The DMZ

Benoit Esnard

8:50 AM

Ohai

Can I ask "Can I request a copy of my password hash thanks to GDPR?" here?

(here = sec.se)

Anders

9:00 AM

@BenoitEsnard Don't know if it's on topic, but damn, it's an interesting question. I hope the answer is "no", but I honestly understand nothing about GDPR.

@M'vy Quick, say something! You are off the wall again.

Benoit Esnard

I think I'll ask it on legal.se

This has basically nothing to do with security, I guess

Tom K.

@BenoitEsnard yeah, I think so too

you could ask "is my password hash available to me because of the GDPR and what implications has it if it is?"

something like that

wow, so many GDPR questions there

Benoit Esnard

9:33 AM

0

Q: Can I request a copy of my password hash with GDPR?

People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since they could identify its owner. If a website doesn't follow best practices regarding password hashi...

Asked

(if you know how to make the question better, feel free to suggest an edit)

(i don't know the specific rules of law.se, and my English is far from perfect)

Kepotx

good question indeed

Benoit Esnard

Accoring to GDPR: law.stackexchange.com/a/27521/4616 passwords must follow good practice

So I guess someone who wants complying with GDPR will have correctly hashed passwords

Kepotx

so, one could have the 4% fine if not hashed correctly?

Benoit Esnard

I guess so. :)

Kepotx

I wonder how could they decide if it's secure enough

like, have the judge some formation in this case ?

Benoit Esnard

9:39 AM

I guess so²

GDPR is quite technical imo

(I mean, compared to the majority of other cases)

I'm not a law person though, so I don't know what I'm saying :)

Kepotx

gosh, half of the new law.SE are gdpr tag

do you know la quadrature du net? They did quite good work explaining this kind of things

Benoit Esnard

That's good.

I guess 90% of people who asked them didn't even know the previous laws. :)

Yeah, I know them

Are you French? That's the 2nd time you're referring to a French website haha

Kepotx

yes I am

and I also guess you are given your name

Benoit Esnard

I'm from Toulouse indeed

Benoit Esnard

10:45 AM

New answer on my question:

1

Q: Can I request a copy of my password hash with GDPR?

People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since they could identify its owner. If a website doesn't follow best practices regarding password hashi...

european-union gdpr

Anonymous

11:02 AM

It strikes as odd a password is not considered "personal data"

Anonymous

If it is not personal data, what is it?

Anonymous

Law is too complicated >.<

M'vy

11:25 AM

@Anders :)

5

Anonymous

Benoit will you hate me if I say I thought you were Spanish?

Anonymous

Please don't hate me. I genuinely couldn't tell you were French.

Benoit Esnard

I have no reason to hate you

Why did you think I was Spanish, out of curiosity?

I'm not convinced with the answer, as I think my question explained why I think it's personal data. :/

Kepotx

12:20 PM

@JoshJones secret != personal

by personal data, it mean that I can know who you are

Anonymous

I have no idea why I thought that Benoit I just did lol

Anonymous

Yes but I still feel like a password is personal data...

Kepotx

Let say someone don't want to share his true identity and choose "DarkAngel64" as nickname. His adress, IP, or even more his real name are personal data, if knowing them can make a link with the real person behind this nickname

but nowing his password is correct horse battery staple will not

the thing Benoit say is that sometimes, password are made with personal information, so if his password is 'MyRealNameIsBenjaamin", it become personal data

Benoit Esnard

If his password is BenoitFromFrance, then it's personal information

Also, it's way too often unique per user

I mean, if I know that someone has d3348f7144207676b29c2ae18016710b as MD5 hash

Kepotx

well, "12345" or "password" are not personal

Benoit Esnard

12:31 PM

I can know with a good confidence that any other user with that same hash is the same user

Well, not all passwords are, for sure

Anonymous

Still. I think a password is personal.

Anonymous

Most people use the same password everywhere.

Anonymous

It seems senseless not to not class it as a personal information

Anonymous

But thats the law I guess so.

Benoit Esnard

12:50 PM

Well, I will wait for other answers I guess

reed

just posted mine

My interpretation of personal data always seems to differ from those I read on the net. I believe the law says personal data is data associated with an identifiable person, not only data that is used to identify them

Benoit Esnard

Thanks for answering!

> Sending the hash to you might actually invalidate their security policies, standards, or practices, because it doesn't sound like it's a great idea to communicate a password hash to a user.

+1

Kepotx

1:13 PM

@reed well, law can be interpreted in diferent way, and also be diferent between countries, so we can all have our diferent definiton of personal data

reed

@BenoitEsnard hashes, if done correctly, shouldn't be the same even if the password is the same, because they should have a different salt

Benoit Esnard

If done correctly, yes.

I think we all know how many people don't hash correctly. :(

reed

for the real truth about GDPR, I'm afraid we will have to wait from 6 months to 1 year

or even more, who knows

Kepotx

as I say in the other answer comment, knowing how they hash your password give you the information of how secure your password is, but it's the only utility of knowing your hash. and I agrre that it invalidate security, so probably not worth it

but it could be a good Idea to know how they hash your password before you subscribe

reed

I don't think you have the right to know the details of the software. Unless the software is open source, then yes, they must give you the code if you ask them

Tom K.

1:24 PM

@BenoitEsnard Why don't you just request your password hash from a site that falls under GDPR? :)

Benoit Esnard

Because every website I know interprets GDPR differently

reed

a more funny thing would be to ask facebook to provide you all the information it has gathered

Benoit Esnard

1:41 PM

"please just send me your SQL backups"

reed

2:00 PM

I need to find out how to erase the contents of my external HDD and USB flash drive, but the usually recommended "secure erase" requires the devices to be connected via a SATA connector, if I'm not mistaken. Both of my devices only have the USB connector

so I guess I'm left with the only possible solution: overwrite with random data. Should be better than nothing

and then I'll encrypt them with LUKS, so I won't have the problem of securely erasing in the future

Tom K.

6:05 PM

@reed you can do that if you have an account

reed

Luckily I don't, lol

Tom K.

wired.com/story/download-facebook-data-how-to-read

this story has some good stuff on what is in such a report

reed

6:20 PM