The data was encrypted and protected with a password, according to the city.
The data was encrypted and protected with a password, according to the city.
The city name is Amagasaki. Everyone on Twitter is guessing the password was "Amagasaki2022"
But … while it’s possible, I think we all know they probably just stored it as plaintext :-D
It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand).
The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.
It's a useful vector for things like malware because an intermediate scanning service can't examine the attachment without having both emails. If there's a concern about some PII or whatever being intercepted in transit, it should help with that too.
I gave up on PGP, and most of my clients and I don't have an e2e encrypted chat or password manager service in common.
But at least I tell them to use a "burn after reading" post on an encrypted pastebin like 0bin.net for the secrets thing to send me.
It adds almost no complexity, best case scenario, you increase the security against bots since they would need to parse the link, visit the paste, trigger the Burn After Reading feature, interpret JS, extract the password and use it. That's already a pretty specific bot.
Most interceptions, even human, will be detected thanks to the burn after reading. And the password is never stored in the pastebin db since it's encrypted client side.
Worst case scenario, it's the same than a plain text email. Not much to loose.
It's easy to teach. Requires no install, little skill or tech, works in most corporate setup.
It's not good security. But it's better than abysmal security.
It's pretty clear in my travels that there's good and bad in pretty much every culture and every country, and that you should focus and celebrate the good while being highly aware of the flip side of things that might be an issue if you are blind to that.
Incident response always ends on "lessons learned" and it's rarely productive to hide the facts due to political embarrassment. Earliest disclosure also mitigates against much bigger liabilities as a consequence of a leak.
> management above should be fired and prosecuted.
And be immediately replaced by management with the same level of understanding and responsibility.
> Haven’t these fools realized...
No. And this is the key point. The biggest thing by FAR in cybersecurity is education. Ordinary people do not have any working model of the threat landscape and basic operational security because they foolishly, blindly trust technology and services providers.
We literally need a second digital literacy revolution. One that undoes a lot of the naive and trusting enthusiasm for digitalisation that we inculcated in the 80s and 90s. Unfortunately that goes against the grain of almost every policy that's active out there today.