GDPArrrrr: Using Privacy Laws to Steal Identities

on YouTube ↗22m

" summary

An experiment treats GDPR's Right of Access as an attack surface, sending 150 right-of-access requests via a Python script while the attacker knows only name, guessed email and phone. Results show 83 organizations actually hold the target's data; one-quarter of organizations handed over personal records on email/phone proof, 16% accepted weak forgeries, ~40% demanded strong proof, and a few returned SSN, DOB, travel history, partial card digits and breached passwords used to log into accounts. Recommendations include stronger verification, third‑party identity checks, and clearer legal guidance.

AI-written summary · about

" chapters (20)

1. 0:00Intro
2. 2:16Agenda
3. 2:46Why GDP
4. 3:06Fear
5. 3:19Bad Decisions
6. 3:38Time Pressure
7. 3:59Flexible Language
8. 4:56Right of Access
9. 5:11Right of Access Process
10. 5:57Letter to Organizations
11. 7:00Reasonable Measures
12. 8:10Three Bad Options
13. 9:10The GDPR Process
14. 11:10Forms of Identity
15. 12:54Example
16. 18:13Proposed Bill
17. 18:48Online Businesses
18. 19:33Legislators
19. 20:22Data Hygiene
20. 21:05Conclusion

" related talks

• 22mPersonal Information Leakage by Abusing the GDPR 'Right of Access'Mariano Di Martino · SOUPS 2019
• 52mDeveloping privacyGlenn F. Henriksen · NDC Oslo 2019
• 41mIllegitimate Data Protection Requests - To Delete or to Address?Larisa Munteanu, Mark Povey · Black Hat Europe 2023
• 23mdev.privacy: GDPR in a nutshellEvan Tedeschi · Codemotion Rome 2018
• 49mPractical privacy: GDPR explainedMarcus Bointon · Craft Conference 2019
• 56mPractical privacy - GDPR explainedMarcus Bointon · Dutch PHP Conference 2017
• 48mThe impact of the GDPRMichael Demey · Devoxx Belgium 2017
• 40mHow the Identity Portions of CCPA Regs Put Consumers and Businesses at RiskJeremy Grant · RSAC 2021