5 ms·

As a longtime Kickstarter user, I'm going to have to delete my account. If they couldn't handle security and rake in Millions if not Billions in annual revenue.

by ameen 13y ago

As a longtime Kickstarter user, I'm going to have to delete my account. If they couldn't handle security and rake in Millions if not Billions in annual revenue. What else were their priorities? If my security is an afterthought to you, then you don't deserve my business.

deleted 13y ago
[deleted]
tptacek 13y ago
That'll sure show them. Next time, I'm sure they'll start a business that does security better than any other company in the world, including banks, payment processors, the NSA, &c. Since, after all, that's apparently where the bar is set.
- ameen 13y ago
  I wouldn't have cared if it was just CC info that had been leaked as I could've easily remedy that. My personal info + password hashes are what pushed me over to this decision. I've personally given them over thousands of dollars of business and was helping others launch their projects on there.
hga 13y ago
I tend to agree: Handling Other People's Money is the essential part of their business. They didn't detect the intrusion. The last one tends to concern me in these sorts of incidents.
- tptacek 13y ago
  Do they handle people's money? I thought that all went through AMZN. In any case: if you're setting the bar for "handling transactions online" at "must be the first to detect any compromise", you're probably good with using Amazon and... hm, probably nobody else.
  - hga 13y ago
    I suppose I wouldn't be surprised if the actual use in the industry of effective intrusion detection systems was negligible, but I'd hope otherwise. I'd note that we wouldn't likely hear about many intrusions discovered by the entity itself, they'd ideally stop them before anything major was lost, at worst case keep it quiet. And, you know, outside of computer stuff where I send my money to NewEgg, I do by default prefer Amazon to all others. (NewEgg has good prices, superb shipping of bare hard drives, the very best and informative reviews, and now a question and answer system, which sends email to people who've bought a product in case they can answer them. Or so I've found with a fan I recently bought, and helped two people, in one case whipping out my micrometer.)
    - tptacek 13y ago
      The actual use in industry of intrusion detection is negligible, and the systems themselves are nearly worthless. For what it's worth: we don't generally recommend IDS deployments.
      - hga 13y ago
        What about tripwire and the like? (That is not asked out of idle curiosity, and I've been told the worst intrusions hack the kernel so tripwire would likely be useless, but don't know if those are widespread.)
        tptacek 13y ago
        I operate from the assumption that any serious compromise starting at SQLI injection equates to kernel compromise, so I don't spend a lot of time thinking about host-IDS either. Tripwire is not a total waste of time, like a network IDS would be, but for most startups a minute spent setting up Tripwire is a minute that could be better spent on appsec.
        graylights 13y ago
        That is quite a leap to assume root access. A user mode database should have write access only to partitions that are mounted noexec. That would make getting root privileges quite hard even on a vulnerable kernel. Also with proper hardening you can prevent the kernel from being modified even by root. Things like FreeBSD securelevel that once enabled blocks writing to kernel memory and raw disk devices.
facepalm 13y ago
Sadly, security is impossible.
chmullig 13y ago
The list of companies who have meaningful numbers of users and haven't been hacked is growing vanishingly small. You'll also notice that no payment information was breached, substantially better than most other similar events. Plus, I'm not sure where you possibly got billions in annual revenue? They're incredibly public about their statistics and business model. They take 5% of successfully raised projects. They report $842M successful dollars on the site, for a lifetime revenue of $42 million in the 5 years since they were founded.
couchdive 13y ago
I deleted my account immediately.
rcfox 13y ago
Based on your GitHub account, you probably have an iPhone. Care to rephrase?
cpach 13y ago
Good luck finding an alternative!
- _random_ 13y ago
  And that's something to be sad about actually...

by ameen 13y ago

deleted 13y ago

[deleted]

tptacek 13y ago

That'll sure show them. Next time, I'm sure they'll start a business that does security better than any other company in the world, including banks, payment processors, the NSA, &c. Since, after all, that's apparently where the bar is set.

ameen 13y ago
I wouldn't have cared if it was just CC info that had been leaked as I could've easily remedy that. My personal info + password hashes are what pushed me over to this decision. I've personally given them over thousands of dollars of business and was helping others launch their projects on there.

hga 13y ago

I tend to agree: Handling Other People's Money is the essential part of their business. They didn't detect the intrusion. The last one tends to concern me in these sorts of incidents.

tptacek 13y ago
Do they handle people's money? I thought that all went through AMZN. In any case: if you're setting the bar for "handling transactions online" at "must be the first to detect any compromise", you're probably good with using Amazon and... hm, probably nobody else.
- hga 13y ago
  I suppose I wouldn't be surprised if the actual use in the industry of effective intrusion detection systems was negligible, but I'd hope otherwise. I'd note that we wouldn't likely hear about many intrusions discovered by the entity itself, they'd ideally stop them before anything major was lost, at worst case keep it quiet. And, you know, outside of computer stuff where I send my money to NewEgg, I do by default prefer Amazon to all others. (NewEgg has good prices, superb shipping of bare hard drives, the very best and informative reviews, and now a question and answer system, which sends email to people who've bought a product in case they can answer them. Or so I've found with a fan I recently bought, and helped two people, in one case whipping out my micrometer.)
  - tptacek 13y ago
    The actual use in industry of intrusion detection is negligible, and the systems themselves are nearly worthless. For what it's worth: we don't generally recommend IDS deployments.
    - hga 13y ago
      What about tripwire and the like? (That is not asked out of idle curiosity, and I've been told the worst intrusions hack the kernel so tripwire would likely be useless, but don't know if those are widespread.)
      - tptacek 13y ago
        I operate from the assumption that any serious compromise starting at SQLI injection equates to kernel compromise, so I don't spend a lot of time thinking about host-IDS either. Tripwire is not a total waste of time, like a network IDS would be, but for most startups a minute spent setting up Tripwire is a minute that could be better spent on appsec.
        graylights 13y ago
        That is quite a leap to assume root access. A user mode database should have write access only to partitions that are mounted noexec. That would make getting root privileges quite hard even on a vulnerable kernel. Also with proper hardening you can prevent the kernel from being modified even by root. Things like FreeBSD securelevel that once enabled blocks writing to kernel memory and raw disk devices.

facepalm 13y ago

Sadly, security is impossible.

chmullig 13y ago

The list of companies who have meaningful numbers of users and haven't been hacked is growing vanishingly small. You'll also notice that no payment information was breached, substantially better than most other similar events. Plus, I'm not sure where you possibly got billions in annual revenue? They're incredibly public about their statistics and business model. They take 5% of successfully raised projects. They report $842M successful dollars on the site, for a lifetime revenue of $42 million in the 5 years since they were founded.

couchdive 13y ago

I deleted my account immediately.

rcfox 13y ago

Based on your GitHub account, you probably have an iPhone. Care to rephrase?

cpach 13y ago

Good luck finding an alternative!

_random_ 13y ago
And that's something to be sad about actually...