Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gigabytes of user data from hack of Patreon donations site dumped online

arstechnica.com

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#71

Post by RyanZAG »

dspillett wrote: post #66
RyanZAG wrote: post #38

Earlier quoted context omitted.

As others have said, this appears to be a total dump of the system and not just the database. It looks like the encryption keys were not kept with the database, but all of the SSL keys and everything are included inside the full dump. Seemingly it was another server with the keys that was dumped too. The only way to protect against this would be some type of hardware key store with limited access to all employees and…

If the keys are only ever held in memory then getting a dump of all the stored data from all the database and font-end servers would not reveal the keys. To achieve that you would need human interaction to bring up a new box (or after an existing box is restarted) in order to hand over the keys (if the server could request the key from somewhere on the local network, then perhaps so can an attacker if they get access…

One more weak spot: if they have full access to the server, they can just dump the ram. This is incredibly simple to do on Linux for example.

In a big company though, having that one developer with full keys to the kingdom and is the only way to start up new servers is obviously out of the picture. Especially if the system works by having the keys on an easily stolen or damaged laptop...

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#72

Post by StavrosK »

anc84 wrote: post #54
Already__Taken wrote: post #37

Earlier quoted context omitted.

People just won't sign up to a new service for each creator they come across it's that simple.

I wish Mozilla Persona or a similar privacy-protecting feature would succeed.

I wish Mozilla would listen to all of us and start developing Persona again.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#73

Post by gpvos »

raesene4 wrote: post #6
Axsuul wrote: post #5

Why don't more websites that are vulnerable to these types of breaches also encrypt user email addresses as well any personally identifiable information? I don't foresee any performance implications if everything is cached anyways.

the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.

Just thinking aloud here, but if your user name is the email address, you could actually store a hash of the user name, use that to look up the account and verify the login, then keep a map from the hash to the user-entered name in an in-memory database. This way the user name (email address) never gets stored.

This would also work when someone has forgotten their password, as long as they don't forget the email address they used to sign up. (This is actually the only reason why the user name has to be the same as the email address.)

You can't send regular information emails with this, though.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#74

Post by [deleted] »

caio1982 wrote: post #70
dublinclontarf wrote: post #22

I'm wondering what their setup is? Are they running on their own machines? AWS? Heroku? From looking at their careers the use PostgreSQL/MySQL, Python, Scala, Ruby, Node. I am assuming because of the nature of the breach that they are running their own servers (either on AWS or their own machines), it's a completely compromised server which had access to everything.

It doesn't tell you everything but it helps: http://builtwith.com/patreon.com

[deleted]

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#75

Post by ceejayoz »

rjtavares wrote: post #26
icebraining wrote: post #14

Earlier quoted context omitted.

How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?

The same way you do it for medical negligence: courts.

I'd really rather not see web developers have to carry malpractice insurance and be licensed by state boards.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#76

Post by icebraining »

BurningFrog wrote: post #67
icebraining wrote: post #64

Earlier quoted context omitted.

The information that they didn't store CC cards was available in FAQs previously: https://patreon.zendesk.com/hc/en-us/articles/203913779-Do-y... The password hashing algorithm wasn't, but then again an informed consumer uses unique passwords for each site, so that's less relevant.

Many informed customers - perhaps most - use the same passwords on many sites because it's too hard to remember hundreds of passwords.

I don't think they're particularly informed if they aren't aware of password managers.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#77

Post by jerf »

anc84 wrote: post #30

The centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?

"Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?"

That had many years to happen. It objectively didn't happen. Fact trumps theory.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#78

Post by sp332 »

icebraining wrote: post #76
BurningFrog wrote: post #67

Earlier quoted context omitted.

Many informed customers - perhaps most - use the same passwords on many sites because it's too hard to remember hundreds of passwords.

I don't think they're particularly informed if they aren't aware of password managers.

They may be informed and "aware" that password managers are a pain to use compared to using the same password for every site.

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#79

Post by sp332 »

deanCommie wrote: post #21

This is the first time I've been Pwned ( https://haveibeenpwned.com/ ) Does anyone know a responsible way I can check WHICH of my data has leaked short of downloading the entire archive and searching for myself?

You should have received an email with this information from Patreon. You can read the notice here as well https://www.patreon.com/posts/3457485

Re: Gigabytes of user data from hack of Patreon donations site dumped online

#80

Post by pjc50 »

icebraining wrote: post #76
BurningFrog wrote: post #67

Earlier quoted context omitted.

Many informed customers - perhaps most - use the same passwords on many sites because it's too hard to remember hundreds of passwords.

I don't think they're particularly informed if they aren't aware of password managers.

I'm aware, I just can't be bothered. Every time I create an account I ask myself "do I care if this gets compromised?". If the answer is no, then it gets a standard password.
Post reply on HN