Can Authoritative Governments Abuse the Right to Access? - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Can Authoritative Governments Abuse the Right to Access?

Les Etats peuvent abuser du droit d’accès?

Résumé

The right to access is a great tool provided by the GDPR to empower data subjects with their data. However, it needs to be implemented properly otherwise it could turn subject access requests against the subjects privacy. Indeed, recent works have shown that it is possible to abuse the right to access using impersonation attacks. We propose to extend those impersonation attacks by considering that the adversary has an access to governmental resources. In this case, the adversary can forge official documents or exploit copy of them. Our attack affects more people than one may expect. To defeat the attacks from this kind of adversary, several solutions are available like multi-factors or proof of aliveness. Our attacks highlight the need for strong procedures to authenticate subject access requests.

Dates et versions

hal-03957151 , version 1 (26-01-2023)

Identifiants

Citer

Cédric Lauradoux. Can Authoritative Governments Abuse the Right to Access?. Annual Privacy Forum 2022, Jun 2022, Varsovie (PL), Poland. pp.23-33, ⟨10.1007/978-3-031-07315-1_2⟩. ⟨hal-03957151⟩
29 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More