In the US, our 4th Amendment to our Constitution protects us from any illegal searches and seizures, by making sure that the government requires a warrant to get hold of our possessions.
Now, take ownership of that data, and apply it to any investigation of the user. So while they may not be able to decrypt that hash, they would still have some entry (read: metadata) into where that password may be applied so who says they couldn't try to use that username and password at the site in question, to gain access to whatever is there, after the contract with the user has ended? Again, those issues still abound. However, when that contract is terminated, the SaaS provider is still in legal ownership of that data, to do with it whatever they please. Granted, they have entered a legal contract with the customer that binds them to what they can do with that data, but the situation exists. Legally, they could delete them, sell them, whatever they want with them, as they are the owners of it. So as it has been judged that the SaaS provider owns the passwords and password hashes that are in their physical possession, they can do whatever they please with those passwords and hashes. The courts agreed, so currently the law states that the person/business/entity who is in physical possession of that data is the owner of that data. *Facebook went to court over the question of if Facebook owns any data that a user has and uploads to their platform.
But let's again ask the question: Does the password - let alone the password hash - at the SaaS provider belong to you, or to the SaaS provider? According to the Facebook rule*, it belongs to the SaaS provider. True, hashes mean that the SaaS provider can't even read or decrypt those hashes to reveal your passwords. Here's a good example, and I'll apply it to here in the US (check local laws/regulations for similar laws in your home country). Where SaaS providers have a problem is with the legal aspect.
0 kommentar(er)
