55AM (#28916772)
"According to a sample provided by the hacker online, the information they have access to right now includes full names, home addresses, birth dates, gender info, ID card issuance and expiration dates, labor identification codes, Trámite numbers, citizen numbers, and government photo IDs."

And entire country just got doxxed. That's insane.

Re:Hacker steals government ID database for Argentina's enti... by richlandlord on Tuesday October 19, 2021 @01:32PM (#28920912)
To be fair this information is already public in argentina. There is no secrecy to almost any of this, as ID numbers are public, sequential and queryable for tax status, debt status, etc.
Re:Hacker steals government ID database for Argentina's enti... by maze-le on Tuesday October 19, 2021 @07:21AM (#28916911)
All this information in one database... Thats the real insanity here. Why would anyone think that this is a good idea? Leave aside security and safeguards for a moment, just compiling this database is neglectful at the very least...
Re:Hacker steals government ID database for Argentina's enti... by vadfa on Tuesday October 19, 2021 @07:54AM (#28917110)
Isn't it like this in practically every European country? We have ID cards with every one of those fields printed on them, including thumbprints. All of that information is probably in one big table somewhere.
Re:Hacker steals government ID database for Argentina's enti... by roenxi on Tuesday October 19, 2021 @08:45AM (#28917473)
Everyone does it is not actually a persuasive argument that something is a good idea. It was an uphill struggle back in the day to get everyone washing their hands.

This is a predictable outcome of a government creating then storing long term secrets in a database. Governments are not good at keeping secrets. The data will leak.

Re:Hacker steals government ID database for Argentina's enti... by vadfa on Tuesday October 19, 2021 @12:01PM (#28919631)
I don't remember justifying it. Your comment seems a cheap karma grab.
Re:Hacker steals government ID database for Argentina's enti... by Aeolun on Tuesday October 19, 2021 @08:11AM (#28917227)
To be fair, The security around the digital system in the Netherlands, is almost painful.

Japan is really good in this, they store everything on paper and fax it around.

They’re also starting with a national ID now though.

Re:Hacker steals government ID database for Argentina's enti... by inter_netuser on Tuesday October 19, 2021 @08:08AM (#28917206)
Germany supposedly does not have a central registry, I've been informed.
Re:Hacker steals government ID database for Argentina's enti... by Semaphor on Tuesday October 19, 2021 @08:22AM (#28917300)
Source? Even the Addresses (Melderegister) are centralized.

edit: Looking it up [0] it looks like there is far more data there, all in a central database since at least 2015 (not sure how it worked before).

[0]: https://de.wikipedia.org/wiki/Melderegister#Deutschland

Re:Hacker steals government ID database for Argentina's enti... by inter_netuser on Tuesday October 19, 2021 @08:27AM (#28917344)
It's been a little while, so perhaps things have changed, but I was told that quite a bit of the data exists only on the card itself.

From your link it seems i was not entirely misinformed: "Contrary to popular belief, there is no central administration of resident registration in Germany. The exception is the registration of resident aliens (see Central Register of Foreign Nationals). Registration is organized by 5283 local offices throughout Germany.[18] "

I'm unable to find the part about cards. will edit or reply more if i do find it.

Re:Hacker steals government ID database for Argentina's enti... by Semaphor on Wednesday October 20, 2021 @03:04AM (#28927647)
Looking into it again, it appears the residential registration is indeed decentralized, but most of that data seems to still be saved in a central database thanks to Abgabenordnung § 139b [0].

There is something about sharing that information, but I can’t say I understand the legalese ;)

[0]: https://www.gesetze-im-internet.de/ao_1977/__139b.html

Re:Hacker steals government ID database for Argentina's enti... by germanier on Tuesday October 19, 2021 @12:14PM (#28919828)
There is no central database, even after the changes of 2015. It is still hosted by each individual municipality (which is exactly what your link states).

However, there here is a standard API which allows some entities to query all those decentralized registers. It is designed to make it hard to siphon out all data at once (which hopefully trips audit systems in enough places that someone cares to look into).

The only centralized database of that kind is the one at BZSt, which contains far less data. For the moment access is limited to tax-related issues but it will be soon expanded to a centralized base data registry (Registermodernisierung).

Re:Hacker steals government ID database for Argentina's enti... by inter_netuser on Wednesday October 20, 2021 @10:19PM (#28939510)
What's in the BZSt?
Re:Hacker steals government ID database for Argentina's enti... by MonkeyClub on Tuesday October 19, 2021 @08:13AM (#28917238)
Because of (political) federation I assume, right?

However are the regional governments supposed to develop their own solutions, or are they using a centrally developed database, just with local unconnected instances?

Re:Hacker steals government ID database for Argentina's enti... by inter_netuser on Tuesday October 19, 2021 @08:31AM (#28917367)
"Contrary to popular belief, there is no central administration of resident registration in Germany. The exception is the registration of resident aliens (see Central Register of Foreign Nationals). Registration is organized by 5283 local offices throughout Germany.[18] "

https://en.wikipedia.org/wiki/Resident_registration#Germany

I was also told something on identity cards only lives on the cards, but cannot find the source or details on that.

Re:Hacker steals government ID database for Argentina's enti... by germanier on Tuesday October 19, 2021 @12:18PM (#28919874)
Each municipality is free to choose their own solution to the legal requirements (which includes a standardized API). For the moment, there are eight different software solutions on the market (developed by both public and private entities), see https://www1.osci.de/meldewesen/xmeld/registrierte-herstelle...
Re:Hacker steals government ID database for Argentina's enti... by DoingIsLearning on Tuesday October 19, 2021 @08:07AM (#28917200)
Most EU cards also integrate fiscal id numbers and national healthcare id numbers in the chip but arguably do exclude registered address, so only a city/province of residence is available.
Re:Hacker steals government ID database for Argentina's enti... by vadfa on Tuesday October 19, 2021 @08:08AM (#28917205)
Not sure about the rest but Spanish ID card includes full address.
Re:Hacker steals government ID database for Argentina's enti... by N19PEDL2 on Tuesday October 19, 2021 @09:26AM (#28917819)
Italian ID cards too, as well as the owner's signature, the fiscal code (an unique identification code similar to the SSN in the USA) and the fingerprints (though these latter are stored in the chip only, not printed on the card).

It's very likely that this data is also stored in some government database, which I hope will never get breached.

Re:Hacker steals government ID database for Argentina's enti... by CaciaraAsAServi on Tuesday October 19, 2021 @01:50PM (#28921144)
Nitpick (as you well know) - codice fiscale in Italy differs from USA SSN in that, for once, it has never had AFAIK any semblance of secrecy at all, as you can easily construct it starting from name, surname, place and date of birth [1] Funnily enough, this sometimes results in two individuals computing to the same code [2]

[1] https://en.wikipedia.org/wiki/Italian_fiscal_code

[2] https://it.wikipedia.org/wiki/Omocodia

Re:Hacker steals government ID database for Argentina's enti... by soco on Tuesday October 19, 2021 @08:18AM (#28917270)
Swiss cards not but well Switzerland is not EU...
Re:Hacker steals government ID database for Argentina's enti... by dgellow on Tuesday October 19, 2021 @11:34AM (#28919274)
It’s part of Schengen though. But I confirm, no adresse on our ID cards.
Re:Hacker steals government ID database for Argentina's enti... by ogogmad on Tuesday October 19, 2021 @12:04PM (#28919685)
Not in the UK (which is in Europe but no longer in the EU). Was planned before 2010 and then got scrapped by the subsequent government. What's in the works now?
Re:Hacker steals government ID database for Argentina's enti... by maze-le on Wednesday October 20, 2021 @02:48AM (#28927553)
I think so, but it doesn't mean that it is a good idea... Every bit that creates an official identity should be handled with great care.
Re:Hacker steals government ID database for Argentina's enti... by Spooky23 on Tuesday October 19, 2021 @08:04AM (#28917180)
The horse left the barn before you were born.

All of this information is in multiple single databases maintained by insurance companies in the US. And that data is in turn linked to all sorts of behavioral and affinity data. GEICO knows more about you than DMV.

Re:Hacker steals government ID database for Argentina's enti... by heavenlyblue on Tuesday October 19, 2021 @07:39AM (#28917019)
I don't understand how you can seriously think that having two databases instead of one would make it any easier. OK, if we had two databases the overlap would be, let's say, 50% and there would be another 20% in the database A that doesn't exist in database B. Still 70% of information stolen.

That on top of the fact that having two separate databases means twice the probability of different bugs in two different systems.

We must all move away from using PI as passwords, that's all we need to do. Then this problem will go away.

Re:Hacker steals government ID database for Argentina's enti... by dewey on Tuesday October 19, 2021 @07:46AM (#28917064)
> We must all move away from using PI as passwords, that's all we need to do. Then this problem will go away.

You make it sound like it's an easily solved problem, which it apparently isn't.

Re:Hacker steals government ID database for Argentina's enti... by adolph on Tuesday October 19, 2021 @12:59PM (#28920431)
I just use password reset every time I have to log in and do enough login fails afterward to lockout my account.
Re:Hacker steals government ID database for Argentina's enti... by sofixa on Tuesday October 19, 2021 @08:14AM (#28917242)
What? How do you imagine that could work? Only paper records, and any interaction with any public administration thing takes a few months? It's generally a good idea to have the tax office, the healthcare ministry/insurance people, police, etc. know who the people of the country are and how to identify them. It's the norm in the EU, and works fine as long as security is taken seriously (which obviously wasn't in Argentina).
Re:Hacker steals government ID database for Argentina's enti... by gomox on Tuesday October 19, 2021 @07:44AM (#28917057)
This is a country where when they installed license plate scanners on highways they accompanied them with large screens that show the plate that was just scanned.

So as to... I don't know, brag that you're collecting all this information, that is to be inevitably leaked in a while? To make people feel safe, while clearly indicating the highway exits to avoid if you actually steal a car?

Re:Hacker steals government ID database for Argentina's enti... by stef25 on Tuesday October 19, 2021 @09:13AM (#28917692)
> This is a country where when they installed license plate scanners on highways they accompanied them with large screens that show the plate that was just scanned.

This is done in France when it catches you driving too fast. "ABC 123" you're going too fast! It's a bit jarring your plate up on a screen so it works kind of well against speeding. They don't need to store your plate to use this feature.

Of course plates are being scanned (and probably stored) all over the place now (toll booths, big roads in & out of the cities), not denying that.

Re:Hacker steals government ID database for Argentina's enti... by gomox on Tuesday October 19, 2021 @11:11AM (#28918943)
In our case its not shaming you for speeding or anything specific, it just displays every plate that it scans to advertise the scanner.

Also in a not very surprising turn of events, a lot of the screens just show a fixed plate these days which makes you wonder which component broke (is it the screen, or the scanner?)

Re:Hacker steals government ID database for Argentina's enti... by Pxtl on Tuesday October 19, 2021 @09:25AM (#28917808)
Yes, I think it's a good idea for government to have that info. Government needs to provide services and manage resources, which means knowing who and where people live, and have a proper ID number to manage that data.

The alternative is for government to have 90% subsets of the same data in a a thousand different databases, one per-department, per-jurisdiction.

Re:Hacker steals government ID database for Argentina's enti... by Arrath on Tuesday October 19, 2021 @10:27AM (#28918450)
And then Dept A thinks you live here, Dept B thinks you live there, Dept C thinks you have a warrant out for your arrest, and little municipal dept Y.43 thinks you're dead.

Yeah, I can see a few problems with that.

Re:Hacker steals government ID database for Argentina's enti... by marcosdumay on Tuesday October 19, 2021 @10:23AM (#28918397)
That's a basic citizen database.

The only non-obvious information is the labor identification code. Except for that, it's just "who exists and how do we call them?"