This is the first time I've been Pwned (https://haveibeenpwned.com/)
Does anyone know a responsible way I can check WHICH of my data has leaked short of downloading the entire archive and searching for myself?
Gigabytes of user data from hack of Patreon donations site dumped online
21–30 of 151 posts
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#22I'm wondering what their setup is?
Are they running on their own machines? AWS? Heroku?
From looking at their careers the use PostgreSQL/MySQL, Python, Scala, Ruby, Node.
I am assuming because of the nature of the breach that they are running their own servers (either on AWS or their own machines), it's a completely compromised server which had access to everything.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#23Why don't more websites that are vulnerable to these types of breaches also encrypt user email addresses as well any personally identifiable information? I don't foresee any performance implications if everything is cached anyways.
the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.
You can use a hardware module with securely stored key to do that for you.
If the whole machine is owned, then I guess it would possible to set limits on these operations. Or at least it can trigger an early warning.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#24That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.
How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?
In the case of Patreon, you might at least assume some negligence, as they had their development servers accessible from the public using production data. In other cases it might be harder to tell. Shielding your dev and staging servers and using mock user data is pretty standard IMO.
I have already requested my Patreon account to be deleted, as they clearly don't understand how to protect customer data.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#25Earlier quoted context omitted.
How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?
I guess we could argue that if you get security seriously enough you don't get hacked. EDIT: I was being sarcastic. This is a good read: https://www.schneier.com/essays/archives/2000/04/the_process...
This is the funniest thing I read today on HN, congratulations
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#26That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.
How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?
The same way you do it for medical negligence: courts.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#27[deleted]
Patreon uses Stripe so I'm pretty sure the hackers expected to not get any credit card numbers.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#28I'm wondering what their setup is? Are they running on their own machines? AWS? Heroku? From looking at their careers the use PostgreSQL/MySQL, Python, Scala, Ruby, Node. I am assuming because of the nature of the breach that they are running their own servers (either on AWS or their own machines), it's a completely compromised server which had access to everything.
Since their servers appear to run on AWS, and knowing that the breach was possible because their development servers were exposed to the public with production user data, it is safe to assume that they had their development servers on AWS as well.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#29Earlier quoted context omitted.
How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?
I guess we could argue that if you get security seriously enough you don't get hacked. EDIT: I was being sarcastic. This is a good read: https://www.schneier.com/essays/archives/2000/04/the_process...
No actually we don't.
Security, if taken seriously is a set of policies related to software and hardware (in the post-Snowden era).
Applying patches like grsecurity, running services through chroot jails, installing IDS systems and reporting tools makes a system (every system) extremely inflexible. Updates become nightmare.
Tuning a system to avoid false positives might take a forever and then the topology/setup/clients/users change. Back to square one again!
New tech like docker or any kind of virtualization are out of question. You probably don't want PHP, Python or Ruby applications. Do you really need JS. Can you debug all the libraries the developers used? Is their responsibility or no, to audit every new shiny framework for security?! Are they going to pay for it? Is it worth it?
The personnel, even the managers, must go through a lot when the systems are secure. More often then than not, people consider standard security measures exaggerations, so they more often than not try to avoid all the hassle. Can you cope with these people, time and again?
And sometimes even taking extreme measures might not be enough[1]. We keep adding layers upon layers at all levels: Development, Sys-admin (now Devops), etc. Can audit every piece of software that comes into the stack? Of course not.
You either have a security team that breaks everyone's balls with audits and strict policies that will cost you money and most startups or even corps can not afford the kind of inflexibility and cost that this brings in.
Security is a trade-off and truth is that most of the times is just additional cost and complexity and even when you're ready to make that trade-off, you're still not invulnerable by any means.
[1] http://www.cnet.com/news/report-of-fbi-back-door-roils-openb...
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#30The centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?