Comment by alias_neo | Hacker News Reader

Comment by alias_neo | Hacker News Reader

Parent Full thread

It's such a battle. When my wife and I were buying our home, we needed to send our entire lives in paperwork form to the solicitors.

I asked if they have a secure mechanism for file uploads and they responded "email is fine". No, email is not fine.

They _really_ struggled to understand why I wouldn't just email them every document they asked for (from birth certificates, marriage certificates, 6 months of financial data, 12 months of pay slips, and a host of other things).

In the end I hosted them myself and phoned them with a password, then deleted them once I'd seen they'd been accessed.

Unfortunately, I have no confidence that they have, did nor will handle all of that information appropriately once they receive it.

How is it not complete insanity to require _that much_ information on someone and _not_ have strict training and liability for managing it?

Between then and now, Firefox Send has come and gone, but fortunately it's open source, so I'll host that if I find myself in a similar situation in the future.

I work in infosec consulting and reversing for 15 years. My identity has been compromised numerous times via OPM, Equifax, and Home Depot, just to name a few. I just don’t care about emailing sensitive docs anymore. I find an alternative if possible, which usually it works. I put in some effort. But realize emailed financial docs aren’t likely how you get owned. It doesn’t feel great, but it is what it is.

E: also, almost everyone I’ve asked will delete the documents after you try and fail to set up an expedient file share. Also, password protected zip files in Dropbox are usually good enough for most everyone and are a very simple system. Just make sure you use modern zip protection and not old crappy Zip crypto :)

Compromised or stolen?

Identity theft can fuck you indefinitely.

Identity theft happened to me once from another person with my same name using my identity to run up credit. It's not that hard to fix, it just takes fighting bureaucracy. They got my info from some lender somehow getting my data and giving it to them. Someone's email spool getting compromised and that leading to identity theft is such a smaller concern compared to all these data warehouses just leaking your data.

Maybe if it goes unnoticed for several years... But even then indefinitely sounds like a stretch.

I've personally had my identity stolen last year and they got a car loan, insurance, and bought a couple iPhones and lines with two different providers. It happened in the month I was closing on my house and getting a mortgage. Yeah it was a bit of a pain but some phone calls, a police report, notarization, and snail mail later and it is off my record and my credit score went right back over 800. Also I was still able to get the mortgage even with it going on.

You can also lock your credit down with the main agencies. I do this during normal times and only unlock when I know I need to secure a new line (such as a car loan or moving)

We don’t chnage credit cards hardly ever. But would need to do it for that too

You better believe I have my credit reports locked now and for anybody reading this I recommend you go do this now if you haven't already (it is free and easy).

I've had to unlock them a few times and I can unlock all three in under 5 minutes.

I also have a fraud alert on my reports now which was only slightly inconvenient when getting utilities because I had to go in person to verify myself (utility companies don't report to credit agencies afaik but they do some sort of identity check through them).

I’ll also add that it’s more convenient than I expected - the three credit bureaus all let you unlock your file temporarily up until a specified date, after which it will re-lock without you having to log back in.

It sounds like you cleaned up one event, but your identity is still owned right, so can’t they buy stuff in your name again? Or how does that work?

I have freezes and fraud alerts on my credit reports so in reality they can't really do anything (unless they also had access to my email, physical address, phone, and the PIN I used to freeze them)

Mostly they were found and went to jail for what they were doing. I guess they could try again if they wanted. I have my credit frozen now though.

The real estate agent we had replied with "but I don't understand why you won't email your documents, we've never had a problem using email to send sensitive documents before and we've done it hundreds of times"

We hear about leaks of user databases all the time now so I'm surprised we don't hear more about mail boxes leaking out. All these small business mail boxes must be an identity thief's dream.

Access to small business mailboxes is used for a “neat” form of fraud; they intercept invoices and change the account details to theirs. It’s a bit of a long-ish targeted attack, but it makes the news now and then.

And the best thing is that with Office 365, you have to pay for obscenely priced license tiers to get access to logs of mailbox activity.

Wanna know if that attacker downloaded all of an inbox? You should've thought of that and paid $35.00 user/month (and that's the lower yearly commitment price) https://www.microsoft.com/en-us/microsoft-365/enterprise/off...

Agreed - there are entire industries that simply have not caught up with secure management of paperwork, PII and financial information. To be frank, I'm not sure how that's possible with all the regulation.

The mortgage industry is shockingly one of these. I just refinanced again after doing it 5 years ago. I was really curious to see if anything had changed in the 5 years. Any advances in basic tech? Was my experience going to be more secure?

Answer: Nope. Still the same old stuff, hard copies of everything, people asking me for stuff via email. Blatant disregard for privacy. Just absolutely terrible.

Multiple times the guy at the bank asked for my banking statements (which include full account number, balances, PII, etc.) and EVERY TIME I had to ask him to resend the link to their secure email portal. Worse - they never even offered secure transmission as an option...I had to ask about that option. It's clearly not the default behavior.

Interestingly, the closing company was lightyears ahead of the bank. They had contracted a SaaS vendor that provided a secure digital document management product focused on mortgage closing, and I was able to e-sign everything (even able to scan in my signature and apply to documents). I mean, this isn't earth-shattering tech, but it sure was one hell of an upgrade compared to the bank. That's what all banks should be providing today; overall it was a far better experience than the bank.

Assuming that you have your email configured to require TLS on the receiver than I don't see what is wrong with email. Even if they downloaded the files from your server they probably just stuck them on some file share which at best is just as secure as their email inbox was. Many organizations have policies for email retention and similar that is less likely to be enabled for file storage.

I would love to see more places just use email. Instead I get these messages with links to proprietary services to get the file. Now I need to download and store it out-of-line with my conversation.

I think the major issue with email is that encryption is optional with transparent downgrading. You can imagine that if it supported something like mailtos:me@example then it could be used as a secure medium, much like https can be trusted today.

Double-comment but check out https://github.com/algolia/sup3rS3cretMes5age

I live in a country where sharing my entire life in paperwork is sadly normalized. Having a self-hosted one-time-secret service for file uploads is so nice.

I know of a reasonably large travel agency that asks their customers to send a photo of their passport, driver's license, and credit card to a random employee's personal email account. I warned my brother against sending them his information and he saw me as the problem.

I have a client that stores similar information in an external HDD in a shared office that a lot of people have access to. I convinced him to let me install BitLocker at a minimum and to allow me to have his computer lock automatically. He had another guy remove full disk encryption because it was a hassle when he moved the HDD around and remove the auto lock because he wanted his secretary to access the computer when he was away from keyboard.

I know an accountant who calls me paranoid when I talk to him about securing the devices that he uses to store tax information about all his clients.

We need regulations and fines because the only way in which people are going to listen about security is if it hurts their pockets.

Luckily there is such regulation in the EU (but it could arguably be better enforced). Are there no such things in the US?

Sort of but not quite.

Sending CC info through email violates the PCI DSS. The PCI is a private organization so noncompliance is not a violation of the law.

There is no unified law across the US that deals with data privacy. Several states are starting to address this problem but there's nothing like what the EU offers.

This is the only thing I still use Dropbox for after moving my files away a long time ago. Set up a password protected folder, send the link over email and SMS them the password or tell them over the phone. Easy peasy.

Yeah, they definitely just attached them to an email they sent to whoever they would have forwarded your email to if you had sent it that way.

You have to assume anything you send can become compromised and then game out what would be the ramifications of that.

Its good you de-risked this somewhat by avoiding email thought, that's a good first step and I wish there was a standard for this.

And after they downloaded your secured file, they probably sent them between themselves over e-mail.

This is why laws like the GDPR are needed.

The GDPR does not fix this at all.

Yes it does. For instance, most places don’t send payslips over email for GDPR compliance reasons.

It does. See for example the Ticketmaster case. They were fined £1.25 million under the GDPR: https://ico.org.uk/action-weve-taken/enforcement/ticketmaste...

A key justification for the fine (see the report eg. sections 6.3 through 6.7) is that "there were multiple failures by Ticketmaster to put in place appropriate technical or organisational measures to protect the personal data being processed on Ticketmaster's systems, as required by the GDPR."

Process data without taking appropriate steps to protect that data and you face being fined under the GDPR.

If the solicitors were acting on behalf of the bank, then they are bound by the contract with the bank. If the bank is a half-decent bank, they have a third-party security risk assessment & risk management team, that audits them regularly.

You are thus covered/protected, because if they (solicitors get hack, leak data, etc) the bank will (most likely) spot this, and move to protect you.

This sounds like wishful thinking at every step.

Whoah plenty downvoting.. I assume that everyone is fully aware of Banks' Third-Party Security protocols/procedures and have good/working knowledge that they don't operate?

Anyway, not wishful thinking. Actual/reality. Feel free to ask your banks about their TPSM.

Good opportunity to see some info: I use BrightTalk (not affiliated) to collect CPEs for my certifications. They have plenty of webinars on Third Party Security: https://www.brighttalk.com/search/?q=%2Bthird+%2Bparty+%2Bse...

Eh, I am in both camps at the same time. I know what you are saying is true in theory, but in practice ability to make money efficiently trumps everything else. Even at bank bank you see people cutting corners for variety of reasons ( and when you see it you have to react ). I can't even imagine how bad it is in unregulated/less regulated industry.

Setting aside everything else, on what basis would they moved to protect you as opposed to protecting themselves? And even even if they are forced to by bad publicity or something, what can they possibly do for you anyway if there’s a leak, other than offer you a useless year of identity theft “protection”?

In other words, I still maintain this is wishful thinking.

Yeah because banks are notoriously good at protecting consumers. “1 year of free credit monitoring” is just to cover their asses but won’t save yours in case of a major leak.

Reply on news.ycombinator.com