Coding Flaw Exposes Voter Details for 6.5M Israelis

Why would anyone? The riskiest place I would keep passwords is in an encrypted archive. Barring unknown side channel attacks, my brain is less secure than that.

How is that even possible? Beyond storing passwords unencrypted anywhere, why would you make a specific endpoint to return them.

It feels suspicious that someone could be capable of building this app (requires some level of knowledge) and creating a publicly exposed endpoint that is almost designed for malicious purposes.

I wonder if, or when computing will be superceded as the main driver of innovation. In 1950 computers existed but you couldn't have guessed that computation and the innovations derived from it would eat the World. What exists today that will transform the World again?

> I wonder what the next 100, 500 years will look like, after all this has 'settled' down.

> Breaches like this should be impossible as there should be designs against it.

I see it the other way around. Privacy is equal to security, it is only as strong as its weakest link, and there are many many “links” (attack vectors) and the amount of data you can breach with asymmetric attacks is unprecedented. By way of ergodicity, everything’s going to be leaked eventually, no matter how good our intentions are to protect it.

If you take everything to its logical conclusion, it is inevitable that the concept of privacy is going to be absolutely destroyed in the future, and everyone will know everything about everyone at all times. The latest privacy laws are futile attempts to put the finger in the dike before it explodes; too little, too late.

Its not that we do an especially bad job with data. Odds are your home is even less secure.

Yes, we are at the primitive end of history, even the first transistor is still within living memory. What these breaches do is normalize the loss of privacy, the protection of which eats into the profits that fuel the growth of the companies that collect it, and threaten their foundational roles in this early history. That this is early in the game is also why protective laws need to be passed for people to retain the power over their own information. Data is not as cheap as the law treats it, Google makes almost $100MM every week.

Furthermore, how much time do these breaches steal in lost productivity, or in diminished free time, for all of us? Quite a bit, but the only time you hear about that metric is when management is complaining about employees talking to each other in the hallway.

Protections not established early become harder to impose later, which is why the companies and lawmakers to which they donate downplay the severity of these breaches via pittances of penalties, 30min of revenues or something. Fines should be $1000 per individual exfiltrated, or a year of revenues (at last year's number), or other figure that would be actually effective...and with strict liability.

> concept of storing PB's of easily searchable and accessible data

The scale of this dataset is probably on the two/three digit MB scale. It's 6.5 million people and everyone adds probably less than 500 bytes to the dataset.

Let's say it's 500 MB. This isn't "big data", but it's still highly sensitive. It's still "only" a file on your Computer and deleting it still doesn't delete it safely.

The issue is the effectivity of our data handling devices. As the file is so small, it fits onto current USB sticks cheaply. People can put those USB sticks anywhere and smuggle them out of their jobs. Snowden claims to have gotten the NSA data out this way and even if he lies, it's certainly a plausible method.

The more effective our data handling devices get, the more data can be leaked.

I'm a bit of a pessimist and think we won't be able to stop such leaks in every domain. They'll just get worse and worse over time, the larger the data sets get that are being accumulated about people.

Former Google CEO Schmidt has famously said that there won't be privacy in the future. Maybe he's right. Maybe he's wrong and we figure out a way to preserve it. But doing that is super hard.

Maybe society is just ever changing and the "stable" state will be some form of singularity where a concept like "living on a planet" is regarded as outdated because we live in emulated environments in free orbit around a sun and the planets are better off being dismantled to build more emulated environments, and all our thoughts, dreams, plans, our entire existence is accessible to the environment's operators who claim to be "fair" like Google, Twitter or Facebook claim today.

Unless said designs/process/overview was deliberately overlooked. This is a political app...

Given the history of obvious, obliviously bad flaws in elections machines everywhere, how can one not come to the conclusion that the rigging of the game is just being swept inside the box with the blinkenlights? Where no one can see or audit the process because this is SECURE code, no can see...

Investigations to see exactly who is funding the election tech companies, board members, prime investors, etc etc etc.

The flow of money will tell the story.

While there's a lot of security firepower in Israel, talent tends to gravitate towards high paying and/or technologically interesting companies.

a consulting firm developing one-off mobile apps used by political parties can offer neither (see the recent Iowa caucuses debacle)

As above poster noted, best talent isn't flocking to work for the bureaucratic arms of the govt. In fact I'd venture as far to say that a large portion of the Israeli population has a very negative view of the government itself.

> our entire field is bad at what we do

I tend to think that if - everyone had access to military grade weaponry, and - their actions were close to anonymous, and - it was so obvious they were killing people by acting

then a lot more planes and elevators would be a lot less safe.

I think plane and elevator technology has had a long time to becomes more robust, and there's a lot less players in the field, with a lot more regulations, and a LOT less people actively trying to sabotage them.

All things being equal, I don't think the people designing them are much more skilled than the people writing software for some of the better firms.