0

I have unregistered users on a site, I want them to be able to enter their name and date of birth (DoB) and see if they are in a database.

The act of being present in the database is somewhat sensitive information. How can I reduce the risk of curious third parties from looking up other peoples' information?

I was thinking an additional 2FA identifier such as an email address or phone number could be used in the following steps:

  1. Check that the user controls the email/phone with an email/SMS verification code
  2. Match in the database on NAME+DOB+EMAIL/PHONE

Unfortunately, the email and phone information is only partially populated in the database, meaning the lookup will return many more false negatives than matching only on name and DoB.

Is there any better solution to this problem?

Improve this question
1
  • If only name and dob are stored, the interested party would have to prove their name and dob to you prior to obtaining an answer - perhaps by a fax of an official id document or birth certificate and manual checks on sour side. Yes, that does not scale, but that's owed to the lack of the 2FA possibility. -- Then again, how is presence in the DB proof of it being the person in question who ought ti be in the DB in the first place? If "John Doe, 1.1.1970" is just some unverified data people entered by random users in the first place, a record "John Doe, 1.1.1970" won't mean it was John Doe
    – Hagen von Eitzen
    Nov 23, 2018 at 6:30

2 Answers 2

Reset to default
1

Contact Information present

You have their e-mail or phone number in your database ?

If so, send any information to that contact information and only display a generic "thank you, if you are registered with us you will receive a confirmation to your registered contact information" message on the website. This message is always the same no matter if the user is in the DB or not.

In fact, to thwart timing attacks you should display the message and exit, and do the lookup and sending of mail or SMS in a background batch process.

Rate limiting, etc. was already mentioned, definitely recommended.

No Contact Information

If I understood correctly, you also have users without any contact information. These guys are tricky. The problem is that name and DOB are not secret information in any way. For most people, it takes minutes to find them out, and any skilled attacker can probably find them within an hour for 99% of people.

You need at least some additional information that is more difficult to find out and can work as a shared secret. That is the reasoning behind the various "mothers maiden name" or "name of your first pet" so-called security questions.

If you don't have anything else, there is no secure way to check. In this case you need to make those users identify themselves in some trusted way, e.g. by going to a physical location and showing their passport, or showing their passport on a webcam or some such step, depending on the sensitivity of the data.

This is a fundamental issue that you cannot solve with technology or math, because there simply is not enough non-public information present.

So check if any of the other fields stored in that DB can be used as identifying information.

Improve this answer
0

Use the same process as "forgot password".

If there is at least partial email information, then ask the user for:

  • name
  • DoB
  • email

If the email satisfies the partial match along with the rest, then send an email to that address with confirmation that they are in the database.

The message you display to the screen is simply: "if you are in our database then an email will be sent to the above email address".

And add in severe rate limiting, time delays, and CAPTCHAs on queries to prevent brute forcing.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .