4 ms·

The only thing I take away from this is that you should not use custom domains for your email, at least for important stuff.

by baisq 4y ago

3np 4y ago
...or just make sure you keep them under your control...? Losing access to an account at a major mail provider seems more probable than losing control of a domain you paid for.
- KMnO4 4y ago
  Eh, it happens. I pay over $200/year for my domain + GSuite. It’s a luxury I enjoy, but a luxury nonetheless. If I couldn’t afford that anymore, I’d probably go back to Gmail. I’d probably think to switch over many of my email addresses (for services that I use), but some may slip the cracks when the domain expires.
  - SuperCuber 4y ago
    How much does your domain cost? Most TLDs cost under $20, and GSuite costs like $60 a year... I pay like $60 for domain + mail combined (with fastmail)
    - KMnO4 4y ago
      My last month’s GSuite invoice was $17.63 (CAD). It has definitely increased in price, but it’s still the cheapest unlimited cloud drive. I think the cheaper plan only includes 30GB storage.
lrvick 4y ago
I checked the password-reset flows for most major NPM contributors that use regular webmail accounts like Gmail too. < 10% had useful 2FA enabled. Most were just password reset questions or had a backup email to some old expired and re-registerable forgotten earthlink accounts etc. I do this stuff all the time. I looked up the password reset questions controlling the zoom.us domain 2 years ago and collected an insulting $200 bug bounty for it. Zoom, like NPM, didn't do signed binaries, so this would have been brutal combined with other issues I found. The solution is what all sane OS package managers do: code signing. NPM has rejected this at least as far back as 2013 when they refused a PR by someone that implemented it for them: https://github.com/npm/npm/pull/4016 https://github.com/npm/npm/pull/4016 I don't know what else to do but keep publicly trolling them at this point until code signing is implemented. Unsigned code is a free pass for remote code execution when an account gets taken over. Meanwhile Debian maintains hundreds of signed nodejs packages proving it is very doable by a low budget team. NPM seems to just want to reduce deveopler friction at all costs :/
- pimterry 4y ago
  Doesn't really even need to reduce average developer friction - they've proven a few times that they're happy to add extra security requirements just for publishers of high-visibility packages. "Once you cross 100,000 weekly downloads, all new publishes must be signed" would keep the easy on-ramp for small packages but dramatically reduce the risk of major attacks against all the big targets (like the example here). Not as good as signing everything, but a good start that can be iterated on later.
- sofixa 4y ago
  Is code signing really a solution here? It seems more like a bandaid to me, because someone without MFA on their account probably also doesn't have the best security around their code signing. In any case, isn't it often handled by CI/CD? If you get access to the developer's account, you can release malicious code, dutifully signed?
  - XorNot 4y ago
    Technically what's needed is attestation: I don't care if the author signs it, I care that trustable third parties have reviewed it. Most people would have no problem marking a couple of big firms and orgs as trusted reviewers and only showing packages to be used if signed by them.
    - jacques_chester 4y ago
      What folks call signing is, if you step back, basically another kind of attestation. It's an attestation of authorship.
    - jka 4y ago
      To be honest, rather than magical blessed keys held by a few orgs, I'd feel more comfortable with a slightly larger number of individual reviewers (and prosaic keys), each with some kind of visible distance metric related to the codebase they're signing artifacts for. For example: "ah yes, a core contributor, a frequent code reviewer, and two downstream consumers of this library have signed off on the changes in this release. even if one of them is having a distracted day/week, that's good enough for our team to be comfortable upgrading it today since it's a minor version upgrade"
merlinscholz 4y ago
Yes, better use Gmail and loose your whole account in a few months/years
- baisq 4y ago
  Yes, it's better that your account gets locked and everybody loses access to it than it is to allow someone else access it.

The only thing I take away from this is that you should not use custom domains for your email, at least for important stuff.

by baisq 4y ago

The only thing I take away from this is that you should not use custom domains for your email, at least for important stuff.

3np 4y ago

...or just make sure you keep them under your control...? Losing access to an account at a major mail provider seems more probable than losing control of a domain you paid for.

KMnO4 4y ago
Eh, it happens. I pay over $200/year for my domain + GSuite. It’s a luxury I enjoy, but a luxury nonetheless. If I couldn’t afford that anymore, I’d probably go back to Gmail. I’d probably think to switch over many of my email addresses (for services that I use), but some may slip the cracks when the domain expires.
- SuperCuber 4y ago
  How much does your domain cost? Most TLDs cost under $20, and GSuite costs like $60 a year... I pay like $60 for domain + mail combined (with fastmail)
  - KMnO4 4y ago
    My last month’s GSuite invoice was $17.63 (CAD). It has definitely increased in price, but it’s still the cheapest unlimited cloud drive. I think the cheaper plan only includes 30GB storage.

lrvick 4y ago

I checked the password-reset flows for most major NPM contributors that use regular webmail accounts like Gmail too. < 10% had useful 2FA enabled. Most were just password reset questions or had a backup email to some old expired and re-registerable forgotten earthlink accounts etc. I do this stuff all the time. I looked up the password reset questions controlling the zoom.us domain 2 years ago and collected an insulting $200 bug bounty for it. Zoom, like NPM, didn't do signed binaries, so this would have been brutal combined with other issues I found. The solution is what all sane OS package managers do: code signing. NPM has rejected this at least as far back as 2013 when they refused a PR by someone that implemented it for them: https://github.com/npm/npm/pull/4016 https://github.com/npm/npm/pull/4016 I don't know what else to do but keep publicly trolling them at this point until code signing is implemented. Unsigned code is a free pass for remote code execution when an account gets taken over. Meanwhile Debian maintains hundreds of signed nodejs packages proving it is very doable by a low budget team. NPM seems to just want to reduce deveopler friction at all costs :/

pimterry 4y ago
Doesn't really even need to reduce average developer friction - they've proven a few times that they're happy to add extra security requirements just for publishers of high-visibility packages. "Once you cross 100,000 weekly downloads, all new publishes must be signed" would keep the easy on-ramp for small packages but dramatically reduce the risk of major attacks against all the big targets (like the example here). Not as good as signing everything, but a good start that can be iterated on later.
sofixa 4y ago
Is code signing really a solution here? It seems more like a bandaid to me, because someone without MFA on their account probably also doesn't have the best security around their code signing. In any case, isn't it often handled by CI/CD? If you get access to the developer's account, you can release malicious code, dutifully signed?
- XorNot 4y ago
  Technically what's needed is attestation: I don't care if the author signs it, I care that trustable third parties have reviewed it. Most people would have no problem marking a couple of big firms and orgs as trusted reviewers and only showing packages to be used if signed by them.
  - jacques_chester 4y ago
    What folks call signing is, if you step back, basically another kind of attestation. It's an attestation of authorship.
  - jka 4y ago
    To be honest, rather than magical blessed keys held by a few orgs, I'd feel more comfortable with a slightly larger number of individual reviewers (and prosaic keys), each with some kind of visible distance metric related to the codebase they're signing artifacts for. For example: "ah yes, a core contributor, a frequent code reviewer, and two downstream consumers of this library have signed off on the changes in this release. even if one of them is having a distracted day/week, that's good enough for our team to be comfortable upgrading it today since it's a minor version upgrade"

merlinscholz 4y ago

Yes, better use Gmail and loose your whole account in a few months/years

baisq 4y ago
Yes, it's better that your account gets locked and everybody loses access to it than it is to allow someone else access it.