Hacker News Reader

Comment by theCrowing | Hacker News Reader

No, we don't it's mostly assertions and I hate it. We don't know about how these two machines were used and were they come from despite ebay. The whole release should have used way less absolute wording because in the end the CCC could look like a clown show just because of assumptions.

View on HN

What more do we need to know? The devices were found and they contained unencrypted and unobfuscated biometric data. There's so many things about these devices that should never have happened at all.

Absolutely right but the fact still stands that we have no valid data to paint it as a fact that the data of the entire population is compromised. It's a communication 101 that you never communicate in absolutes if you can't verify your findings.

Skimming a couple of the sources mentioned in the article and the linked german government Q&A it seems they scanned a) collaborators and b) "potentially dangerous" afghan citizens.

So we can reasonably assume that biometric data of those two population groups was leaked by left behind devices. Not the entire population, but the two most sensitive groups. Sounds pretty bad imo.

As I said before you are absolutely right it's fucking bad and repulsive but you can still communicate facts without making assumptions especially with a serious topic like this.

Reading this polite exchange I couldn't help but be reminded of the classic: https://youtu.be/3m5qxZm_JqM

Glad we're all nice to each other in this corner of the web!

Not a fact, but highly likely, since due diligence was obviously not applied. Thats enough as a hint what else might be not discovered yet.

> It's a communication 101 that you never communicate in absolutes if you can't verify your findings.

Even "Der Spiegel" or the Washington Post would dissagree on this statement.

If the data being available in cleartext on devices anyone can buy online isn't "compromised", I'm not sure what would be.

I think the point he wants to make is that the biometric data itself is raw and nothing about it is "tagged" to discern between collaborators and common people, nor is it circumstantially implied that all of the data belonged to collaborators, because all of the population - not just collaborators - were catalogued. For some reason people seem to immediately jump to the conclusion that a) every collaborator is now at risk, because b) this raw data is functionally identical to the final processed and augmented database that was built using this raw data.

In the end people could get killed. It this case it's better to assume a worst case scenario

Reply on news.ycombinator.com