12 ms·
It's a private key. You need the public key to encrypt, which is not password-encrypted. Although I still wonder about how they run recurring charges.
by gburt 14y ago
It's a private key. You need the public key to encrypt, which is not password-encrypted.
Although I still wonder about how they run recurring charges.
- lawnchair_larry 14y agoI understand this, and any system that needed this information would not work if it relied on a human to decrypt.
- corford 14y agoI think the most likely answer is pretty simple and non shocking: the key is loaded via an agent on boot (subject to the correct passphrase being entered) and stays resident in memory (either permanently or for x minutes/hours). Where's the problem?
- thaumaturgy 14y agoIf they did it that way, then because the attackers had access to the keys and the server code for an unknown period of time (up to maybe a couple of days), they may have been able to either extract it from memory or use the private key with someone else's credentials to decrypt some or all of the payment information. I'm really trying to avoid speculation at this point -- we simply don't have enough information to make smart guesses -- but I think we can reasonably conclude that nobody at Linode was manually keying in a password every time there was a charge to a customer card, and therefore it's not insanely paranoid to cancel any cards associated with Linode. Really the most annoying thing here is Linode's obtuseness about the attack and their processes and what's at risk, and if I end up moving to another service (as at the moment I'm inclined to), that will be the reason -- not because they got compromised, but because they valued their own butts over their customers'. They're a VPS service for chrissake. They could explain in very technical terms exactly how manager passwords were stored and how the credit card information was stored & accessed and what other billing information may have been compromised -- a full disclosure -- and most of their customers would not only understand most of it, but they would appreciate it. Sorry, I kinda went off on a tangent there, but the more I think about how this has been handled, the less I feel like I can trust them.
- cmelbye 14y agoIt could be a manual script that he runs which prompts for the passphrase. I know that earlier in Linode's history, caker made it seem as if it worked that way from the way he acted in their IRC channel when the batch transactions were running.
- eridius 14y agoThis seems likely. Once a month, run a script, type in the complex passphrase, and all the billing gets done at once.
- thaumaturgy 14y agoI mentioned this elsethread, but I've had changes to my account get charged to my card immediately (within minutes), even in the middle of the night. Last example of this was January 2012, so they may've changed their billing practices since then.
- eridius 14y agoI suppose they could also keep the decrypted key in memory using something like gpg-agent.
- stock_toaster 14y agoI read somewhere (can't remember where now) that the hacker supposedly dumped the key from memory. My guess is they type in the passphrase on boot or something, and it lives in an agent thereafter.
- eridius 14y agoI haven't seen that anywhere, and I find it unlikely.