6 ms·
Long story short: MongoHQ is securing access to critical administration functionality behind a VPN and will be requiring two-factor authentication instead of ha
by biot 13y ago
Long story short: MongoHQ is securing access to critical administration functionality behind a VPN and will be requiring two-factor authentication instead of having that functionality available to anyone on the internet via a simple password.
What's interesting is that I think we've all been there at one point. You start building something, it gains momentum, then you get so bogged down with adding functionality and fixing bugs that you never get around to implementing the security features you know you should. At what point do you say "Okay, we have too much at risk to not correct this immediately"?
- deleted 13y ago[deleted]
- ams6110 13y agothat functionality [critical administation functionality] available to anyone on the internet via a simple password I mean COME ON, MAN.... there are mistakes, and then there's incompetence.
- olefoo 13y agoIt depends on the simplicity of the password... I mean yeah if the password was 'letme1n' that's one thing. Whereas if it's a "at least 16 characters, mixed cased, punctuation and no english words"; maybe that's another. But, I would have thought at the very least, ssh with keys-only on the external-facing bastion host.
- nthj 13y agoWhat with keyboard loggers, unsecured wifi, video cameras, stolen computers, stolen iPhones (with email access, now you're vulnerable to password resets), there are just too many attack vectors for even a 16 character password to suffice. You need to be protected by both something you have and something you know. (My iPhone has a 16+ character password. It's a pain. It's worth it.) Heroku's lack of 2-factor auth has literally given me nightmares.