Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gigabytes of user data from hack of Patreon donations site dumped online

arstechnica.com

Post reply on HN
Print view View original

11–20 of 151 posts

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#11

Post by pki »

Axsuul wrote: post #8
raesene4 wrote: post #6

Earlier quoted context omitted.

the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.

Depends on the attack. If the key used to encrypt the data is stored on another server and loaded into memory when the application is initialized, then the attackers technically wouldn't be able to get access to that key unless they also hacked the server with the key.

If your entire box running with source is compromised, could you not just edit whichever file pulls the key to also dump it to a file on start .?

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#12

Post by Axsuul »

steckerbrett wrote: post #9
Axsuul wrote: post #8

Earlier quoted context omitted.

Depends on the attack. If the key used to encrypt the data is stored on another server and loaded into memory when the application is initialized, then the attackers technically wouldn't be able to get access to that key unless they also hacked the server with the key.

I don't see how that protects anything, if the information is around for the webserver to use it's around for whoever has root on your box.

It would still protect against attacks that don't involve having root access to the box (i.e. Ashley Madison data breach)

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#13

Post by florianletsch »

jtokoph wrote: post #2

Has anyone checked to see if any Facebook access tokens were saved unencrypted in the database? They mention that users who logged in with Facebook instead of username/password would be completely safe, but if access tokens were leaked, then many users could have their Facebook data mined.

Are Facebook access tokens vulnerable to such an attack?

If I remember correctly, at least Google tokens wouldn't be: The application receives a token from Google. With that token, a new session token is created. This session token expires and can only be renewed with the application token and the correct redirect URL.

If Facebook uses a similar scheme, tokens would be useless without the running application renewing session tokens.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#14

Post by icebraining »

steckerbrett wrote: post #4

That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.

How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#16

Post by rplnt »

icebraining wrote: post #14
steckerbrett wrote: post #4

That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.

How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?

Then they didn't do it seriously enough? Either they are not hacked or they can find the person responsible (rogue employee, etc..).

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#17

Post by dspillett »

raesene4 wrote: post #6
Axsuul wrote: post #5

Why don't more websites that are vulnerable to these types of breaches also encrypt user email addresses as well any personally identifiable information? I don't foresee any performance implications if everything is cached anyways.

the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.

> the problem is, if you intend to use the data within the application, you need to be able to decrypt it

... which requires the encryption keys to be know at the point of use - but it doesn't mean that they need to be kept with the database. It doesn't necessitate asymmetric encryption either.

If you keep the keys in a different location, completely away from the database server(s), then a compromised database or backup does not compromise any of the information. Of course there are attack routes that would still give access to the keys too, but you have covered quite a few common attack vectors.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#18

Post by reidrac »

icebraining wrote: post #14
steckerbrett wrote: post #4

That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.

How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?

I guess we could argue that if you get security seriously enough you don't get hacked.

EDIT: I was being sarcastic.

This is a good read: https://www.schneier.com/essays/archives/2000/04/the_process...

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#19

Post by Tinyyy »

raesene4 wrote: post #6
Axsuul wrote: post #5

Why don't more websites that are vulnerable to these types of breaches also encrypt user email addresses as well any personally identifiable information? I don't foresee any performance implications if everything is cached anyways.

the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.

What if you use the email as extra bits of entropy? Like you can append the password to email then hash it. Of course you lose the ability to send emails and account recovery, but its an okay tradeoff for people who want more security.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#20

Post by Tinyyy »

raesene4 wrote: post #6
Axsuul wrote: post #5

Why don't more websites that are vulnerable to these types of breaches also encrypt user email addresses as well any personally identifiable information? I don't foresee any performance implications if everything is cached anyways.

the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.

What if you use the email as extra bits of entropy? Like you can append the password to email then hash it. Of course you lose the ability to send emails and account recovery, but its an okay tradeoff for people who want more security.
Post reply on HN