6 ms·

My Visa card that I used with Linode was stolen and used on an Amazon order I didn't authorise last week, my bank successfully blocked the charge. Someone else

My Visa card that I used with Linode was stolen and used on an Amazon order I didn't authorise last week, my bank successfully blocked the charge. Someone else reported their Visa had also been compromised in the thread 2 days ago, looks like that confirms the suspicions: https://news.ycombinator.com/item?id=5542015 https://news.ycombinator.com/item?id=5542015 Poor show Linode. (edit: worth noting I use the card with other things too, I have no confirmation it was leaked through Linode other than the compromise happening at the same time these supposed leaks happened).

austengary 14y ago
Switched to https://www.digitalocean.com/ https://www.digitalocean.com/ last week. Excellent service and pricing.
- Kudos 14y ago
  Yeah, a week sounds like plenty of time to assess a hosting provider.
  - austengary 14y ago
    Oh, and the years of Linode assessment were adequate?
    - umsm 14y ago
      Every site can be hacked. It's just a matter of time. You just have to properly react: call your CC provider, check for any charges on your bill, and move on.
      - austengary 14y ago
        I do not think anyone here is actually worried about their funds; as mentioned below, any reputable provider will have such charges promptly reversed. The problem is instead with their response to the situation. Linode has addressed the breach, but assured customers nothing of value had been compromised. This infers two thoughts. One: they knew of the breach and lied, thereby unveiling a unforthcoming and dishonest nature. Or two: they did not properly investigative the severity of the issue, thereby suggesting incompetence. Both equally reprehensible.
        gcr 14y ago
        Mm, not equally. I'd rather have incompetence over malice.
- mratzloff 14y ago
  Until they're hacked, too...
  - austengary 14y ago
    Unlike Linode, they accept PayPal.
    - oinksoft 14y ago
      I'm far more concerned about the integrity of my servers than about my CC, which has good fraud protection.
  - shuzchen 14y ago
    Or until they let other customers see all the data on VMs that you've shut down. Oh wait, that already happened: http://www.wired.com/wiredenterprise/2013/04/digitalocean/ http://www.wired.com/wiredenterprise/2013/04/digitalocean/
    - gcr 14y ago
      DigitalOcean is new and they fixed the problem the same day the article was written: https://www.digitalocean.com/blog_posts/resolved-lvm-data-issue https://www.digitalocean.com/blog_posts/resolved-lvm-data-is... If I had a choice between a VPS provider who either: - Only has large issues (eg. leaks credit card data) and goes weeks without reporting them to customers, or - Has lots of small issues (eg. forgetting to clean the free space of LVM volumes) but fixes them the same day, I'd much prefer the latter. EDIT: My bad, apparently the problem was reported on March 27 and wasn't fixed until April 2.
      - bad_user 14y ago
        There is no evidence to suggest that Linode leaked credit card data. Personally I took precautionary measures and just called my bank to replace my credit card, which I think is the sane approach, as when it comes to hacking you have to assume the worst. However, your statement on "has lots of small issues but fixes them the same day" is just stupidly childish. Linode's issues are bigger just because they are a bigger target.
- level09 14y ago
  was not convinced by the website, looks nice but prices are kind of very cheap ? also a twitter feed for the customers page ?
nivla 14y ago
Great, now I am feeling paranoid although I don't see any unauthorized charges on my card. Does anyone know if debit cards are legally protected the same way as credit cards with 0% liability.
- UnoriginalGuy 14y ago
  Debit cards have less protection. Wouldn't hurt just to ask your bank to re-authorise it anyway? It will change the three digits on the back.
  - spkthed 14y ago
    They don't, protections are exactly the same.
    - UnoriginalGuy 14y ago
      They really aren't. I know someone who got their debit card cloned. While the bank eventually repaid him, that did nothing to repay him the additional fees he owned his normal debtors (e.g. rent, utilities, etc). With a credit card you aren't losing "actual" money. You are losing the bank's borrowed money which the bank pays back. With a debit card you're losing cash which you won't be able to replace yourself and which the bank might take days to weeks to replace. Even if you NEED to borrow while your credit card is out of commission you can either use the overdraft facility on your debit card or other quick sources of credit. Hard to get quick cash without going to a pawn shop.
  - nsfmc 14y ago
    they typically have the same protections, the only difference is that while credit cards only check that the charge can be made during the authorization period, debit cards lock up the bank's funds immediately which may cause your checking account to be temporarily unusable even if all the charges are successfully disputed. a good practice that bankers constantly tell me is to have a separate credit card for online purchases for the fact alone that it is one step removed from your checking account.
- 14y ago
AlexMuir 14y ago
Nothing on my UK Mastercard.
jtolj 14y ago
I have two accounts with them, one for my day job and one through my LLC. Right now neither card is showing unusual charges. My day job had some Google Apps account compromises last month, and this is making me paranoid that the database that contained hashed/salted passwords for our Intranet hosted on Linode was the culprit. The time frame doesn't seem to line up, but we didn't see any evidence of phishing or compromised desktops being involved. (Don't want to spread fear - I haven't been able to find any evidence our Linodes were compromised either.) I'm normally huge a Linode evangelist, but I'm severely disappointed with the lack of transparency on this. I'm debating right now whether to rebuild all our nodes from scratch as I'm not sure they can be trusted.
davidw 14y ago
I had a CC problem, and I use it for a very restricted number of online services. Luckily the fraudulent attempt was blocked by the CC company. Linode was not at the top of my list of suspects (there was another company that seemed to be storing passwords in cleartext), but now I'm wondering. This was a couple of months ago though... I wonder if that's the right time frame?
prawn 14y ago
FWIW, no charges on my card used with Linode at this point.

austengary 14y ago

Switched to https://www.digitalocean.com/ https://www.digitalocean.com/ last week. Excellent service and pricing.

Kudos 14y ago
Yeah, a week sounds like plenty of time to assess a hosting provider.
- austengary 14y ago
  Oh, and the years of Linode assessment were adequate?
  - umsm 14y ago
    Every site can be hacked. It's just a matter of time. You just have to properly react: call your CC provider, check for any charges on your bill, and move on.
    - austengary 14y ago
      I do not think anyone here is actually worried about their funds; as mentioned below, any reputable provider will have such charges promptly reversed. The problem is instead with their response to the situation. Linode has addressed the breach, but assured customers nothing of value had been compromised. This infers two thoughts. One: they knew of the breach and lied, thereby unveiling a unforthcoming and dishonest nature. Or two: they did not properly investigative the severity of the issue, thereby suggesting incompetence. Both equally reprehensible.
      - gcr 14y ago
        Mm, not equally. I'd rather have incompetence over malice.
mratzloff 14y ago
Until they're hacked, too...
- austengary 14y ago
  Unlike Linode, they accept PayPal.
  - oinksoft 14y ago
    I'm far more concerned about the integrity of my servers than about my CC, which has good fraud protection.
- shuzchen 14y ago
  Or until they let other customers see all the data on VMs that you've shut down. Oh wait, that already happened: http://www.wired.com/wiredenterprise/2013/04/digitalocean/ http://www.wired.com/wiredenterprise/2013/04/digitalocean/
  - gcr 14y ago
    DigitalOcean is new and they fixed the problem the same day the article was written: https://www.digitalocean.com/blog_posts/resolved-lvm-data-issue https://www.digitalocean.com/blog_posts/resolved-lvm-data-is... If I had a choice between a VPS provider who either: - Only has large issues (eg. leaks credit card data) and goes weeks without reporting them to customers, or - Has lots of small issues (eg. forgetting to clean the free space of LVM volumes) but fixes them the same day, I'd much prefer the latter. EDIT: My bad, apparently the problem was reported on March 27 and wasn't fixed until April 2.
    - bad_user 14y ago
      There is no evidence to suggest that Linode leaked credit card data. Personally I took precautionary measures and just called my bank to replace my credit card, which I think is the sane approach, as when it comes to hacking you have to assume the worst. However, your statement on "has lots of small issues but fixes them the same day" is just stupidly childish. Linode's issues are bigger just because they are a bigger target.
level09 14y ago
was not convinced by the website, looks nice but prices are kind of very cheap ? also a twitter feed for the customers page ?

nivla 14y ago

Great, now I am feeling paranoid although I don't see any unauthorized charges on my card. Does anyone know if debit cards are legally protected the same way as credit cards with 0% liability.

UnoriginalGuy 14y ago
Debit cards have less protection. Wouldn't hurt just to ask your bank to re-authorise it anyway? It will change the three digits on the back.
- spkthed 14y ago
  They don't, protections are exactly the same.
  - UnoriginalGuy 14y ago
    They really aren't. I know someone who got their debit card cloned. While the bank eventually repaid him, that did nothing to repay him the additional fees he owned his normal debtors (e.g. rent, utilities, etc). With a credit card you aren't losing "actual" money. You are losing the bank's borrowed money which the bank pays back. With a debit card you're losing cash which you won't be able to replace yourself and which the bank might take days to weeks to replace. Even if you NEED to borrow while your credit card is out of commission you can either use the overdraft facility on your debit card or other quick sources of credit. Hard to get quick cash without going to a pawn shop.
- nsfmc 14y ago
  they typically have the same protections, the only difference is that while credit cards only check that the charge can be made during the authorization period, debit cards lock up the bank's funds immediately which may cause your checking account to be temporarily unusable even if all the charges are successfully disputed. a good practice that bankers constantly tell me is to have a separate credit card for online purchases for the fact alone that it is one step removed from your checking account.
14y ago

AlexMuir 14y ago

Nothing on my UK Mastercard.

jtolj 14y ago

I have two accounts with them, one for my day job and one through my LLC. Right now neither card is showing unusual charges. My day job had some Google Apps account compromises last month, and this is making me paranoid that the database that contained hashed/salted passwords for our Intranet hosted on Linode was the culprit. The time frame doesn't seem to line up, but we didn't see any evidence of phishing or compromised desktops being involved. (Don't want to spread fear - I haven't been able to find any evidence our Linodes were compromised either.) I'm normally huge a Linode evangelist, but I'm severely disappointed with the lack of transparency on this. I'm debating right now whether to rebuild all our nodes from scratch as I'm not sure they can be trusted.

davidw 14y ago

I had a CC problem, and I use it for a very restricted number of online services. Luckily the fraudulent attempt was blocked by the CC company. Linode was not at the top of my list of suspects (there was another company that seemed to be storing passwords in cleartext), but now I'm wondering. This was a couple of months ago though... I wonder if that's the right time frame?

prawn 14y ago

FWIW, no charges on my card used with Linode at this point.