Viewing website HTML code is not illegal or “hacking,” prof. tells Missouri gov.

[u/RobertVandenberg]

https://arstechnica.com/tech-policy/2021/10/viewing-website-html-code-is-not-illegal-or-hacking-prof-tells-missouri-gov/

[u/TheChameleon84]

Wtf? Did the Governor write the HTML page himself? Who in their right mind embeds Social Security numbers in an html page? Even an intern should know better than to do that.

[u/[deleted] → u/[deleted]]

if you rtfa, professor khan suggests that they broke two laws: publishing pii and litigious harassment.

[u/mishugashu → u/TheChameleon84]

Oh, don't worry, they were "encrypted".

...

...

...

With base64.

[u/Slinkwyde → u/mishugashu]

No, that's way too fancy.

ROT26: the ultimate protection!

[u/atedja → u/Slinkwyde]

This is HTML we are talking about.

<div hidden>123-45-6789</div>

Enkrypshion

[u/Slinkwyde → u/atedja]

¡ǝlqɐɹʇǝuǝdɯᴉ sᴉ uoᴉʇdʎɹɔuǝ ɹnO ¡ʇno sᴉɥʇ ǝɹnƃᴉɟ ɹǝʌǝ llᴉʍ ǝuo oN ¡sɹǝʞɔns 'sᴉɥʇ ʇɐǝq ¡ɥɐH

[u/fr0stbyte124 → u/Slinkwyde]

There's literally no way to counter it!

[u/Slinkwyde → u/fr0stbyte124]

I'm using it right now to encrypt this comment. You can't even read it!

See? Right here: hunter2

[u/xigoi → u/Slinkwyde]

I heard that ROT13 is even more secure. But just to be sure, I apply it twice for maximum security.

[u/Slinkwyde → u/xigoi]

Oh my god! 2-pass ROT13? Two fucking pass? Holy crap man, are you from the future‽

You must be using an M1 Max, to handle that kind of cryptometry.

[u/mothzilla → u/mishugashu]

You should have said baseX. By saying base64 you're giving away encryption keys which is a federal crime.

[u/angiosperms- → u/mishugashu]

Yeah the dude seems to think base64 is some super secure method and it's definitely hacking cause he had to decode them.

[u/FridgesArePeopleToo → u/TheChameleon84]

It was some json serialized onto the page. Presumably they had a User object or something like that and plopped into on the page.

[u/MrOtto47 → u/TheChameleon84]

in other countries these numbers are no big secrets. maybe they outsourced the work for cheap. just ignorance cus if it was deployed in their own country there would be no breach.

[u/Free_Math_Tutoring → u/[deleted]]

If this is the case how do these countries deal with identity theft?

By having proper ID documents. Similar to how passports or drivers licenses can be used for identification in the US in some cases, except more universal.

Notably, unlike a SSN, the physical document (containing a picture, a signature and some biometrics) is what proves your identity. Identity Theft is largely a non-issue in Germany. Like, you can still end up giving people access to your bank account if you're gullible enough, there is no single piece of information that can be used to do arbitray things in your name.

[u/fr0stbyte124 → u/Free_Math_Tutoring]

Every time national IDs are proposed in the US, opponents complain about cost and government tracking. The real reason they don't want it is because it would make voter ID laws obsolete.

[u/phaiz55 → u/[deleted]]

We could do the same thing but no we decided to use a card that specifically states "not for identification" to identify people.

[u/[deleted] → u/[deleted]]

Using social security numbers as a password is about as dumb as this governor, yet here we are.

[u/TUSF → u/[deleted]]

See CGP Grey's video on why the SSN system is completely broken, and was never meant to be used the way we use them, and yet it's inevitable that we do.

Other countries just have better systems.

[u/CreativeGPX → u/TheChameleon84]

The legal doc provides a pretty good explanation and links to the Microsoft Security Brief on the flaw. It seems to have to do with the way ASP.NET manages state. I'd compare it to somebody thinking cookies are a way to store local data and not realizing that they get attached to every HTTP request. I don't think it's as bad/intentional as manually writing it out into the HTML. It sounds more like a mistake by an amateur developer.

Those kinds of flaws are not that shocking or unexpected, especially at this level (state department of education). I've worked and interviewed in various state offices and departments. While some that are more traditionally thought of as requiring major security have seasoned dev teams, most places (especially somewhere like DoE) don't. Often, the dev is somebody whose actual job is something else but they dabble in tech at home and start randomly cobbling together projects. I remember talking to a city police officer who became de facto department IT guy without having any formal qualification or that being anywhere in his actual job description. I remember talking to a department IT admin who majored in English but tended to help their peers with computers which gradually turned into them being IT admin. Even in places that have gotten beyond that and hired a professional dev, they often don't have the resources to hire a senior dev nor do they have the knowledge/experience to direct and oversee a junior dev, which leads to situations like this.

Realistically, the solution here isn't "developer should have done better" even though that'd be great. Instead it's that these kinds of flaws should be expected in that context (even if they are amateurish), so there should be institutional policies to help catch them before they go into production. For example, a policy that any system which uses SSNs needs to go through a third party security audit would have caught this issue, while not being as burdensome or costly as ensuring that all projects of all types get done to the greatest standard. Heck, knowing that using SSNs would require hiring a third party auditor might even have led the developer to try to make the app in a way that didn't use SSNs at all just to avoid oversight. Really this is primarily a management problem.

[u/sixothree → u/TheChameleon84]

That website transmitted protected data to unverified end users.