5 ms·

Tell HN: Epik have finally informed customers of their data breach

11 points by opheliate 5y ago

Received at 19:20 UTC, approx 2 days after the breach was publicly known: > At Epik, we take security and the privacy of your information very seriously. Therefore as a precautionary measure, I am writing to inform you of an alleged security incident involving Epik. > Our internal team, working with external experts, have been working diligently to address the situation. We are taking proactive steps to resolve the issue. We will update you on our progress. In the meantime please let us know if you detect any unusual account activity. I am proud of our team’s efforts as we do our part to empower a thriving internet for the benefit of our customers around the world. > You are in our prayers today. We are grateful for your support and prayer. When situations arise where individuals might not have honorable intentions, I pray for them. I believe that what the enemy intends for evil, God invariably transforms into good. > Blessings to you all. > Regards, > Rob Monster > Founder and CEO > Epik Holdings Inc

shishy 5y ago
Welp. I bought a domain I needed from them a few weeks ago (waiting to transfer it out); didn't have much of a choice. Are the dumps posted already?
- mpnex 5y ago
  Was a post yesterday with a link (the link itself appears to be down now, but here's the post anyway: https://news.ycombinator.com/item?id=28532464 https://news.ycombinator.com/item?id=28532464 ) If it's to be believed, yes, looks like a torrent is going around. Unsalted passwords, everything edit: https://archive.is/S6loc https://archive.is/S6loc mirror of announcement
throw03172019 5y ago
The email felt very off to me. Strange wording to the situation.
smt88 5y ago
> At Epik, we take security and the privacy of your information very seriously. If this were true, how did they end up with an engineering culture that uses unsalted MD5 to hash passwords? If you search for "securing passwords," hashing is the first topic covered. At some point we have to accept that 95% of companies do not take security seriously and decide what to do next.
- kypro 5y ago
  > At some point we have to accept that 95% of companies do not take security seriously and decide what to do next. Perhaps we need an food hygiene rating for software? Every year or two every piece of publicly facing software which deals with sensitive data should be audited for security by approved auditors. Failure to pass such an audit would give the company 6 months to address the issue or close the system to customers until the security issue is resolved. As part of this audit process companies could be given a "security score" which they would be required to display to their customers kind of how UK restaurants have to display their food hygiene rating to customers. Admittedly, I don't pay a huge amount of attention to a restaurant's hygiene rating, but the fact it's there at least gives me confidence that hygiene is being taken at somewhat seriously by any restaurant I visit. I don't feel the same about security on the majority of websites I visit.
approxim8ion 5y ago
Is "Rob Monster" some kind of evangelical weirdo? This is weirdly unprofessional phrasing.
- p0d 5y ago
  I'm also an evangelical weirdo. He is speaking the language of his people, with biblical references. I'm not sure I would do the same in this context but it is a step up from the spin and lies we often hear. I have experienced some choice phrasing myself in business down through the years which I am too shy to repeat :-)

11 points by opheliate 5y ago

shishy 5y ago

Welp. I bought a domain I needed from them a few weeks ago (waiting to transfer it out); didn't have much of a choice. Are the dumps posted already?

mpnex 5y ago
Was a post yesterday with a link (the link itself appears to be down now, but here's the post anyway: https://news.ycombinator.com/item?id=28532464 https://news.ycombinator.com/item?id=28532464 ) If it's to be believed, yes, looks like a torrent is going around. Unsalted passwords, everything edit: https://archive.is/S6loc https://archive.is/S6loc mirror of announcement

throw03172019 5y ago

The email felt very off to me. Strange wording to the situation.

smt88 5y ago

> At Epik, we take security and the privacy of your information very seriously. If this were true, how did they end up with an engineering culture that uses unsalted MD5 to hash passwords? If you search for "securing passwords," hashing is the first topic covered. At some point we have to accept that 95% of companies do not take security seriously and decide what to do next.

kypro 5y ago
> At some point we have to accept that 95% of companies do not take security seriously and decide what to do next. Perhaps we need an food hygiene rating for software? Every year or two every piece of publicly facing software which deals with sensitive data should be audited for security by approved auditors. Failure to pass such an audit would give the company 6 months to address the issue or close the system to customers until the security issue is resolved. As part of this audit process companies could be given a "security score" which they would be required to display to their customers kind of how UK restaurants have to display their food hygiene rating to customers. Admittedly, I don't pay a huge amount of attention to a restaurant's hygiene rating, but the fact it's there at least gives me confidence that hygiene is being taken at somewhat seriously by any restaurant I visit. I don't feel the same about security on the majority of websites I visit.

approxim8ion 5y ago

Is "Rob Monster" some kind of evangelical weirdo? This is weirdly unprofessional phrasing.

p0d 5y ago
I'm also an evangelical weirdo. He is speaking the language of his people, with biblical references. I'm not sure I would do the same in this context but it is a step up from the spin and lies we often hear. I have experienced some choice phrasing myself in business down through the years which I am too shy to repeat :-)