pull down to refresh
I wonder how many EU employees have access to an email address to which financial institutions are legally obligated to provide customer KYC data. Clearly, at least one of them was compromised. I certainly don't believe that no other email addresses are compromised.
Also, this went on for five months!
It really is astounding to me that lawmakers do not see the trainwreck they are creating when they continue to require ever more KYC. And for what? So they can catch some criminals...usually who have already committed some other crime which the state was incapable of preventing or successfully prosecuting them for.
Is law enforcement's reasoning: "look, we are really bad at our job of preventing crimes like human trafficking and ransom and all kinds of other things, and we don't have any way to actually catch people who commit these crimes, so what we are going to do is ask you all to take on a huge extra risk and expose your personal identifying information and financial details to millions of other people so that we can hopefully identify some of these criminals we failed to catch. Oh, and we don't know how to keep it secure. And we will hold you accountable if someone else uses your information to do something we don't like."
God damn. This system is broken.
at least one of them was compromised.
How I read it, that was low effort and more than one.
It's not even about the number of employees per se. You need one then you can privilege escalate inside azure/outlook because MS Azure, at least in the EU, rarely patches fast, and throws out many issues as "not-a-bug". The entire EU (and almost every national govt inside the EU) runs more than 70% of their infra on Azure. So within that environment, you basically only need to get in once. I've been given 2 demos in the past 18 months of what it's like on Azure mail servers in terms of exploitable "not-a-bug"s, and it's not pretty. So all you need is some dude with a login, or even hotter and concurrently easier targets: sysadmins.
The main issue is digital systems security across the entire chain. It's not just some Estonian regulator (or the DMV) that has poor security - that's just low hanging fruit. Everyone has poor security, even the people with high-end security, because the chains are interdependent and all you need is one weak link. That's why I claimed that after Bitcoin comes the banks. And here we are. The guy didn't even have to hack the bank.
law enforcement
I know a bunch of people in LE and the honest, knowledgeable, hard-working people among them are often as much against this crap as you or I. Same goes mostly for the few natsec people I know, on both continents. They're often very much aware of how poor the systems are, how bad the requirements were at the start and how even these were higher standards than what got delivered. In all aspects really, because it's not just security, it's also in the breadth of effectiveness of what these systems were intended for.
This system is broken.
Most of these ideas come from people that want to be re-elected / re-appointed their next term and thus cannot "look weak" by not addressing something for the sake of keeping the greater evil out, because it will be narrated against them no matter what. That means that we get completely leaky mandatory processes, that can often not be enforced and often cannot be secured without trustmebro bullshit. The KYC crap is one of the things where this is going very wrong very quickly now. It's not much worse in Europe than in the US tho, as the prescribed chains of information dissemination have, especially since 2020, been heavily maldesigned everywhere. I've since then worked on projects on both sides on the Atlantic where PII non-confidentiality is mandated rather than stricly forbidden.
Everyone has poor security, even the people with high-end security, because the chains are interdependent and all you need is one weak link.
I find this really depressing. The sense that if I have one weak link in my security, it's all for naught is scarily apparent to me in Bitcoin. But I know that much of my life is even more exposed. I'm not looking forward to navigating all this in the coming years.
It really is astounding to me that lawmakers do not see the trainwreck they are creating when they continue to require ever more KYC.
...oor, alternative hypothesis: it was on purpose and they knew precisely what they were doing
but how does this mess benefit them? At this rate, kyc data will be so freely available that it will be entirely useless. So what's the play? Push us all towards biometrics?
no clue. I don't really believe it, either.
Can't square this with anything else than malice. Stupidity and oops just doesn't seem to cut it
It doesn't take inside information to figure out that they're clueless though. But since you're a prestigious scholar and all, I'm sure you can get your butt into a Brussels expert group and report for us.
Maybe we can ~DIY you some spy cams and make a video show out of it. Undercover Stacker.
that'd be insanely fun
I had a call with someone today who (correctly) asked me why I was sounding hesitant to talk to them, and whether I didn't trust them. I told them that because they report everything I say into their Salesforce database, it is not a matter of trust towards them, but that I don't trust their security. Thus, we're communicating on "what in the movies they call a need-to-know basis".
They got pretty pissed at me.