8 ms·
Disqus Demonstrates How to Do Breach Disclosure Right
- aidos 9y agoIs this correct though? I had the email from Troy saying my email was in the breach but I haven't heard anything at all from Disqus...
- r3bl 9y agoYes it is. Here's the official Disqus statement: https://blog.disqus.com/security-alert-user-info-breach https://blog.disqus.com/security-alert-user-info-breach According to it: > As a precautionary measure, we are forcing the reset of passwords for all affected users. We are contacting all of the users whose information was included to inform them of the situation. They even give a shoutout to Troy right at the end of that article.
- aidos 9y agoThanks for the link. This reply to a comment on that page gives the information I'm missing: > "We are currently in process of emailing all of the impacted users directly. Getting all 17.5 million emails out will take us a few days, but we wanted to get this disclosure post out as soon as possible. Additionally we've posted links to this disclosure in our publisher admin panel, user homepages, and on disqus.com."
- r3bl 9y agoHey, it's kind of appropriate that you find what you're looking for in the comments section on an article from the commenting platform itself. :)
- jlgaddis 9y agoIn a previous discussion here on HN, there were several folks who claimed that they were (or should have been) affected that did not receive an notification from Disqus but did receive a notification from HIBP.
- masklinn 9y agoAccording to their statement[0], they have 17.5 million emails to get out. Unless they routinely send several times that volume daily, they'll have to batch the notifications over the next few days or the entire thing will get blackholed. [0] https://blog.disqus.com/security-alert-user-info-breach https://blog.disqus.com/security-alert-user-info-breach > We are currently in process of emailing all of the impacted users directly. Getting all 17.5 million emails out will take us a few days, but we wanted to get this disclosure post out as soon as possible. Additionally we've posted links to this disclosure in our publisher admin panel, user homepages, and on disqus.com.
- shalmanese 9y agoTheir entire business is sending out emails to notify you when someone has replied to your comment.
- cisanti 9y agoI have two accounts, both infected according to Troy's site, but zero emails. Just double checked. One account is the owner of several sites that use disqus too! And few bigger ones.
- StavrosK 9y agoWhile we're on the subject, is there an alternative to Disqus that doesn't load three terabytes of stuff and have all the social-engagey functionality? I just want something that does comments.
- ploggingdev 9y agoYes, I built Hosted Comments ( https://www.hostedcomments.com/ https://www.hostedcomments.com/ ) for the reason you mentioned as well as privacy concerns with ads and tracking scripts. Demo here : https://www.ploggingdev.com/2017/08/building-a-disqus-alternative-part-1--research/#hosted_comments https://www.ploggingdev.com/2017/08/building-a-disqus-altern... But the catch is that I don't have a free plan (yet) since I can't make any money off of users on the free plan. If you're interested though you are welcome to sign up and use the comments system for free. I can offer a few fellow HNers free access as a thank you to this community. If you decide to use the comments system, just send me an email to let me know so that I can mark the account as being on the free plan.
- geostyx 9y agoI'd love to see a $2 plan for blogs just starting out with <20k views. Right now 90% of the views I get are my own and I haven't gotten any comments on Disqus yet.
- archildress 9y agoSeconded.
- KajMagnus 9y agoHave a look here, another embedded comments alternative. I'm looking to charge $2, + it's open source. Scroll down to the bottom, https://www.kajmagnus.blog/new-embedded-comments/ https://www.kajmagnus.blog/new-embedded-comments/ (The underlying discussion platform: https://www.effectivediscussions.org/ https://www.effectivediscussions.org/ ) It has some cool features that people at HN might like: https://www.effectivediscussions.org/-32/how-hacker-news-can-be-improved-3-things https://www.effectivediscussions.org/-32/how-hacker-news-can... (but I haven't ported all that to embedded-comments yet)
- DougWebb 9y agoI got an email, despite never having set up an account. I was able to reset my password and delete the account though. Before I did that I looked through the profile and settings, and it was completely blank aside from my email address. I'm assuming one of the many people who use my gmail address by mistake tried to sign up with it.
- PakG1 9y agoThis is the primary reason why I switched to using Fastmail with a custom domain. Sick and tired of other people using my email address for stuff, or worse, their friends regularly emailing me to organize get-togethers.
- stevekemp 9y agoThat won't help, I've had a "custom" domain since 1999. I still have people sign up to random services using my email-address.
- PakG1 9y agoHaha, I guess I'm also not publishing my email address anywhere as much as I can? I imagine that eventually the "secret" will get out, but at least I'll no longer have random generators using my email address? Don't rain on my parade, man, it's been quite peaceful over the last half year! :P
- christophilus 9y agoWith FastMail, you can create unlimited (I think) aliases, so I've started creating one per service I use. I think this is a reasonable approach, though a bit of a pain. I only give my personal alias out to close friends and family.
- dasil003 9y agoTry having a common name at gmail and you'll realize that in fact you are wrong, whatever problem you have at your own domain is peanuts in comparison to that nightmare.
- ComodoHacker 9y agoWould their reaction be so swift and competent if it wasn't Troy but someone with no name?
- spydum 9y agoThat level and timeline of response tells you a great number of things, regardless of the source: 1) they had a plan for breaches (it would be hard to cover all the ground without one) 2) they had technical controls/capability to respond (mass password reset) 3) they had clear and direct accountability all the way up to ceo Other than not having detected the breach, and using not-the-best (but not entirely the worst either) password storage, I don't know what else you could ask for.
- megous 9y ago> The breach dated back to July 2012 but wasn't identified until years later when the data finally surfaced. Not everything is rosy. They didn't notice unauthorized access for 5 years.
- megous 9y agoI have my mail in the breach, yet I don't have an account. Perhaps I've deleted my account after 2012, but don't remember it. Will be interesting to see if I receive email from them, despite not being a user anymore.
- notzorbo3 9y ago> They provided details - the passwords were salted SHA1 hashes which is not a pretty story to tell in this day and age, but they told it truthfully regardless The leak is from 2012, which might explain SHA1 usage. It should still have been something beter, even for that time, but still. Anyway, I think it's pretty hilarious that we're now patting companies on the back after leaking 17.5 million user details. Not that Disqus' disclosure wasn't text book. Just that it's now so normal for companies to leak things all over the place that we actually have Best Practices for what to do when (not if ;-) that happens. Personally, I don't register with my real name and email anymore, anywhere. It's a bit of a pain in the ass sometimes, but worth it.
- DarronWyke 9y agoIn the land of infosec, it's always "when" something happens, not "if". You do your damndest to shore up defenses but a breach is inevitable.
- graystevens 9y agoAs someone else said, it’s “when” not “if” when it comes to security. You could have the best defences possible, but all it takes is a vulnerability in something public facing, like a zero day (looking at you Equifax and Struts), and you’re instantly at risk. Plus, this is ignoring the easiest option... just spear phish the employees, won’t be long before you get a catch or two. Breaches are inevitable, it’s all about spotting them early and minimising their impact. Oh and strong hashes help :)
- jjnoakes 9y agoI don't agree. With proper design a zero day in a web-facing framework should not automatically expose a full database of sensitive user information to the internet.
- korzun 9y agoYou can't compare a Disqus (commenting engine) to Equifax. I would also argue that disclosures on a broader set of systems, with multiple security layers, would require a lot more time. The Equifax situation demanded complete top to bottom sweeps by internal and external resources. Not a good idea to communicate anything, that's a non-fact externally at that point.
- feelin_googley 9y ago"Less than a day earlier, they had absolutely no idea what was coming yet they managed to pull all this together in record time." How is he sure that they had no knowledge? What if they knew but were just waiting for someone with a blog or a Twitter account to make the "discovery"? In any event, none of this would have happened if email addresses had not been collected. There is no need to collect email addresses in order to allow internet users to post comments. Requiring email addresses serves no benefit to the user. It is just more gratuitous data collection. Data which eventually becomes the subject of yet another "data breach blog" entry.
- philh 9y ago> It serves no benefit to the user. Persistent identity -> password-protected account -> email for recovery. I certainly wish more places would make email addresses optional, but there is value in collecting them.
- EpicEng 9y agoWhy do I care about any of that? I just want to leave a comment on some random blog and maybe read a couple of replies. I have backed out of commenting numerous times because of this nonsense.
- philh 9y agoIf you personally don't care, then it provides no value to you. That's fine. In that case you can hope that the blog allows anonymous commenting, which the blog author may or may not want to provide for various reasons. And I would hope disqus offers them that choice. But even if it doesn't, there are many users who are not you and whose commenting patterns are not yours, and email collection still adds value for them.
- EpicEng 9y agoI imagine very few users care about having a Disqus account. It's not a feature intended to make the user's experience a better one.
- RachelF 9y agoPerhaps it is co-incidental, but disclosing the results at 4pm EST on a Friday afternoon helps "bury the bad news". This ensures it falls outside the news cycle for most journalists and gets the minimum of coverage.