11 ms·
Security Update
- rhamzeh 7y agoI think we've reached a point where it's safe to say that if you're using a service - _,any_ service - assume your data is breached (or willingly given) and accessible to some unknown third party. That third party can be the government, it can be some random marketer or it can be a malicious hacker. Just hope that you have nothing anywhere that may be of interest or value to anyone, anywhere. Good luck.
- kuzimoto 7y agoI've made it a point to start self hosting anything that's particularly sensitive that I don't want third parties to have access to. KeePass and SyncThing probably have my most important information, and it's all owned by me.
- solidasparagus 7y agoI think this belief that personally run software is more secure than professionally run software is a bit optimistic.
- mehrdadn 7y agoIt doesn't have to be more secure, it just has to be less likely to get hacked.
- baroffoos 7y agoLess likely to have targeted attacks but you are still at risk of someone finding an exploit in the software and sending a bot to scan the internet for the software
- mehrdadn 7y agoSure. Nobody claimed you could get the risk down to zero.
- baroffoos 7y agoIts even more of a risk potentially because big companies have people full time working on keeping systems up to date and monitored. How many self hosters have a full monitoring system powerful enough to detect attacks and keep their software up to date and secured as soon as updates come out? How many people self hosting are even qualified to run a secure system? I bet most of them are just regular devs who know just enough about linux to get something online.
- mehrdadn 7y agoI don't think you understood my point. Yes, one particular risk might be higher. But you don't need to do security better or even on par with a big company. You just need your total risk of data exposure to be lower. You can bet big companies have lots of hackers trying to break into them with the newest 0-days, spearphish their employees, etc... there are so many threats you practically don't face if you're self-hosting.
- TeMPOraL 7y ago> Its even more of a risk potentially because big companies have people full time working on keeping systems up to date and monitored. Beyond the thing about different types and frequency of attacks - sure, I trust Google's security more than my own. But I do trust my own security more than that of Random-Startup.IO, who likely have no full-time security people, and little incentive to get the job right (paying attention to security slows down your incredible journey). Also, even with big companies, this argument applies primarily to the few like Google, Facebook or Apple. Your Random Megacorp from outside tech community usually focuses its security efforts on satisfying regulators and neutering their own employees, who'd otherwise happily copy out all sensitive data to make their jobs easier.
- Hackbraten 7y ago
- rcfox 7y agoI'm not sure that off-the-shelf software on your own server is necessarily less likely to get hacked. It's easy to fall behind on security updates when you don't think about deploys regularly. Look at the logs for your existing infrastructure. I can pretty much guarantee that there are drive-by Wordpress attacks, regardless of what software is actually serving requests. There will be ssh login attempts.
- mehrdadn 7y agoYou're not showing anything by telling me to look for attempted attacks. I realize they will be there, I don't even need to check. But if attack attempts are how you measure risk then I'd bet you whatever attack you can think of, Google et al. will have orders of magnitude more of them than I would. You gotta realize, it's not like I'm arguing you should set up a server with 1234 as the root password. I'm assuming you're reasonably competent in security, just mostly lacking in the bandwidth needed to e.g. keep your server constantly checked and updated on a daily/weekly basis. With those assumptions I have no reason to think the slightly increased risk of getting hit by a brand-new attack through an IP scan or something is going to outweigh all the entire classes of risks that you do away with as a result of not being part of a massive corporate attack target. Although, heck, if you're absolutely paranoid about random IP scans, you could just move your stuff to some obscure port, which I'm sure you realize already. There you go, you're not going to be found through random mass scans anymore.
- rhamzeh 7y agoI hear you. But I worry that that's not enough. I trust Syncthing and the (many) Keepass (X/C)++ developers, but how hard really would it be to slip something in unnoticed. All it requires is some minuscule bug somewhere. It doesn't need to be in the software itself! It can be in the compiler, or in the crypto or in the machine running it. If the OpenSSL debacle taught us, open source and the fact that many people can look at the code does not mean it's actually being looked at. Don't get me wrong, still loads better than non-open source, but you're still face a huge risk. I'm slightly competent as a developer (not that much, just enough to barely get by) and still looking at the code base of the many apps, services and platforms I use, I'm astounded by the fact that I have no clue how they actually work, and if there is any obvious attack vector there. MOST people have even less of an understanding of all these than I do.
- mehrdadn 7y agoWhat kind of a KeePass bug would compromise your passwords by itself though? Are you imagining instead of saving your passwords it'd "accidentally" upload them to sketchyserver.com?
- ekianjo 7y ago> All it requires is some minuscule bug somewhere You can say the exact same thing for any proprietary software or web service. The point of self-hosting is reducing the attack surface and probability of an attack.
- StavrosK 7y agoPlus, both are great software. KeePass2Android is the best Android password manager, bar none.
- rhamzeh 7y ago* KeePass2Android Offline :)
- mehrdadn 7y agoWhy offline? (And how do you sync?)
- rhamzeh 7y agoI feel it's slightly better to rely on something else for the syncing (even better if you do it manually). I just feel like a password safe would have a draw immense interest from bad actors, so you marginally decrease your chances by using something else for syncing. That way if password storage code was compromised somehow, it can't do much. Then again, a password storage solution is probably investing so much more into security that it may be actually better than using something else..
- mehrdadn 7y agoWhat kinds of threats are you imagining though? KeePass2Android doesn't e.g. open any listening ports does it (I haven't checked)? (Not that NAT would make it easy to connect to it if it did anyway?) Are you imagining it would "accidentally" open a port? And you don't browse the web on it or otherwise run untrusted code on it. How are you imagining it would possibly get hacked? If it's connecting to e.g. Google Drive, then Google Drive or your DNS would need to get hacked somehow, and I'd hope it's checking certificates to prevent that (shouldn't be hard to verify this if this is your concern). If it's via Syncthing, your Syncthing would need to get hacked. In both cases your database would be hacked in which case you'd have the same issue with the offline version too... OTOH you're losing entry-level syncing which is quite the inconvenience...
- 7y ago
- jammygit 7y agoThe biggest thing stopping me is the worry I might misconfigure something after making some change in 6 months when I’m busy.
- m-p-3 7y agoMake sure to keep the amount of selfhosted services to a minimum and as simple as possible to use and maintain. The simpler and smaller the surface of attack is, the better.
- kuzimoto 7y agoThat could always be an issue. Though I try to make sure I have the minimum number of ports, and services running. But there is a possibility that something I have is exploitable still.
- closeparen 7y agoStackOverflow is a forum, not a password manager or a file storage service. If people only participate in forums they self-host, each will have a community of one.
- rglullis 7y agoThe IndieWeb people would like to have a word with you...
- keyle 7y agoThat's my basic assumption now. Which is why any website force-asking me for my date of birth or phone number will get a fake one, and I will use Paypal over giving my physical address. But it doesn't matter, the damage has been done over and over. Pretty sure I'm in many leaked database already (Hi Adobe!)
- deleted 7y ago[deleted]
- Reedx 7y agoJust imagine a Gmail or Mint breach. Oy.
- mey 7y agoQuickbooks Online would also be horrific
- dboreham 7y agoWhich is why nobody should use Quickbooks Online.
- kerng 7y agoI think a mature state of mind is that you should assume those systems are compromised.
- desdiv 7y agoBefore 2013, data sent between Google data-centers were in plaintext (!!!) because Google incorrectly assumed that the their private fiber network was actually private[0]. So if you used Gmail or communicated with people who used Gmail before 2013, then a copy of your communications are backuped up in Utah[1] right now. [0] https://www.wired.com/2013/10/nsa-hacked-yahoo-google-cables https://www.wired.com/2013/10/nsa-hacked-yahoo-google-cables [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
- maccam912 7y agoSomeone make a service that I can submit my email and you'll generate tons of fake passwords for me, then "accidentally" leak them all. When my email and password make their way into the big password lists I want to dilute the real one with thousands of fake ones. If it became the norm that password lists are suddenly full of junk the demand for them would proboably evaporate.
- AnimalMuppet 7y agoInteresting, but the result will be that they're going to blast all of those passwords at the login of whatever service you're trying to protect by this trick. That could DOS the service. It also could result in them locking your account, if they're awake at all.
- ggg2 7y agoif someone get enough passwords to DoS the service or force you to do a password reset, that's actually a pretty good safety fallback.
- joelthelion 7y agoOh oh... More than ever now, don't copy paste blindly from SO answers!
- keyle 7y agoYou'd have to copy/paste a serious chunk of code you don't understand to really cause any damage. I think this comment is either taking the pun or misguided.
- andrewbarba 7y agoHe/she is making a joke. No user data was accessed so the assumption is questions may have been, a couple pluses changed to minuses could cause a lot of damage (headaches?) when copy pasting.
- baroffoos 7y agoIt didn't say no user data was accessed. It said "We have not identified any breach of customer or user data" Which likely means the attacker had access to user data but there was way to know if they did or did not access it.
- erichurkman 7y agoQ: "How do I recursively set ownership of folders in Linux?" A: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste
- justwalt 7y agoReader mode exposes the full text of the command, if anyone is wondering and doesn’t feel like doing exactly what the post is telling you not to do.
- falcor84 7y agoI wonder why they are disclosing this so early, with so little information.
- bastawhiz 7y agoWould you prefer that they didn't?
- falcor84 7y agoI think I would prefer to wait until they have something more specific to disclose. The current update gives me absolutely nothing to go with. It's as if a prison disclosed that the front gate was left unlocked for several minutes and they're still counting the prisoners. I would much prefer to hear about it after they have learned whether anyone escaped.
- needcaffeine 7y agoBecause if they didn't, they'd get criticism about not doing so right away. Also...GDPR?
- majewsky 7y agoThis is not related to GDPR afaics, but at least in Germany, there is an IT security law that governs how companies must disclose security breaches. (Don't get your hopes up, that law is entirely toothless in practice.)
- nerdbaggy 7y agoSO is a good company and this is what good companies do
- plasma 7y agoReflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and detect ex-filtration attempts (eg, queries for multiple customers at once being abnormal) and automatically block that.
- pavanagrawal123 7y agoWouldn't this really just turn into a database as a service?
- sroussey 7y agoNo. It should prevent something like "SELECT * FROM users WHERE sex="F" and age=18".
- viraptor 7y agoSince it's users, maybe call it a directory... And since it's changing, maybe even an Active Directory? Like this https://aws.amazon.com/directoryservice/ https://aws.amazon.com/directoryservice/ ?
- majewsky 7y agoBut then we need some sort of Protocol to Access the Directory. It should be something Lightweight, ideally. ;)
- anticensor 7y agoLDAP?
- toyg 7y agoA single target for all gangsters on the planet? A convenient one-stop-shop, as opposed to having to penetrate multiple different services with vastly different technology stacks and protections and to then normalize data stored in a multitude of different formats? Sounds great, for attackers.
- chairleader 7y agoWhat tends to be the first indication of breaches? It's one thing to do a forensic analysis after learning of a breach, and it's another to detect it in the first place.
- clebio 7y agoIt depends on attack surface and what tooling you already have in place. But for example: > Finding suspicious outbound network activity https://blog.rapid7.com/2016/05/09/introduction-to-osquery-for-threat-detection-dfir/ https://blog.rapid7.com/2016/05/09/introduction-to-osquery-f...
- bigiain 7y agoMostly, Troy Hunt e-mailing clueless companies saying "Hey, this data breach I got sent seems to check out as real, at least a few of the users in it have validated that's currently or recently been their $company website credential to me." (Only mostly joking...)
- nerdbaggy 7y agoI worked at a company that logged every single SQL query and made a rule set based on that. May not of been the most efficient but it worked great. There was basically a whitelist of sorts and if the query structure wasn’t in there then action taken. Also worked by knowing what queries came in what order when doing certain things.
- jtdev 7y agoInteresting that this message is being delivered by the VP of Engineering rather than a VP of Security or another more security focused counterpart with a sufficiently senior title. Wonder if SO has an in house security team with management and executive representation?
- deleted 7y ago[deleted]
- 9nGQluzmnq3M 7y agoSerious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally embarrassing material and many of if not most StackExchange users post with handles easily associated to their real names.
- smelendez 7y agoAnd passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.
- 9nGQluzmnq3M 7y agoI would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.
- rcfox 7y ago10 years ago, almost to the day, they had a password vulnerability involving unsalted hashes. So not plain text, but who knows if they've learned the right lessons? https://blog.codinghorror.com/i-just-logged-in-as-you-how-it-happened/ https://blog.codinghorror.com/i-just-logged-in-as-you-how-it...
- 0xffff2 7y agoUnless I'm badly misreading something, the unsalted hashes in that post were on some other (unspecified) site unrelated to Stack Overflow.
- rcfox 7y agoIn the first sentence, he links to a previous post where it's made more clear that he's talking about Stack Overflow. > I found what one could call a security hole in Stackoverflow. I'm curious enough to go digging around for holes, but too ethical to actually do anything with them.
- nick_kline 7y agoI'm glad it was a 'minor' breach. But where is the blog post from the clever and witty founder, about not trying to hire the top 5% of security engineers because everyone is?
- blackflame7000 7y agoSecurity through obscurity is undervalued.
- NicolaiS 7y agoNo.
- blackflame7000 7y agoYes. It's about minimizing attack surfaces. You can't hack what you can't understand.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- rlt 7y ago> We have not identified any breach of customer or user data. As usual, this is a meaningless statement. It could mean they have full packet captures they've completely audited, or it could just as easily mean "we don't keep logs of any kind so we have no fucking clue".
- msemar 7y agoI take it to mean that they've looked into their logfiles and accesses to their resources as closely as they can and so far haven't spotted anything. So, not exactly meaningless, but also not entirely reassuring. At any rate, I still have some degree in trust in the people running things over there to tell us if the reality is different.
- rossdavidh 7y agoWell, I think it is intended, and usually interpreted, as a comment on their own state of knowledge at that point. In other words, "we're not giving you any details because we don't know yet, but we're looking into it". At least, that's how I interpreted it.
- philliphaydon 7y agoProbably a really stupid question... but how do people detect an intrusion like this?
- lucb1e 7y agoIt's not, but it might have been smart to read a few of the other comments and notice an identical question with two or three answers (depending on your exact time of writing): https://news.ycombinator.com/item?id=19935443 https://news.ycombinator.com/item?id=19935443
- philliphaydon 7y agoThanks. I was reading on my phone on the train, comments on the app aren't always easy to follow.