lsh123

78 ms·

721.
by lsh123 13y ago
Other attack vectors: rogue google employee, breakins into the data center, ...
722.
by lsh123 13y ago
In addition to the numbers already posted, you can remember that Google decided to add encryption to the data links in September.
723.
by lsh123 13y ago
> The evidence totally points to cable splicing. I don't think there are any evidences at all. As far as I know, the only known thing is that NSA was able to obtain the un-encrypted google traffic. For example, it could have been ba
724.
by lsh123 13y ago
I wrote my thoughts on the subject in a blog post as well: http://www.aleksey.com/2013/11/06/why-google-engineers-got-i...
725.
by lsh123 13y ago
I hear what you are saying but I think there are similarities. In both cases there was an assumption "X is safe" and then the thinking have stopped. I've heard different version of how the data was taken from the google'
726.
by lsh123 13y ago
Sure. A court order would do it no problem.
727.
by lsh123 13y ago
I think public key encryption with long enough key is a pretty safe bet these days. Of course, NSA might have new non-public discoveries in math/crypto that might make public encryption obsolete. Or they might have a device form Area 5
728.
by lsh123 13y ago
I know that people don't like lawsuits. But for security to work there should be consequences for not doing security right. To give you an example, if a company X doesn't have any risks or damages from lack of security, then compa
729.
by lsh123 13y ago
Absolutely. That's why you have to have logs and regular audits to make sure that employees are not doing things that they are not supposed to do. BTW, one should consider not only kidnapping but just a "rogue" employee. For
730.
by lsh123 13y ago
At WePay - no, we don't have our own data centers just yet. In a couple large companies I worked before - yes (and we did encrypt the traffic as much as possible). Some types of encryption are pretty cheap actually. I used to use speci
731.
by lsh123 13y ago
We use Cisco appliances for VPN (a few different models) and indeed there is a shared key that we have to input manually. However, after the key is entered (and configs saved) in order to decrypt the traffic one would need to print Cisco co
732.
by lsh123 13y ago
* Mid-tier servers: standard HTTPS with nginx * Database: SSL connections for MySQL * Memcached, Gearmand, and other tools that don't have built-in SSL support: simple home grown message level encryption (AES256) And of course, there a
733.
by lsh123 13y ago
Consider the recent passwords leak from Adobe: they stored passwords in a dedicated unshared datacenter. Does this make a good security decision to encrypt passwords instead of using a hash because nobody should have been able to access the
734.
by lsh123 13y ago
BTW, "at least they weren't supposed to" is not a good enough argument in security :) You have to think about people who are not following the rules or your security is only protecting from a well-behaving 1st grade student
735.
by lsh123 13y ago
Well, I feel that encrypting traffic inside the data center is not a bad idea (and we do it at WePay where I serve as CSO). The reasons is that you never know who is listening (big smile here). For example, I don't want our system ad
736.
by lsh123 13y ago
Well, I do :) Moreover, I encrypt all the traffic even inside the same data center.
737.
by lsh123 13y ago
Yes (search for SSAE16 or SAS70). However, I would not feel the same way if US government would have used Area 51 technology to hack 4096 public key encryption. The difference from my perspective is that in "burglary" scenario (an
738.
by lsh123 13y ago
Lets start from the beginning: the NSA "hack" became possible because Google (and its security team) made bad assumptions about the security of the connection between Google's data centers and did not encrypt the traffic. Bas
739.
by lsh123 13y ago
Built one myself sometime ago: https://github.com/lsh123/stats-rrdb An important part for me was the desire to completely separate data and UX (so no graphite). Added bonus is ability to control resources (e.g. memory&
740.
by lsh123 13y ago
I personally think that "provides only snapshot isolation" and "provides ACID transactions on a single machine, but sharding, caching, and failover will likely violate them as you try to scale" are very different stateme
741.
by lsh123 13y ago
We use MySQL-Galera and it has full ACID guarantees in cluster/multi-site/DR environment. Unfortunately the article is not a complete overview of the existing DBs landscape and has too much marketing in other places as well.
742.
by lsh123 13y ago
(disclaimer - I work for WePay which is another payment processor) If you are collecting credit card numbers in your application, then you are still required to be PCI compliant (see TOS for the companies you've mentioned). The reasons
743.
by lsh123 13y ago
PCI standard is the minimum requirement. In my experience, people don't really think about security and PCI at least forces them to think and ask questions. From this perspective, PCI is actually doing its job.
744.
by lsh123 13y ago
wanna bet that I can write bad code in python? :) :) :)
745.
by lsh123 13y ago
Reading the comments to the PHP bug, I find it funny that "The Software shall be used for Good, not Evil." license clause was not approved by Google :) :) :)
746.
by lsh123 13y ago
There are services that specialize in handling DDOS attacks with distributed data centers and large pipes. It is very hard to do it on a shared infrastructure (e.g. AWS) w/o affecting other customers thus hosting providers will be more
747.
by lsh123 13y ago
Just to keep it historically accurate, PayPal's Adaptive Payments API supported marketplace use case since mid 2010. Disclaimer: I used to work on it in my past life.
748.
by lsh123 13y ago
Invest in some kind of fruit company
749.
by lsh123 13y ago
Yep, I think it has too many dependencies and the architecture is over complicated. I've built a standalone stats collection/storage daemon that just works with any charts packaging - google charts, or whatever. Works great and do
750.
by lsh123 13y ago
https://www.youtube.com/watch?v=h3kREPMzMLk

More ›