> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens
Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry and that it won’t happen again".
Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc.
Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laundering. It doesn't actually do that. Search for "largest money laundering settlements" and you will find 5 banks and one crypto scam.
> Or maybe the government should not require companies to KYC you for every little stupid thing
Actually....
Say what you like about the French today, but one good thing they have is an electronic service[1] where you can generate single-use KYC ID:
- That only discloses minimum information required
- For a specific recipient organisation
- For a specific duration
- For a specific use-case by that organisation
More countries should provide this sort of KYC tool.
It looked great and I wanted to try it, but it doesn't work on the web and my smartphone is rejected with no clear explanation ("missing some security mechanisms"); probably because I'm running LineageOS with MicroG.
I'm not exactly sure of the details, but isn't this similar to DigiD in NL? There too you can "prove your Identity and log in" via the govt app. The server side of the 3rd party has to handle the rest (eg user account information etc.), nothing is shared beyond "this is the guy who's signing in, verified by the govt".
Wish entities who handle Aadhar in India be required to accept the one-time Virtual Aadhar. Its a quick online and SMS-only process. Seems everybody forces you to hand over your permanent Aadhar, including the ID verification partner for Paypal.
I'm tired of having to connect on EDF' shitty website to get a new PDF every three months.
I just set it up!
A bit bumpy because login on Ameli/Impôts wasn't working on Orion so I had to go on Safari, but otherwise its done.
I even have colored pictures on the virtual CNI/Permis!
Thanks!
EDIT: Why do the put three stats about trains on your linked page?!
The overreach on access and then storage will be a meaningful issue we will have to reckon with more and more. Companies are acquired, companies die. What happens to your data in 5, 15, 50 years? It doesn’t just disappear.
So that if you ever step out of line with regards to what the government deems "worthy" behavior (whatever the hell that means at any given moment) you can be de-banked and effectively excluded from participating in society
I’m not versed in the French system specifics, but know a bit about the Belgian itsme. It’s up to the companies to specify which scopes and data bits they want. The better government agencies only ask for your ID number and proof that you’re you. Corporate users tend to ask for absolutely everything in your profile.
KYC: Know your customer or know your client (KYC) laws, regulations and guidelines in financial services require regulated businesses and professionals to verify the identity, suitability, and risks involved with maintaining a business relationship with a customer.
Yeah, it should be made illegal to hold like, more than x columns of PII per entity or bank branch or something. It's just not smart to allow big database of everyone to be made and to expect you stay the one to abuse than to be nails that gets beaten using it.
Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive.
The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose a legally-enforced deadline to fix any issues, with a fine (for private actors) or demotion of the guy in charge of infosec (for state agencies).
Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.
France seems to have had a ton of government hacks in the past year at various levels, so it's sorely needed.
I agree with the premise that SSII audits are useless, but your solution sounds like bandaid on a cancer. The real solution solution is stop this surveillance machine madness!
I understand that identity is required for property deeds and bank accounts for tax reasons and that should 100% not be online. But for the rest, it should be entirely outlawed to collect personal information beyond what's necessary for the service, including for government agencies.
Make healthcare (really) free => no social security database to hack. Give me back humans in offices for taxes and drivers licences => no ANTS database to hack. etc.
Er? social security covers more than just healthcare and the issue with on-line data in context of healthcare is patients' history, which i) is sensitive and ii) needs to be shared among health care providers.
Tough luck, i've never used any machine learning in my life (that i know of). AI tools are part of the same problem, the same techno-fascism i was decrying in my comment. I'm just curious how you could even think i was using AI????
You don't seem to realize the difference between those 2.
> The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose ...
And now you've got private people empowered to attack specific government officials. In fact, that's their job. Btw: you forgot to specify "in public", and that needs to be how it works, otherwise it will just result in officials attacking this security agency. Oh, AND you're giving government officials an obvious point of attack: "salaries matching the private sector".
> Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.
You mean forget the way even the dumbest of the dumb can "provide security"? Do you think government officials in France got their position based on their IQ?
Of course this is the only way it can work, but this needs a very un-French form of government to get it to work.
> this needs a very un-French form of government to get it to work
I'm usually not one to defend french culture, but i believe your interpretation is wrong. What went wrong in this case is the americanization of the french administration: make everything complex, remove all local government branches and workers who can help you, remove every sensical administrator from their position, ignore all the privacy laws that were passed after Vichy and the nazi/IBM databases, "just make all the NUMÉRISATION".
The french government didn't have a proper national ID system until the nazi administration (Vichy) who invented the CNI and the Ausweis. There was strong sentiment against this well into the 70s and the Loi Informatique et Libertés, and it's only the more recent startup generation that started undoing all our ancestors hard fought battles against data collections/centralization.
Someone(s), somewhere, is paid "big bucks" to be in charge.
That's the person we should charge. If they cannot be charged for this kind of fuck-ups, then they should not be paid anything for simply rubber-stamping anything going over their desk. A simple machine could do their job.
If it’s related to compliance? Yeah I think that’s a pretty dangerous culture to have. Compliance requirements need owners who will ensure standards are met. If they don’t do their jobs, then they should face the consequences for the harm they allow.
Hey now, don’t forget the offer of “free credit monitoring for a year” - I feel like at this point I’ve gotten so many of those that if I signed up for them all, I’d have my personal info in twice as many probably-hackable locations as I do already.
Seeing another one of these breaches had me returning to look at local-first software. https://lofi.so
I feel like if we're going to make progress in preventing wholesale data breaches it will be through architectural innovations that attack the problem of why a trove of concentrated data needs to exist. Even if the government needs to be a central authority, are there ways to house the data that limit the blast radius?
I'm sure there are innumerable arguments why this can't help, but when the mainstream alternative is despair and helplessness, progress will be made in the margins.
My full name, phone number, and address were leaked by TAP Air Portugal about five years ago, along with the details of my parents who were on the same booking. Since then, my dad has been targeted by those types of scams where a fraudster impersonates me to ask for money.
I never received a notification from TAP; I only found out a year later through my Google One security feature. I certainly didn't get an apology—much less a free travel ticket!
If the scam success rate is 0.1%, and it takes days to comb a phone book and put together a list of potential relationships and takes a human 10 minutes per phone call, the economics of scamming works out a lot less profitable than importing a data leak and emailing or robocalling everyone in the list.
I do use an email alias everywhere. But I don't believe you can do the same with phone numbers. I tried using my twilio rented number and there is a way systems use to figure out if that is a real number for a person or a VoIP one. Though it is sometimes successful in use for signups and hence spam reduction.
Could set up 6 digit long extensions and only ever issue a few hundred of them in total.
Guess wrong 3x and goodbye.
Can also set some/most/all to go to voicemail so they can get in touch with you, but not really.
Or blackhole the invalid extensions to /dev/null voicemail but then you run the risk of legit misdials and you never get some important message.
The real vs “fake” number issue could be worked around by having your cell phone provider forward all calls to your VoIP number. It’s baked into gsm, don’t need a phone after initial setup: https://www.geckobeach.com/cellular/secrets/gsmcodes.php
That TAP data was leaked on a tor hidden service, in multiple files, and download was extremely slow on the days following the leak. One of the files was much smaller, and my friend had the bad luck to have his data in that one.
His phone was spammed so incessantly he had to change his number almost immediately.
I'm dissatisfied about the TAP leak as well! I was affected, and like you, didn't even receive a notification - nevermind compensation for having leaked my personal data to the dark web enabling all sorts of shenanigans that make my personal life difficult.
About 2 million portuguese there. Basically all active portuguese adults that have enough financial conditions to travel by airplane.
It was a fantastic leak, based from an excel file asked by a marketing department which forgot it inside a shared folder on the hacked (private) server. There was far more info there than just that, also included the details of employees and more interesting if they were on medical leave.
Curiously enough many of those employees were family members from politicians and well-known people. Some of those in long term sick leave were receiving a monthly salary while conducting live shows on festivals during the summer.
Nothing happened on the news. They all went silent about this case.
I'm not sure about France, but here in Argentina all this info is assumed to be public. If you want a credit at a bank or shop, they ask for a physical copy of the national ID [1], probably a photocopy too, an electricity or water bill and perhaps other paperwork that is hard to get (verified phone number???).
It's supposed to be identifying information here. Usually, you can just send copies of those documents, which means that if you're looking to impersonate someone, you can easily produce fakes. And since everyone and their grandmother asks for these, people don't bat an eye and send them.
The coup de grace of security in France is signatures, though. Now, since you can't produce a physical signature over the internet, they'll ask for your phone number and send you a text with a code. Once you've entered it on their web form, you've proved undoubtedly you are who you say you are.
Physical signature are as useless anyway. We could just mark an X and it would be exactly the same. It only proves that some anoynmous person had a pen and was not afraid to use it.
You might find it interesting to learn a bit about information theory. The entire purpose of your specific number is precisely to identify which number in that list is yours. Having the list of all possible numbers is irrelevant. Conceptually you can model that as everyone has that, all the time. But that's not enough to do anything with, because having that list entire list means you have zero information.
If you say "it starts with an 8", you've eliminated 90% of the possibilities. Now you have log2(10) bits of information, but you haven't nailed it down yet. For each additional number you give you give that many more bits until you nail it down.
This is a common misconception people have. I remember someone who claimed to have copyright all possible melodies by virtue of having printed them out and thus enumerated them. But that is meaningless, because the entire job of naming a specific melody is precisely the nailing down of which one you mean. Expanding the list of possibilities you might mean is actually a reduction in the amount of information, despite the superficial appearance of listing more numbers out, and when you expand the possibilities out to "all possible instances of the thing" you're actually at the minimum of information, not the maximum.
> in Argentina all this info is assumed to be public
Same here. You can probably can find my address and phone numbers fairly easily from my name by a number of methods. That doesn't mean it isn't bad when an organisation spews out, or allows to be sucked out, huge numbers of people's data. With a leak like this it is practical to try scam everyone the list, searching for each person's details individually, and having to enumerate those people in the first place⁰, would mean no such attack would scale in a way to make it worthwhile bothering¹.
--------
[0] This seems strange when you first think it, but: the most important thing being on such a list says about you, is that you are a real existing person, whose identity could be exploited somehow. That fact is what makes any other information valuable.
[1] except for high-worth targets, which is why spear-phishing is a thing
Nothing like america though, lots of people (maybe the majority) cruise through life with 1-2 credit cards and occasionally apply for a mortgage without ever really thinking about their credit rating.
Being obsessed or even thinking about your credit rating in the UK is a bit of a minority reddit pursuit not something normal people do.
(Of course if you default on stuff you will need to think about it)
There is no such thing in France (or most countries for that matter). It's a pretty absurd system that gamifies and profits off heuristics, and results in a Kafkaesque nightmare where you can't get a job, rent a place or get a loan because of an arbitrary value assigned by a company with a profit motive. One that has no incentive to get things right or even get the right person.
How things work in France is much simpler and better. When you apply for a loan, the lender checks with Banque de France (national bank) if you have outstanding debts and if you've defaulted on any debts in the past 5 years. That's it, that and your proof of revenue is all they need.
Fairly sure this is an ironic comment. (Credit monitoring is the useless thing companies give people in the US when their information is leaked -- everyone in the industry knows it's laughably unrelated to private information disclosure).
Heh, for real, it's maddening how often this is the "solution" to any breach. It's especially lovely when it comes from multiple companies at the same time, that may or may not have leaked your SSN.
These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry and that it won’t happen again".
So, you want the French government to fine the French government so the French government uses French taxpayer money to pay the French government for the French government's mistake?
With everyone doing online “identity” verifications, all these details and more are already available to data brokers. Persona.. I mean Palantir even has a short video of you from your “liveness check” to go with the scan of your ID.
Depends. According to DOGE, voter registration databases have people listed as 150 years old or deceased people receiving monthly government checks. Obviously a different govt than TFA, but govt databases are no less prone to inaccurate data. They are still run/managed by humans regardless of the govt in question
That DOGE info was a very small portion of the data and considering who it came from you have to take even that with a grain of salt. There's always going to be inaccuracies in any dataset, no avoiding that.
> These things will never change if the only penalty the company/agency gets is
I do not think penalties can prevent these situations. Perhaps they may be less frequent; perhaps people would get more compensation, but ultimately I do not think these can be prevented. The first consideration is why the data has to be stored in the first place. Naturally one can say "the government needs to know who is a citizen and who is not", and I can understand this rationale to some extent, but even then I wonder whether this has to be correct. Perhaps we could have a global society without any requirement to be an identifiable citizen per se. Things such as mandatory age verification-sniffing to never become an issue, because it is not needed and not possible and nobody would have an addiction-need to sniff for that data (we know Meta and co want that data, this is why their lobbyists run rampage via the "but but but somebody protect the children" lie).
GDPR has solid fines for data breaches, but this doesn't work for government agencies. Just someone else's money going from one government pocket to another.
What they need is an automatic firing of the head of the government agency that suffered a breach. No question asked.
It's not just one head though. It's 3 different right-wing administrations (Sarkozy, Hollande, Macron) wanting to make everything digital, fighting against the unions, fighting against the users, and fighting against any common-sense administrator so they can destroy public services, close down local government service branches (La Poste, sécurité sociale, etc).
It was always an entire fuck up. There was no way it was anything else than an entire fuck up. The "highest level of security" (ANTS) leak is just the cherry on the top. Time to get the guillotine out of the garage i guess?
It's hard to say otherwise. They were moderate left in the 80s when they were doing nationalizations and pro-worker reforms. They've embraced free market in the 90s which is arguably not very left-wing. Leaving aside same-sex marriage for a minute, Hollande's rule was well-known for social regressions for workers (Loi travail) and minorities (Déchéance de nationalité, taking 7 year-old children into police custody for thought crimes), and handouts for wealthy elites (CICE). That, and systematically continuing to destroy public services that Sarkozy already harmed. That can hardly be called left-wing in my book... unless you'd like to name left-wing policies introduced under Hollande?
I received the email telling me I am impacted today.
Ironically it changes nothing for me as that same data had already been leaked by the French government agency that handles unemployment benefits a couple years ago.
Silly me had not bothered deleting that account even after it was no longer necessary due to finding a new job.
And they're still pushing through with the idea of centralized IDs for the internet creating massive honeypots for hacker groups and AI companies all over the world. Meanwhile it's a breach every other month all over.
Let us know how it works out. It's great in theory to stick to your principles but taking on the government in that way is almost certainly a losing battle. There are better ways to bring about change.
There's a whole spectrum available from dialogue with government members to bloody revolution. But I don't see how passive aggressively breaking arbitrary civil laws that happen to be your pet peeve either raises awareness or puts any pressure on the government at all.
The person I responded to didn't seem to be French ("governments" not "or government") and I'm not sure the French have a history of opposing their governments through copyright violations.
It seems to me we must move away from worrying about ransomware, data breach, data protection as that ship has already sailed and everyone's PII has already been stolen. We should think of how to verify people's identities online (for things like government benefits etc). I have heard of the Dutch and the Japanese using national digital identity systems although I am unclear how they work. India is doing biometrics. I am curious what the US will eventually land on.
Biometrics is just something else to get leaked, terrible idea because it's even more sensitive (can be used to track you through cameras for example, like used in the Iran war).
This problem has long been solved with federated IdPs and MFA - something you own like OTP device/physical token besides something you know like SSN/tax id/password.
Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.
I would not go that far to say all govts are like that. The main problem is majority of citizens cannot easily remember such things. Even simple PIN that is included in EU ID cards - most people don't remember or use. people want frictionless use.
You shouldn't model it as incredible hard to fake. It isn't. It's harder that typing a password you've stolen into a web site, but if you set out to do it, it's not that much harder.
This is the primary reason I'm against biometrics used for identity. Yeah, the privacy invasion is a problem, but I think that's completely dominated by the fact that if everyone uses it, it will be leaked, and once leaked, can indeed be quite practically faked. If used as a password, it's a password you can never change. That is useless.
The difficulty of overcoming a security measure should be greater in cost than the thing it is valuing. The cost of, for instance, replicating a fingerprint given a photo of it, is basically a home hobbyist project for the weekend. Check out Youtube for many people who have done exactly that and give instructions how. When the cost of bypass is "home hobbyist project on a weekend", the value of what it should be expected to protect is correspondingly low.
(In fact I don't even use it on my cell phone, with all its access to bank accounts and amazon accounts and other ways to spend my real money. The idea of a password to all that stuff that I leave arbitrary copies of sitting right on my screen is completely absurd. Everything important is locked behind codes and passwords. It's less convenient than fingerprints but at least those offer actual security.)
You also have to bear in mind the costs of the biometrics gathering. If you have a physical guard watching someone do a retinal scan and verifying that they have put their real eye up to it, you're at least on track to something that takes a lot of resources to overcome, especially if it's in combination with other techniques of identification. If you don't have that, now we're back to "how cheaply can we replicate whatever passes for a retina with this scanner" and that's likely to be cheaper than most people think. Real-world biometrics are in places where attackers can perform arbitrary attacks with impunity.
Thinking about it, I probably wouldn't remember to change my fingerprints to the new ones with all the services I use, I'd probably have to carry my "legacy fingerprints" wherever I go for some time to avoid a lockout.
These aren't really "credentials" in that they're not secret the way your iris/retina pattern, fingerprint pattern, password, pin, secret key, or security token are.
Your name, DoB, and email address are identifiers, yes, but aren't really authenticators - they're more like a username, not a password.
Based on how things are, I feel like the US solution is just going to end up with me requiring a retinal scan to buy pants from Target online and then that scan will end up on the dark web along with my voice print and a scan of a my driver's license.
Something can probably be learned from Sweden, where nearly all information is public by default.
Here's my home address btw, super easy to find if you know my name.
DoB is on there too, who I live with, which door in the building, if I have a car, a dog or contract phone.. You can even pay a small fee and get an extract of the income register to see how much I earn.
> We should think of how to verify people's identities online
France already has that, in multiple ways.
There is the France Connect SSO, which is kind of a federated SSO. You need at least one account which is physically proven (it could be with the Post Office which send you a letter with a code to confirm your address and idenntity / ask you to physically come to a post office for an ID inspection; the tax authority where there are also multiple physical verification hoops, the social security system, same), and can use that via the SSO to authenticate to all government services.
Separately, there is an app proposed that scans your physical ID's NFC chip with your biomettrics, compares that to a selfie you take, and uses that identity to authenticate you to stuff.
In the Netherlands, there's a single ID you use for all official government services. It's essentially username/password with MFA, issued by the government. What is neat is you can scan your passports NFC chip with your smartphone as a means to verify your identity through this system.
Not sure how it solves any of the data breach issues, though.
I find it especially ironic that they would leak all my data, given the fact that they would ask of me to forward them every piece of id imaginable whenever I needed to forge or amend a new one (when adding a mention on my driver's license for instance).
They do have to prove who you are, and to do that you need to show your ID(s) and they need to check it in their system. I don't understand your comment.
I already have to log to their website with 2 factor authentification.
I had to walk and physically present my id card, install the numerical identity app. That should be enough.
Also, apart from reuploading IDs, they ask for information such as age, name, place of living, and a thousand more things that they already have and doesn't need to be provided to establish that you really are you.
In 2015/2016, the president (Hollande), and its prime minister (Valls) did install a document which is "law", about technical directives for the gov and its agencies/dependencies. This document was probably written by big tech themselves. No following prime minister and even the new president (macron), did fix this obvious big tech ("whatng cartel") trojan horse.
They were probably screwed as f... or they had/have some interests somewhere ($$$).
In the last decade, all web sites were broken to be replaced by web apps ($$$), creating a hard dependency on the massively huge and complex "whatng cartel" web engines and their related massively complex c++ compilers. It is very hard to believe to anything else than corruption, really hard.
This document, which is law, which only the president and prime minister have power on, must be modified to make the difference between web sites and web apps and to mandate a web site for core and critical online services of gov and dependencies. Aka, restore noscript/basic (x)html interoperability, or "small" and technically reasonable web engines (to foster real-life alternatives from citizen, local company, etc, initiatives). All of such online services had a working web site (no app) before this document sold the gov and its dependencies to big tech (here the "whatng cartel").
No gov authorities (competition/anti-trust, justice, etc), not even the parliaments can do anything here, only the president and the prime minister.
Hardly believable, and I found out only a month ago, in spite of consulting lawyers, being part of related user groups with legal experts, etc, for 10 years. I could not understand what was going on, all this money and 'loss of strategic control' channelled in those 'companies'.
There’s something to be said about old school bureaucratic institutions: it made breaches like this significantly more difficult to pull off and far less valuable as a result.
It also ensured democratic participation by all of the people employed there making sure that processes are followed and making sure no one is cheating.
We all knew that systems like this would get breached. It’s not a matter of, “if,” but, “when.” If we’re going to continue down this route because of convenience or surveillance and authoritarianism or whatever; people designing these systems need to thinking: When this system is breached…. And they should make sure there’s a good story for protecting people and the system from these sorts of events.
It’s kind of interesting that this happens so shortly after they proudly announced how easily they would’ve able to migrate all systems from Microsoft and US firms. Maybe next year will be the year of the Linux desktop
Important to remember: this is the competency level of basically all governments who are currently proposing you be required to identify yourself using their proprietary identity systems anytime you visit a website to "save the children."
There will be zero risks to you of course, because their software is magically perfect, unlike any other software created in the history of mankind.
Assuming this is a serious question, no. The database was compromised. Some people have the authoritative source of information. Any noise they will just ignore because they know it's not in the "real" dataset.
A possible outcome of AI-assisted hacking is that companies, governments, and people become more resistant to using software, and software adoption actually declines.
What all these breaches tell me is that personal data should not be required, and especially not stored unless absolutely necessary. I cannot verify how my data is treated once it leaves my device, so how can I possibly trust it will be treated properly and not leaked?
This is a major reason as to why I am so strongly against all this verification shit governments keep trying to push, the best way to keep data secure is not to have it in the first place, therefore my personal data should not leave my device except in the strictest of circumstances for things like my name/DOB/address/SSN.
Access to the server gives you access to the encryption keys, unless the server is just storing end-to-end encrypted material for someone else and doesn't do anything with the data.
Yet another example why NO ONE should trust age verification laws or companies like Anthropic forcing you to verify identity with shady companies like Persona (https://news.ycombinator.com/item?id=47872608). Whatever info you give up, it’ll be exposed one day.
Great, now scammers can steal my identity directly from the government. I hope they release a tool to check if I'm impacted or at least email me about it.
Edit: does someone not realize that many (all?) the doctors and hospitals use to verify you is your name and date of birth (in the U.S. - although I suppose that's why since this breach happened elsewhere)?
Because the world is run by people who don't know anything, but have to pretend they know everything, so they can't ask those of us who have some idea about how IT security works.
There are carve-outs to allow for governments to make exceptions, but it's besides the point.
If the government were to hold themselves to account, they would fine themselves some amount N, and pay itself N using your taxes. It also wastes other finite resources for all the paperwork and legal action involved that could be used for something else.
Speaking pragmatically, there's no point trying to hold the government itself to it's own laws. The only time citizens do hold the government accountable, it's always done in the form of hangings, or the guillotine in France's case.
what would be the point of the government fining itself though?
Now that I'm thinking of it, it would create the need for an extra gaggle of bureaucrats to oversee the process,so I suppose someone might see a point to it ...
You may think you're funny or something, but boy do I have news for you.
There absolutely are fines for French administrations. And, knowing the French tax system, they've probably found a way to levy VAT and some other taxes on top of those fines.
I trust Google more than any government with my data. One needs security to survive the other couldn’t care less.
Google selling data? So far no one came to blackmail me for certain dispositions, while the other does as they want, IRS, foreign governments, social security whatever.
Google can be sued while the other gives itself a pass.
Who is the baddie?
In Germany the administration put massive duties on IT providers and added punitive damage as a looming consequence.
Fast forward and the government with its “Ha, we are so digital!” and “Europe is better than US in CS!” suddenly has to swallow some brutal medicine I guess.
I stick to my guns: Silicon Valley and especially Google is art regarding code and CS evolution. Same for FAANG etc.
EU is hubris to say the least.
Every time someone says “Let’s build our own Google/Cloud/…” a penguin dies.
E Invoice will be a brutal boomerang, XRechnung the greatest backdoor of all times.
I don't understand the downvotes. Literally every single German email provider took like 5 years to implement 2FA. Even now lots of security issues with many German providers that claim privacy. Even so-called DE-mail was sham. Still somehow people assume FAANG is crap in data security. (Yes, I am not demanding privacy from ANY MultiNational company)
> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens
Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry and that it won’t happen again".
Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc.
Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laundering. It doesn't actually do that. Search for "largest money laundering settlements" and you will find 5 banks and one crypto scam.
> Or maybe the government should not require companies to KYC you for every little stupid thing
Actually....
Say what you like about the French today, but one good thing they have is an electronic service[1] where you can generate single-use KYC ID:
More countries should provide this sort of KYC tool.[1]https://france-identite.gouv.fr/usages/le-justificatif-d-ide...
It looked great and I wanted to try it, but it doesn't work on the web and my smartphone is rejected with no clear explanation ("missing some security mechanisms"); probably because I'm running LineageOS with MicroG.
Proving* that the KYC implementation is bogus as it relies on GSF. *Probably.
I'm not exactly sure of the details, but isn't this similar to DigiD in NL? There too you can "prove your Identity and log in" via the govt app. The server side of the 3rd party has to handle the rest (eg user account information etc.), nothing is shared beyond "this is the guy who's signing in, verified by the govt".
Wish entities who handle Aadhar in India be required to accept the one-time Virtual Aadhar. Its a quick online and SMS-only process. Seems everybody forces you to hand over your permanent Aadhar, including the ID verification partner for Paypal.
Why do I have to learn about it on HN?
I'm tired of having to connect on EDF' shitty website to get a new PDF every three months.
I just set it up!
A bit bumpy because login on Ameli/Impôts wasn't working on Orion so I had to go on Safari, but otherwise its done. I even have colored pictures on the virtual CNI/Permis!
Thanks!
EDIT: Why do the put three stats about trains on your linked page?!
> I'm tired of having to connect on EDF' shitty website to get a new PDF every three months.
It doesn't look like this app can generate "justificatifs de domicile", only substitutes for an identity card or passport.
> Why do the put three stats about trains on your linked page?!
I was wondering about that too
> It doesn't look like this app can generate "justificatifs de domicile", only substitutes for an identity card or passport.
You're absolutely right! Damn!
At least it should make it easier to use France Connect with the QR code stuff instead of the credentials from other websites...
It's a pity this doesn't work for foreigners resident in France.
[dead]
The overreach on access and then storage will be a meaningful issue we will have to reckon with more and more. Companies are acquired, companies die. What happens to your data in 5, 15, 50 years? It doesn’t just disappear.
From a few months back: https://mjeggleton.com/blog/your-data-never-dies
So that if you ever step out of line with regards to what the government deems "worthy" behavior (whatever the hell that means at any given moment) you can be de-banked and effectively excluded from participating in society
I’m not versed in the French system specifics, but know a bit about the Belgian itsme. It’s up to the companies to specify which scopes and data bits they want. The better government agencies only ask for your ID number and proof that you’re you. Corporate users tend to ask for absolutely everything in your profile.
Might be cheaper & safer to buy an identity than use my own.
KYC: Know your customer or know your client (KYC) laws, regulations and guidelines in financial services require regulated businesses and professionals to verify the identity, suitability, and risks involved with maintaining a business relationship with a customer.
https://en.wikipedia.org/wiki/Know_your_customer
Yeah, it should be made illegal to hold like, more than x columns of PII per entity or bank branch or something. It's just not smart to allow big database of everyone to be made and to expect you stay the one to abuse than to be nails that gets beaten using it.
[dead]
Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive.
The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose a legally-enforced deadline to fix any issues, with a fine (for private actors) or demotion of the guy in charge of infosec (for state agencies).
Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.
France seems to have had a ton of government hacks in the past year at various levels, so it's sorely needed.
I agree with the premise that SSII audits are useless, but your solution sounds like bandaid on a cancer. The real solution solution is stop this surveillance machine madness!
I understand that identity is required for property deeds and bank accounts for tax reasons and that should 100% not be online. But for the rest, it should be entirely outlawed to collect personal information beyond what's necessary for the service, including for government agencies.
Make healthcare (really) free => no social security database to hack. Give me back humans in offices for taxes and drivers licences => no ANTS database to hack. etc.
Er? social security covers more than just healthcare and the issue with on-line data in context of healthcare is patients' history, which i) is sensitive and ii) needs to be shared among health care providers.
French context: sécurité sociale exclusively means socialized healthcare. Sorry for the confusion.
Flagged for AI use.
Tough luck, i've never used any machine learning in my life (that i know of). AI tools are part of the same problem, the same techno-fascism i was decrying in my comment. I'm just curious how you could even think i was using AI????
You don't seem to realize the difference between those 2.
> The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose ...
And now you've got private people empowered to attack specific government officials. In fact, that's their job. Btw: you forgot to specify "in public", and that needs to be how it works, otherwise it will just result in officials attacking this security agency. Oh, AND you're giving government officials an obvious point of attack: "salaries matching the private sector".
> Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.
You mean forget the way even the dumbest of the dumb can "provide security"? Do you think government officials in France got their position based on their IQ?
Of course this is the only way it can work, but this needs a very un-French form of government to get it to work.
> this needs a very un-French form of government to get it to work
I'm usually not one to defend french culture, but i believe your interpretation is wrong. What went wrong in this case is the americanization of the french administration: make everything complex, remove all local government branches and workers who can help you, remove every sensical administrator from their position, ignore all the privacy laws that were passed after Vichy and the nazi/IBM databases, "just make all the NUMÉRISATION".
The french government didn't have a proper national ID system until the nazi administration (Vichy) who invented the CNI and the Ausweis. There was strong sentiment against this well into the 70s and the Loi Informatique et Libertés, and it's only the more recent startup generation that started undoing all our ancestors hard fought battles against data collections/centralization.
> Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive.
This is the same as the rogue police problem in the US. What needs to happen is a shift to personal liability for those responsible.
Personal liability? Are you also against no blame culture that is prevalent in the tech world?
Someone(s), somewhere, is paid "big bucks" to be in charge.
That's the person we should charge. If they cannot be charged for this kind of fuck-ups, then they should not be paid anything for simply rubber-stamping anything going over their desk. A simple machine could do their job.
If it’s related to compliance? Yeah I think that’s a pretty dangerous culture to have. Compliance requirements need owners who will ensure standards are met. If they don’t do their jobs, then they should face the consequences for the harm they allow.
[dead]
Hey now, don’t forget the offer of “free credit monitoring for a year” - I feel like at this point I’ve gotten so many of those that if I signed up for them all, I’d have my personal info in twice as many probably-hackable locations as I do already.
Seeing another one of these breaches had me returning to look at local-first software. https://lofi.so
I feel like if we're going to make progress in preventing wholesale data breaches it will be through architectural innovations that attack the problem of why a trove of concentrated data needs to exist. Even if the government needs to be a central authority, are there ways to house the data that limit the blast radius?
I'm sure there are innumerable arguments why this can't help, but when the mainstream alternative is despair and helplessness, progress will be made in the margins.
Wait, you don’t even get a month of free credit monitoring?
My full name, phone number, and address were leaked by TAP Air Portugal about five years ago, along with the details of my parents who were on the same booking. Since then, my dad has been targeted by those types of scams where a fraudster impersonates me to ask for money.
I never received a notification from TAP; I only found out a year later through my Google One security feature. I certainly didn't get an apology—much less a free travel ticket!
The world of today is so weird sometimes.
When I was a kid most adults' full name, phone number, and address were available for free in the phone book.
If the scam success rate is 0.1%, and it takes days to comb a phone book and put together a list of potential relationships and takes a human 10 minutes per phone call, the economics of scamming works out a lot less profitable than importing a data leak and emailing or robocalling everyone in the list.
I do use an email alias everywhere. But I don't believe you can do the same with phone numbers. I tried using my twilio rented number and there is a way systems use to figure out if that is a real number for a person or a VoIP one. Though it is sometimes successful in use for signups and hence spam reduction.
Could set up 6 digit long extensions and only ever issue a few hundred of them in total.
Guess wrong 3x and goodbye.
Can also set some/most/all to go to voicemail so they can get in touch with you, but not really.
Or blackhole the invalid extensions to /dev/null voicemail but then you run the risk of legit misdials and you never get some important message.
The real vs “fake” number issue could be worked around by having your cell phone provider forward all calls to your VoIP number. It’s baked into gsm, don’t need a phone after initial setup: https://www.geckobeach.com/cellular/secrets/gsmcodes.php
That TAP data was leaked on a tor hidden service, in multiple files, and download was extremely slow on the days following the leak. One of the files was much smaller, and my friend had the bad luck to have his data in that one.
His phone was spammed so incessantly he had to change his number almost immediately.
I'm dissatisfied about the TAP leak as well! I was affected, and like you, didn't even receive a notification - nevermind compensation for having leaked my personal data to the dark web enabling all sorts of shenanigans that make my personal life difficult.
About 2 million portuguese there. Basically all active portuguese adults that have enough financial conditions to travel by airplane.
It was a fantastic leak, based from an excel file asked by a marketing department which forgot it inside a shared folder on the hacked (private) server. There was far more info there than just that, also included the details of employees and more interesting if they were on medical leave.
Curiously enough many of those employees were family members from politicians and well-known people. Some of those in long term sick leave were receiving a monthly salary while conducting live shows on festivals during the summer.
Nothing happened on the news. They all went silent about this case.
It’s scams all the way down.
> I never received a notification from TAP
They have been reporting millions in profits despite rising costs. What you propose would further elevate costs. Shareholders don’t want that.
I'm not sure about France, but here in Argentina all this info is assumed to be public. If you want a credit at a bank or shop, they ask for a physical copy of the national ID [1], probably a photocopy too, an electricity or water bill and perhaps other paperwork that is hard to get (verified phone number???).
[1] Do you want my number? It's inside this list:
It's supposed to be identifying information here. Usually, you can just send copies of those documents, which means that if you're looking to impersonate someone, you can easily produce fakes. And since everyone and their grandmother asks for these, people don't bat an eye and send them.
The coup de grace of security in France is signatures, though. Now, since you can't produce a physical signature over the internet, they'll ask for your phone number and send you a text with a code. Once you've entered it on their web form, you've proved undoubtedly you are who you say you are.
Physical signature are as useless anyway. We could just mark an X and it would be exactly the same. It only proves that some anoynmous person had a pen and was not afraid to use it.
"Do you want my number? It's inside this list:"
You might find it interesting to learn a bit about information theory. The entire purpose of your specific number is precisely to identify which number in that list is yours. Having the list of all possible numbers is irrelevant. Conceptually you can model that as everyone has that, all the time. But that's not enough to do anything with, because having that list entire list means you have zero information.
If you say "it starts with an 8", you've eliminated 90% of the possibilities. Now you have log2(10) bits of information, but you haven't nailed it down yet. For each additional number you give you give that many more bits until you nail it down.
This is a common misconception people have. I remember someone who claimed to have copyright all possible melodies by virtue of having printed them out and thus enumerated them. But that is meaningless, because the entire job of naming a specific melody is precisely the nailing down of which one you mean. Expanding the list of possibilities you might mean is actually a reduction in the amount of information, despite the superficial appearance of listing more numbers out, and when you expand the possibilities out to "all possible instances of the thing" you're actually at the minimum of information, not the maximum.
> in Argentina all this info is assumed to be public
Same here. You can probably can find my address and phone numbers fairly easily from my name by a number of methods. That doesn't mean it isn't bad when an organisation spews out, or allows to be sucked out, huge numbers of people's data. With a leak like this it is practical to try scam everyone the list, searching for each person's details individually, and having to enumerate those people in the first place⁰, would mean no such attack would scale in a way to make it worthwhile bothering¹.
--------
[0] This seems strange when you first think it, but: the most important thing being on such a list says about you, is that you are a real existing person, whose identity could be exploited somehow. That fact is what makes any other information valuable.
[1] except for high-worth targets, which is why spear-phishing is a thing
> That doesn't mean it isn't bad when an organisation spews out, or allows to be sucked out, huge numbers of people's data.
I completely agree.
If you are that unconcerned, why do you not provide us with your information right here and now?
The credit system is not the same in Europe, first of all there is no such thing as credit rating and what not.
People don't have credit card like the one in US and Canada.
The vast majority use a debit card.
We do very much have credit rating in Germany, might be very different than the one in the US, don’t know theirs.
the credit rating system in Europe is quite different from the one in the United States and varies significantly from country to country.
but credit ratings are definitely a thing, they're just not FICO scores.
Equafax is still a thing in the UK and Spain, etc.
In UK there is. :(
Nothing like america though, lots of people (maybe the majority) cruise through life with 1-2 credit cards and occasionally apply for a mortgage without ever really thinking about their credit rating.
Being obsessed or even thinking about your credit rating in the UK is a bit of a minority reddit pursuit not something normal people do.
(Of course if you default on stuff you will need to think about it)
There is no such thing in France (or most countries for that matter). It's a pretty absurd system that gamifies and profits off heuristics, and results in a Kafkaesque nightmare where you can't get a job, rent a place or get a loan because of an arbitrary value assigned by a company with a profit motive. One that has no incentive to get things right or even get the right person.
How things work in France is much simpler and better. When you apply for a loan, the lender checks with Banque de France (national bank) if you have outstanding debts and if you've defaulted on any debts in the past 5 years. That's it, that and your proof of revenue is all they need.
Fairly sure this is an ironic comment. (Credit monitoring is the useless thing companies give people in the US when their information is leaked -- everyone in the industry knows it's laughably unrelated to private information disclosure).
Heh, for real, it's maddening how often this is the "solution" to any breach. It's especially lovely when it comes from multiple companies at the same time, that may or may not have leaked your SSN.
These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry and that it won’t happen again".
So, you want the French government to fine the French government so the French government uses French taxpayer money to pay the French government for the French government's mistake?
You could just jail the CEO or who was responsible for the security at that agency / company.
With everyone doing online “identity” verifications, all these details and more are already available to data brokers. Persona.. I mean Palantir even has a short video of you from your “liveness check” to go with the scan of your ID.
Yeah we are all walking with online targets in our real life. Technology has failed us spectacularly
And 12 months of credit monitoring to go with the 2346823 months of credit monitoring they already have.
The problem though is when its from a gov agency it validates previous breach data making it more valuable.
Depends. According to DOGE, voter registration databases have people listed as 150 years old or deceased people receiving monthly government checks. Obviously a different govt than TFA, but govt databases are no less prone to inaccurate data. They are still run/managed by humans regardless of the govt in question
That DOGE info was a very small portion of the data and considering who it came from you have to take even that with a grain of salt. There's always going to be inaccuracies in any dataset, no avoiding that.
> if the only penalty the company/agency gets
What is the penalty for the government?
Elon Musk
Not disagreeing with you, but:
> These things will never change if the only penalty the company/agency gets is
I do not think penalties can prevent these situations. Perhaps they may be less frequent; perhaps people would get more compensation, but ultimately I do not think these can be prevented. The first consideration is why the data has to be stored in the first place. Naturally one can say "the government needs to know who is a citizen and who is not", and I can understand this rationale to some extent, but even then I wonder whether this has to be correct. Perhaps we could have a global society without any requirement to be an identifiable citizen per se. Things such as mandatory age verification-sniffing to never become an issue, because it is not needed and not possible and nobody would have an addiction-need to sniff for that data (we know Meta and co want that data, this is why their lobbyists run rampage via the "but but but somebody protect the children" lie).
GDPR has solid fines for data breaches, but this doesn't work for government agencies. Just someone else's money going from one government pocket to another. What they need is an automatic firing of the head of the government agency that suffered a breach. No question asked.
I'd go for mandatory caning, on CSPAN
It's not just one head though. It's 3 different right-wing administrations (Sarkozy, Hollande, Macron) wanting to make everything digital, fighting against the unions, fighting against the users, and fighting against any common-sense administrator so they can destroy public services, close down local government service branches (La Poste, sécurité sociale, etc).
It was always an entire fuck up. There was no way it was anything else than an entire fuck up. The "highest level of security" (ANTS) leak is just the cherry on the top. Time to get the guillotine out of the garage i guess?
> It's 3 different right-wing administrations (Sarkozy, Hollande, Macron)
So now socialists are right wing? Who isn’t then? Kim Jong Un maybe?
It's hard to say otherwise. They were moderate left in the 80s when they were doing nationalizations and pro-worker reforms. They've embraced free market in the 90s which is arguably not very left-wing. Leaving aside same-sex marriage for a minute, Hollande's rule was well-known for social regressions for workers (Loi travail) and minorities (Déchéance de nationalité, taking 7 year-old children into police custody for thought crimes), and handouts for wealthy elites (CICE). That, and systematically continuing to destroy public services that Sarkozy already harmed. That can hardly be called left-wing in my book... unless you'd like to name left-wing policies introduced under Hollande?
> Nothing really new here sadly
Facts at Equifax
[flagged]
did you just want an excuse to say "microslop" or what is the relevance of your comment to either the article or the comment you are replying to?
hackernews.txt
I received the email telling me I am impacted today.
Ironically it changes nothing for me as that same data had already been leaked by the French government agency that handles unemployment benefits a couple years ago. Silly me had not bothered deleting that account even after it was no longer necessary due to finding a new job.
A copy of it would be nice for record purpose (so Anthropic and OpenAI can have it in their dataset :))
Is it from ANTS? I haven't gotten anything yet.
And they're still pushing through with the idea of centralized IDs for the internet creating massive honeypots for hacker groups and AI companies all over the world. Meanwhile it's a breach every other month all over.
If governments are treating my personal data as if it is worth nothing, then I'm not going to treat copyrighted works as if they are worth something.
If you want to build a society on information, then you cannot forget the most important group.
Let us know how it works out. It's great in theory to stick to your principles but taking on the government in that way is almost certainly a losing battle. There are better ways to bring about change.
It all starts by noticing that there is something odd about the way governments are trying to structure things, and then raising awareness about it.
There might be better ways to bring about change, but if you don't say what they are then that doesn't help much.
There's a whole spectrum available from dialogue with government members to bloody revolution. But I don't see how passive aggressively breaking arbitrary civil laws that happen to be your pet peeve either raises awareness or puts any pressure on the government at all.
Not sure the French of all people need lectures on bringing about change and taking on the government.
The person I responded to didn't seem to be French ("governments" not "or government") and I'm not sure the French have a history of opposing their governments through copyright violations.
It seems to me we must move away from worrying about ransomware, data breach, data protection as that ship has already sailed and everyone's PII has already been stolen. We should think of how to verify people's identities online (for things like government benefits etc). I have heard of the Dutch and the Japanese using national digital identity systems although I am unclear how they work. India is doing biometrics. I am curious what the US will eventually land on.
Biometrics is just something else to get leaked, terrible idea because it's even more sensitive (can be used to track you through cameras for example, like used in the Iran war).
This problem has long been solved with federated IdPs and MFA - something you own like OTP device/physical token besides something you know like SSN/tax id/password.
Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.
I would not go that far to say all govts are like that. The main problem is majority of citizens cannot easily remember such things. Even simple PIN that is included in EU ID cards - most people don't remember or use. people want frictionless use.
> Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.
Or... it's something that you always have on you which is incredibly hard to fake.
You shouldn't model it as incredible hard to fake. It isn't. It's harder that typing a password you've stolen into a web site, but if you set out to do it, it's not that much harder.
This is the primary reason I'm against biometrics used for identity. Yeah, the privacy invasion is a problem, but I think that's completely dominated by the fact that if everyone uses it, it will be leaked, and once leaked, can indeed be quite practically faked. If used as a password, it's a password you can never change. That is useless.
The difficulty of overcoming a security measure should be greater in cost than the thing it is valuing. The cost of, for instance, replicating a fingerprint given a photo of it, is basically a home hobbyist project for the weekend. Check out Youtube for many people who have done exactly that and give instructions how. When the cost of bypass is "home hobbyist project on a weekend", the value of what it should be expected to protect is correspondingly low.
(In fact I don't even use it on my cell phone, with all its access to bank accounts and amazon accounts and other ways to spend my real money. The idea of a password to all that stuff that I leave arbitrary copies of sitting right on my screen is completely absurd. Everything important is locked behind codes and passwords. It's less convenient than fingerprints but at least those offer actual security.)
You also have to bear in mind the costs of the biometrics gathering. If you have a physical guard watching someone do a retinal scan and verifying that they have put their real eye up to it, you're at least on track to something that takes a lot of resources to overcome, especially if it's in combination with other techniques of identification. If you don't have that, now we're back to "how cheaply can we replicate whatever passes for a retina with this scanner" and that's likely to be cheaper than most people think. Real-world biometrics are in places where attackers can perform arbitrary attacks with impunity.
> something you know like SSN/tax id/password
How can you equal an SSN/Tax id with a password? The SSN/Tax id is more or less public knowledge while a password is not.
Biometrics are the only credential you can't roll after compromise.
It depends what the biometrics are. There have been successful hand transplants, so new finger prints are possible, but completely impractical.
https://en.wikipedia.org/wiki/Hand_transplantation
Thinking about it, I probably wouldn't remember to change my fingerprints to the new ones with all the services I use, I'd probably have to carry my "legacy fingerprints" wherever I go for some time to avoid a lockout.
kind of but others are hard as well... most people don't change their name, date of birth or even email address when they are leaked.
These aren't really "credentials" in that they're not secret the way your iris/retina pattern, fingerprint pattern, password, pin, secret key, or security token are.
Your name, DoB, and email address are identifiers, yes, but aren't really authenticators - they're more like a username, not a password.
this is exactly my problem with them
Maybe in the future, our driver licenses will become a physical token?
Based on how things are, I feel like the US solution is just going to end up with me requiring a retinal scan to buy pants from Target online and then that scan will end up on the dark web along with my voice print and a scan of a my driver's license.
Something can probably be learned from Sweden, where nearly all information is public by default.
Here's my home address btw, super easy to find if you know my name.
DoB is on there too, who I live with, which door in the building, if I have a car, a dog or contract phone.. You can even pay a small fee and get an extract of the income register to see how much I earn.
https://mrkoll.se/person/Jan-Martin-Harris-Harasym-Snapperup...
https://www.ratsit.se/19891030-Jan_Martin_Harris_Harasym_Mal...
Yet somehow it seems to work.
> We should think of how to verify people's identities online
France already has that, in multiple ways.
There is the France Connect SSO, which is kind of a federated SSO. You need at least one account which is physically proven (it could be with the Post Office which send you a letter with a code to confirm your address and idenntity / ask you to physically come to a post office for an ID inspection; the tax authority where there are also multiple physical verification hoops, the social security system, same), and can use that via the SSO to authenticate to all government services.
Separately, there is an app proposed that scans your physical ID's NFC chip with your biomettrics, compares that to a selfie you take, and uses that identity to authenticate you to stuff.
In the Netherlands, there's a single ID you use for all official government services. It's essentially username/password with MFA, issued by the government. What is neat is you can scan your passports NFC chip with your smartphone as a means to verify your identity through this system.
Not sure how it solves any of the data breach issues, though.
I can make a new password, hard to get a new eyeball.
[dead]
I find it especially ironic that they would leak all my data, given the fact that they would ask of me to forward them every piece of id imaginable whenever I needed to forge or amend a new one (when adding a mention on my driver's license for instance).
Like they didn't have access to it anyway.
They do have to prove who you are, and to do that you need to show your ID(s) and they need to check it in their system. I don't understand your comment.
I already have to log to their website with 2 factor authentification. I had to walk and physically present my id card, install the numerical identity app. That should be enough.
Also, apart from reuploading IDs, they ask for information such as age, name, place of living, and a thousand more things that they already have and doesn't need to be provided to establish that you really are you.
In 2015/2016, the president (Hollande), and its prime minister (Valls) did install a document which is "law", about technical directives for the gov and its agencies/dependencies. This document was probably written by big tech themselves. No following prime minister and even the new president (macron), did fix this obvious big tech ("whatng cartel") trojan horse.
They were probably screwed as f... or they had/have some interests somewhere ($$$).
In the last decade, all web sites were broken to be replaced by web apps ($$$), creating a hard dependency on the massively huge and complex "whatng cartel" web engines and their related massively complex c++ compilers. It is very hard to believe to anything else than corruption, really hard.
This document, which is law, which only the president and prime minister have power on, must be modified to make the difference between web sites and web apps and to mandate a web site for core and critical online services of gov and dependencies. Aka, restore noscript/basic (x)html interoperability, or "small" and technically reasonable web engines (to foster real-life alternatives from citizen, local company, etc, initiatives). All of such online services had a working web site (no app) before this document sold the gov and its dependencies to big tech (here the "whatng cartel").
No gov authorities (competition/anti-trust, justice, etc), not even the parliaments can do anything here, only the president and the prime minister.
Hardly believable, and I found out only a month ago, in spite of consulting lawyers, being part of related user groups with legal experts, etc, for 10 years. I could not understand what was going on, all this money and 'loss of strategic control' channelled in those 'companies'.
19 millions de Français! Et moi, et moi, et moi.
Better link? https://www.bleepingcomputer.com/news/security/french-govt-a...
There’s something to be said about old school bureaucratic institutions: it made breaches like this significantly more difficult to pull off and far less valuable as a result.
It also ensured democratic participation by all of the people employed there making sure that processes are followed and making sure no one is cheating.
We all knew that systems like this would get breached. It’s not a matter of, “if,” but, “when.” If we’re going to continue down this route because of convenience or surveillance and authoritarianism or whatever; people designing these systems need to thinking: When this system is breached…. And they should make sure there’s a good story for protecting people and the system from these sorts of events.
It’s kind of interesting that this happens so shortly after they proudly announced how easily they would’ve able to migrate all systems from Microsoft and US firms. Maybe next year will be the year of the Linux desktop
Important to remember: this is the competency level of basically all governments who are currently proposing you be required to identify yourself using their proprietary identity systems anytime you visit a website to "save the children."
There will be zero risks to you of course, because their software is magically perfect, unlike any other software created in the history of mankind.
Would it be possible to spread so much noise that data like this becomes useless? Could an LLM be used to help here?
Assuming this is a serious question, no. The database was compromised. Some people have the authoritative source of information. Any noise they will just ignore because they know it's not in the "real" dataset.
Url changed from https://techcrunch.com/2026/04/22/france-confirms-data-breac..., which points to this.
A possible outcome of AI-assisted hacking is that companies, governments, and people become more resistant to using software, and software adoption actually declines.
I can see this happening as well. I'm extremely loathe to download or sign up or discuss anything online these days.
C’est la vie.
Governments may just be incompetent. Still, the lobbyists will never give up for mandatory age verification in the future.
We are going to leak everything from our sexual health records to our HR files
It's the age of the leak and the sooner we accept, no matter our efforts, we live in a security free world and design around that - the better
What all these breaches tell me is that personal data should not be required, and especially not stored unless absolutely necessary. I cannot verify how my data is treated once it leaves my device, so how can I possibly trust it will be treated properly and not leaked?
This is a major reason as to why I am so strongly against all this verification shit governments keep trying to push, the best way to keep data secure is not to have it in the first place, therefore my personal data should not leave my device except in the strictest of circumstances for things like my name/DOB/address/SSN.
It's nothing special. Our data goes away on a regular basis.
They hack the taxes and the heath insurance system and yhay have everything about us.
What a shitty world because of these idiots
- There was no leak - Here is sample data we stole
„Small, not harmful leak of non important data, few records only”
This shit should be stored encrypted not in plaintext.
The attacker will then simply use the decryption key to decrypt it.
Then the headline would be French goverment loses encryption keys ..
Access to the server gives you access to the encryption keys, unless the server is just storing end-to-end encrypted material for someone else and doesn't do anything with the data.
Use Mythos!
Yet another example why NO ONE should trust age verification laws or companies like Anthropic forcing you to verify identity with shady companies like Persona (https://news.ycombinator.com/item?id=47872608). Whatever info you give up, it’ll be exposed one day.
I wonder: Do all these government ID databases etc contain the IDs of the politicians and other people in "power" that pushed for all this shit?
Or are they magically exempt?
[dead]
[dead]
Great, now scammers can steal my identity directly from the government. I hope they release a tool to check if I'm impacted or at least email me about it.
Why would those pieces of data (DOB, full name, address) ever be sufficient for identity theft?
If that's sufficient to achieve anything then those systems are built on top of hopes and dreams.
It's good enough for health insurance fraud.
Edit: does someone not realize that many (all?) the doctors and hospitals use to verify you is your name and date of birth (in the U.S. - although I suppose that's why since this breach happened elsewhere)?
Because the world is run by people who don't know anything, but have to pretend they know everything, so they can't ask those of us who have some idea about how IT security works.
With the number of leaks the French administration had everywhere, you don't need a tool, you are guaranteed to be impacted.
"Our government successfully achieved wide distribution of valuable assets in the era of digital information."
Alternatively, hackers can now be used as a method of age identification.
>I hope they release a tool to check if I'm impacted or at least email me about it.
"ANTS stated that it is currently in the process of notifying those identified as impacted."
are govs required to comply with GDPR and data breaches laws?
There are carve-outs to allow for governments to make exceptions, but it's besides the point.
If the government were to hold themselves to account, they would fine themselves some amount N, and pay itself N using your taxes. It also wastes other finite resources for all the paperwork and legal action involved that could be used for something else.
Speaking pragmatically, there's no point trying to hold the government itself to it's own laws. The only time citizens do hold the government accountable, it's always done in the form of hangings, or the guillotine in France's case.
Yes, but unelected bureaucrats only impose fines on the private sector.
what would be the point of the government fining itself though?
Now that I'm thinking of it, it would create the need for an extra gaggle of bureaucrats to oversee the process,so I suppose someone might see a point to it ...
You may think you're funny or something, but boy do I have news for you.
There absolutely are fines for French administrations. And, knowing the French tax system, they've probably found a way to levy VAT and some other taxes on top of those fines.
Do you mean fines for tiny companies?
I trust Google more than any government with my data. One needs security to survive the other couldn’t care less.
Google selling data? So far no one came to blackmail me for certain dispositions, while the other does as they want, IRS, foreign governments, social security whatever.
Google can be sued while the other gives itself a pass.
Who is the baddie?
In Germany the administration put massive duties on IT providers and added punitive damage as a looming consequence.
Fast forward and the government with its “Ha, we are so digital!” and “Europe is better than US in CS!” suddenly has to swallow some brutal medicine I guess.
I stick to my guns: Silicon Valley and especially Google is art regarding code and CS evolution. Same for FAANG etc.
EU is hubris to say the least.
Every time someone says “Let’s build our own Google/Cloud/…” a penguin dies.
E Invoice will be a brutal boomerang, XRechnung the greatest backdoor of all times.
Your data, time to shift everything into the EU.
I don't understand the downvotes. Literally every single German email provider took like 5 years to implement 2FA. Even now lots of security issues with many German providers that claim privacy. Even so-called DE-mail was sham. Still somehow people assume FAANG is crap in data security. (Yes, I am not demanding privacy from ANY MultiNational company)