Slashdot Mirror
Privacy Breach In Canadian Passport Application Site
Joanna Karczmarek sends us news of a massive privacy breach in the Government of Canada passport website. "A security flaw in Passport Canada's website has allowed easy access to the personal information — including social insurance numbers, dates of birth and driver's license numbers — of people applying for new passports. ... The breach was discovered last week by an Ontario man completing his own passport application. He found he could easily view the applications of others by altering one character in the Internet address displayed by his Web browser."
Odd's are, lots of people are applying for passports nowadays too, since apparently we Canadians need them to cross the border into americaland in the near future.
3...
2...
1...
Breaking News, a L33t Canadian Hacker broke into a national security site, stealing millions of Dollars worth of personal information.
No word yet on any arrests.
More at 11.
Just -1, Troll talking to another.
That's some leet hakking going on there...
http://www.freedom-to-tinker.com/index.php?p=780
http://www.tjmcintyre.com/2005/06/morris-tribunal-learns-pitfalls-of.html
http://blogs.zdnet.com/threatchaos/?p=464
When they came for the communists, I said "He's next door. Take him away. Goddam commies."
Sounds like some web monkey needs a beating....
I wish I was clever!
Comment removed based on user account deletion
I wouldn't say Americans are that bad at English...
Real Daleks don't climb stairs - they level the building.
http://www.cbc.ca/consumer/story/2007/12/04/passport-security.html?ref=rss
Irresponsible name to have these days.
biopowered.co.uk - catalytically cracking triglycerides for home automotive use since 2008. Just say no to big oil!
I'm guessing the database the info comes from is not even encrypted. One could come up with half-a-dozen schemes to prevent this. Here's one: every sensitive record in the database is encrypted with a unique key that is mapped to each session via a very long random number generated on a per-session basis. This random number would be used to decrypt the information in the database (combining, of course, with a server-side key to reconstruct a "permanent key"). So each client-side key would be able to decrypt one and only one sensitive record, making a one-session to many-record scenario impossible. Key-pairs would be generated on a per-session basis from a database of permanent keys that are themselves encrypted and served by a key server. I hereby patent this protocol. Please send me money if you use it or I will sue you.
Just callin' it like I see it.
I havn't looked at the article, but I doubt that's going to help against someone determined. Sure - Joe Blogs who found the bug this time probably wouldn't have, but that's just an URL encoded string, which are trivial to decode (I believe PHP has an urldecode function for just that).
Never, ever, trust data provided by the user. If there's potential to cause trouble, somebody will do it, which is why the site should have been keeping track of who's application was being filled out on the server, probably in a session variable.
This is not just a moan - it is a serious question.
In the UK, every large computer project since the Navy sponsored the Babbige engine seems to end up running hugely over budget and time, and often delivering nothing. Often, many of these projects could have been done on standard equipment from the high street shop. Remember the 10 lb military wearable computer and radio that did little more than a mobile phone? The recent leak of disks with 25 million UYK residents' personal information, most of which was not wanted by the people it was going to was not removed because that was 'too labour intensive'. A few lines of perl, tops. If they want to send discs, then can send discs of random numbers, and do one-time pad encryption. If you have a proper source of random numbers, then provided the discs arrive with the seals intact, they can send the actual data XORed with the one-time pad. Not exactly rocket science, any of this.
The usual explanation is a lack of market forces. State projects tend to get offered to contractors with vetted personnel, contractors who have done similar projects before. If you have a military requirement then your choice is restriced to positively vetted people who don't mind working on such stuff. Certainly, in the UK, there seems to be a cosy relationship between the state and the contractors. I am not sure I altogether buy this explanation. If there really is a free market, then more talented people ought eventually to come to the top if the contracts are so lucrative,
Perhaps the problem lies with the national interest. The UK government would have to prever UK companies to overseas ones. Sometimes the competition has to come from outside a country. 20 years ago, prescription glasses used to be expensive and took a week to arrive. If you were going to the US, you could take your prescription, and get a pair made in an hour. Now you can get the same service in the UK. In the US, it is hard to get a mobile phone unlocked - it is looked on as illegal, but in the UK this is commonplace. IN both cases, I don't think there was anyhing that was actively preventing competition: it just wasn't happening.
As a fourth generation Canadian, I too have met a large number of Canadians. While I have no intention of defending the AC, I resent the absurd generalization that Canadians are uneducated and racist. With any large sampling of people, you will encounter the good and the bad. I am sorry to discover that you have clearly encountered only the bad, yet you are a sample of one.
I work at a company with fifteen employees, representing eight distinct nationalities and we operate in perfect harmony. This place is not anomalous; I have lived through several similar situations at other companies.
However, I am also a sample of one. Let us look at statistics. Immigration accounted for two-thirds of Canada's population growth in 2006/2007 (http://www.statcan.ca/Daily/English/070927/d070927a.htm/) and has always been a significant contributor to our population (http://www40.statcan.ca/l01/cst01/demo03.htm?sdi=population%20growth/).
Does this trend pose difficulties? Certainly. However, were such a policy not embraced by the majority of Canadians, it certainly would not persist. The tolerance is real. Join us and see for yourself.
ObXKCD link: http://xkcd.com/327/
Help! I'm a slashdot refugee.
Having being a civil servant in the past, I take great exception to your comments. In the 10 years I was with the provincial government, I was only able to attend one outside training session. Being in a smaller province, where training *rarely* came to, most training would require travel (typically to another province) which would never happen. I financed most of those out of my own pocket with no reimbursement. You make it sound like I had a free ride, and a free lunch, with all the extra toppings. It is not. I was refused to attend a conference in Vancouver that was specifically on what I was implementing within the department, because it was too "close" to Whistler/Blackcomb. WTF?!?!?!? The reason? The perception would be exactly the crap that you are spewing.
With regard to the union, they screwed me more than they ever helped me. Ever play the "temporary" position game before? They prevented me from getting the "job" as I didn't have the seniority. Nothing worse than filling a position for 8 months and having someone that is completely incompetent that I had to train for the position, all because they had "more time in." The preventing me from getting a better position, because I didn't have a "degree" that was required for the position, yet I was the one that trained the "degree people" for the position. Go figure eh? The union prevented me from being paid what I was worth because the position that I had, didn't reflect the duties I performed. None of the union positions were accurate in this regards. The union screwed me more than they ever protected me. Don't make them sound like they are the golden cup.
I have since gotten out of government, and went over to private sector, with a larger IT consultant company. This was no better, though I was able to get training very easily (x amount per year) and it didn't matter where it was (I attended something in Vegas, which would have never happened within gov't. While there were some benefits, working 12 hours, getting paid for 8, yet billing for the 12 got tiresome really quick.
Government, private sector, independent contractor doesn't really make a difference. In this consumerism driven society, with the corporate mentality to do more, more, more with less, less, less, is what drove me out of the IT industry. And don't get me started on the politics... Gov't or not, the politics are what really wreck things.
From your point of view, the grass may look greener on the other side of the fence, but look where the green grass is; Odds are it's right over the leaking septic tank. Make sure you check the ground before you start grazing.
I'm not saying there aren't some that have ways to abuse the system, but it's not as common as you portray. There are projects out there that are just as bad, except you don't hear about them. Banks, credit card companies, and private sector is just as bad, except, you don't hear about it, except through the network with people within the fields. It doesn't get out there publicly.
I've since turned my back on the entirety of the whole IT industry as a career. There is absolutely no enjoyment in it anymore. As a hobby, I still love it though.
Your spewing the FUD of a stereotype that perhaps may have some truth to it. But that truth you are spewing is the exception, rather than the rule. There are good people that work within the civil sector. And have worked on both sides, one is no better than the other.
Cheers,
Xyst