8 ms·

Please provide a little more evidence than starting a flame war. Although it could in theory be true, it's a fairly baseless claim until you present a little

by mbesto 13y ago

Please provide a little more evidence than starting a flame war. Although it could in theory be true, it's a fairly baseless claim until you present a little more evidence. For my online transactions I use prepaid cards that are easy to dispose of, and this card was used solely for linode. Couldn't the online card issuer be to blame? How do we know you haven't mistakenly used it for anything else? The fact that you use prepaid cards for online purchases seems fishy to me in the first place (which is just as baseless of a claim on my part as yours is here). groceries, cheese How do you use a online generated CC for groceries and cheese?? From Linode: Credit card numbers in our database are stored in encrypted format, using public and private key encryption. The private key is itself encrypted with passphrase encryption and the complex passphrase is not stored electronically. Along with the encrypted credit card, the last four digits are stored in clear text to assist in lookups and for display on things like your Account tab and payment receipt emails. We have no evidence decrypted credit card numbers were obtained. https://blog.linode.com/2013/04/16/security-incident-update/ https://blog.linode.com/2013/04/16/security-incident-update/ TL;DR - This is unfair to Linode and I think the community (who uses their service quite frequently) would appreciate if you took it up with them first, before you start a smear campaign.

jmillikin 13y ago
The fact that Linode stored the public and private keys in the same directory is strong evidence that they do not have any competence in security. Their reluctance to disclose the compromise of their customer's passwords and financial data is evidence that they are not trustworthy. So on one hand we have someone who is careful enough about their finances to use disposable prepaid cards for renting a VPS. On the other, a company that doesn't understand how encryption works and had to be forced to disclose the attack by the FBI. Which do you believe?
- dllthomas 13y ago
  "stored the public and private keys in the same directory" People keep harping on that, but as phrased that's not a problem. Wherever you have your private key, there's no reason not to also have your public key. The issue is if the private key was living somewhere inappropriate. Consider that "public and private keys in the same directory" is exactly what happens when you run ssh-keygen on any of the typical setups; failing to then remove the public key is not any kind of a security threat.
  - jmillikin 13y ago
    The entire purpose of having separate public and private keys is for the private key to be stored in a secure location. That way, when your data-writer is compromised, none of the previously written data is at risk without an additional compromise of the key bastion. If the private key is stored in the same directory, then there no effectively no additional security over simple symmetric-key encryption with a passphrase.
    - jdbernard 13y ago
      You missed dllthomas's point. The private key should never exist outside a dedicated secure location, the "key bastion" as you say. dllthoms's point was that it doesn't matter if the public key is also present in the secure location. There is no reason the keys have to be stored separately. That is orthogonal to the actual requirement that the private key is private aka. secret. In fact, the public key is public meaning it is assumed that anyone has or could gain access to it. It is purposefully published. So keeping the public key separate is meaningless. Since it is assumed that everyone has access to the public key we must assume that anyone who gains access to the private key has access to both. Ergo there is no reason to not store them both in the secure location.
      - jmillikin 13y ago
        > There is no reason the keys have to be stored > separately. That is orthogonal to the actual requirement > that the private key is private aka. secret. It's effectively required to store the keys separately because if you stored the public key on the key bastion, it would be useless. > In fact, the public key is public meaning it is assumed > that anyone has or could gain access to it. It is > purposefully published. So keeping the private key > separate is meaningless. This makes no sense at all. You're saying that since the public key is public, it's safe to distribute the private key with the public key.
        deleted 13y ago
        [deleted]
FooBarWidget 13y ago
Why is using prepaid cards for online purchases fishy? - Prepaid cards impose an upper limit on what can be spent, so that if the card details leak out you are protected against losing more money than is on the card. They can't plunder your entire bank account. - Some people don't like the idea of having debt. By using a credit card you immediately have a debt whether you like it or not.
- rosser 13y ago
  By using a credit card you immediately have a debt whether you like it or not. Credit cards are only debt if you treat them like debt. I use the shit out of mine, but pay the full balance pretty much every month. There's a lot of convenience, I'm fully protected from fraudulent activity, and I have a stupid amount of points/miles/whatever for free (or at least cheap) travel, to boot — I flew to .au a couple years ago for free on that basis, for example.
  - jalons 13y ago
    Your balance is irrelevant - your available credit line is debt, as at any moment you can be liable for up to that amount.
    - mikeash 13y ago
      If I have a $10,000 credit limit and $0 balance, my debt is $10,000? At any moment I can be liable for up to $10,000? How does that work?
      - rosser 13y ago
        How does that work? It doesn't. The GP comment is FUD.
        waterlesscloud 13y ago
        It is, however, an element of your credit score.
forthewyn 13y ago
I'm with you. This post strikes me as nothing more than fear groundless fear mongering.
knowtheory 13y ago
The tech required to write data onto a physical card is pretty inexpensive, and the standards for how magnetic stripe data is stored is widely known. It doesn't seem unrealistic that someone could take valid creditcard details and put them onto a physical card to swipe.
deleted 13y ago
[deleted]

by mbesto 13y ago

jmillikin 13y ago

The fact that Linode stored the public and private keys in the same directory is strong evidence that they do not have any competence in security. Their reluctance to disclose the compromise of their customer's passwords and financial data is evidence that they are not trustworthy. So on one hand we have someone who is careful enough about their finances to use disposable prepaid cards for renting a VPS. On the other, a company that doesn't understand how encryption works and had to be forced to disclose the attack by the FBI. Which do you believe?

dllthomas 13y ago
"stored the public and private keys in the same directory" People keep harping on that, but as phrased that's not a problem. Wherever you have your private key, there's no reason not to also have your public key. The issue is if the private key was living somewhere inappropriate. Consider that "public and private keys in the same directory" is exactly what happens when you run ssh-keygen on any of the typical setups; failing to then remove the public key is not any kind of a security threat.
- jmillikin 13y ago
  The entire purpose of having separate public and private keys is for the private key to be stored in a secure location. That way, when your data-writer is compromised, none of the previously written data is at risk without an additional compromise of the key bastion. If the private key is stored in the same directory, then there no effectively no additional security over simple symmetric-key encryption with a passphrase.
  - jdbernard 13y ago
    You missed dllthomas's point. The private key should never exist outside a dedicated secure location, the "key bastion" as you say. dllthoms's point was that it doesn't matter if the public key is also present in the secure location. There is no reason the keys have to be stored separately. That is orthogonal to the actual requirement that the private key is private aka. secret. In fact, the public key is public meaning it is assumed that anyone has or could gain access to it. It is purposefully published. So keeping the public key separate is meaningless. Since it is assumed that everyone has access to the public key we must assume that anyone who gains access to the private key has access to both. Ergo there is no reason to not store them both in the secure location.
    - jmillikin 13y ago
      > There is no reason the keys have to be stored > separately. That is orthogonal to the actual requirement > that the private key is private aka. secret. It's effectively required to store the keys separately because if you stored the public key on the key bastion, it would be useless. > In fact, the public key is public meaning it is assumed > that anyone has or could gain access to it. It is > purposefully published. So keeping the private key > separate is meaningless. This makes no sense at all. You're saying that since the public key is public, it's safe to distribute the private key with the public key.
      - deleted 13y ago
        [deleted]

FooBarWidget 13y ago

Why is using prepaid cards for online purchases fishy? - Prepaid cards impose an upper limit on what can be spent, so that if the card details leak out you are protected against losing more money than is on the card. They can't plunder your entire bank account. - Some people don't like the idea of having debt. By using a credit card you immediately have a debt whether you like it or not.

rosser 13y ago
By using a credit card you immediately have a debt whether you like it or not. Credit cards are only debt if you treat them like debt. I use the shit out of mine, but pay the full balance pretty much every month. There's a lot of convenience, I'm fully protected from fraudulent activity, and I have a stupid amount of points/miles/whatever for free (or at least cheap) travel, to boot — I flew to .au a couple years ago for free on that basis, for example.
- jalons 13y ago
  Your balance is irrelevant - your available credit line is debt, as at any moment you can be liable for up to that amount.
  - mikeash 13y ago
    If I have a $10,000 credit limit and $0 balance, my debt is $10,000? At any moment I can be liable for up to $10,000? How does that work?
    - rosser 13y ago
      How does that work? It doesn't. The GP comment is FUD.
      - waterlesscloud 13y ago
        It is, however, an element of your credit score.

forthewyn 13y ago

I'm with you. This post strikes me as nothing more than fear groundless fear mongering.

knowtheory 13y ago

The tech required to write data onto a physical card is pretty inexpensive, and the standards for how magnetic stripe data is stored is widely known. It doesn't seem unrealistic that someone could take valid creditcard details and put them onto a physical card to swipe.

deleted 13y ago

[deleted]