Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail pays $6k ransom, gets taken out by DDoS anyway

arstechnica.com

Post reply on HN
Print view View original

91–100 of 233 posts

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#91

Post by SHIT_TALKER »

geofft wrote: post #68
rcurry wrote: post #32

It is always a temptation to an armed and agile nation To call upon a neighbour and to say: -- "We invaded you last night--we are quite prepared to fight, Unless you pay us cash to go away." And that is called asking for Dane-geld, And the people who ask it explain That you've only to pay 'em the Dane-geld And then you'll get rid of the Dane! It is always a temptation for a rich and lazy nation, To puff and look impo…

Poems by the man who romanticized the colonization of my grandparents' country are always cool, but the logic doesn't hold up. If you're not as well-armed as the British Empire, and you very much do not have the resources to defeat the Dane, it's nice that the end of the game is oppression and shame, but you're going to lose well before you even get to endgame.

The British created your grandparents' country and you should be thankful to them for it. It was nothing but fortunate for India to have sensible men like Charles James Napier working to put an end to barbarism like Sati:

A story for which Napier is often noted involved Hindu priests complaining to him about the prohibition of Sati by British authorities. This was the custom of burning a widow alive on the funeral pyre of her husband. As first recounted by his brother William, he replied:

"Be it so. This burning of widows is your custom; prepare the funeral pile. But my nation has also a custom. When men burn women alive we hang them, and confiscate all their property. My carpenters shall therefore erect gibbets on which to hang all concerned when the widow is consumed. Let us all act according to national customs."[1]

[1] https://en.wikipedia.org/wiki/Charles_James_Napier#Service_i...

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#92

Post by jacquesm »

SHIT_TALKER wrote: post #91
geofft wrote: post #68

Earlier quoted context omitted.

Poems by the man who romanticized the colonization of my grandparents' country are always cool, but the logic doesn't hold up. If you're not as well-armed as the British Empire, and you very much do not have the resources to defeat the Dane, it's nice that the end of the game is oppression and shame, but you're going to lose well before you even get to endgame.

The British created your grandparents' country and you should be thankful to them for it. It was nothing but fortunate for India to have sensible men like Charles James Napier working to put an end to barbarism like Sati: A story for which Napier is often noted involved Hindu priests complaining to him about the prohibition of Sati by British authorities. This was the custom of burning a widow alive on the funeral py…

The fact that colonialism had some beneficial side-effects does not make it right and does not oblige anybody to be thankful.

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#93

Post by vskarine »

nickpsecurity wrote: post #27

There's regular security solutions then there's those meant to stop High Strength Attackers. I warned ProtonMail's team and infrastructure wouldn't handle the latter. I was expecting stealth 0-days, though, given there's DDOS mitigations available. That they went down due to DDOS was a bit of a surprise. "Cost estimates for these solutions are around $100,000 per year since there are few service providers able to fig…

You mentioned that you warned ProtonMail's team about High Strength Attackers. What else did you warn them about? What other security flaws do they have in your opinion?

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#94

Post by geofft »

awqrre wrote: post #89
geofft wrote: post #63

I suspect, sadly, this is why Gmail and sites like it will continue to win. Secure email always sounds like a good thing, but it's less important in practice than accessible email. If you have to make a choice between confidentiality, integrity, and availability, for day-to-day email, very few people will choose anything other than availability. (The email deliverability problem doesn't help matters, of course.)

an email server doesn't need to be accessible 100% of the time to guarantee deliverability

By "the email deliverability problem" I'm referring to the problem that only well-known IP addresses get to send mail that doesn't get arbitrarily thrown into spam filters. See e.g. http://liminality.xyz/the-hostile-email-landscape/ , which was front-page here a few weeks back.

If you're just talking about availability, then yes, but this was a sustained DDoS that took their servers down for hours. While the email protocol does insist that the sender should queue and try later, having no new email for hours is not really what people want out of email.

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#95

Post by SHIT_TALKER »

jacquesm wrote: post #92
SHIT_TALKER wrote: post #91

Earlier quoted context omitted.

The British created your grandparents' country and you should be thankful to them for it. It was nothing but fortunate for India to have sensible men like Charles James Napier working to put an end to barbarism like Sati: A story for which Napier is often noted involved Hindu priests complaining to him about the prohibition of Sati by British authorities. This was the custom of burning a widow alive on the funeral py…

The fact that colonialism had some beneficial side-effects does not make it right and does not oblige anybody to be thankful.

When you are weak, you take what you can get. It was much better to have been colonized by the British, who actually had an interest in nation-building and respect for law and human rights (to the extent they deemed their subjects capable of handling them), than, say, to have become the personal fiefdom of Leopold II of Belgium.

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#96

Post by travis2k »

jacquesm wrote: post #66
tim333 wrote: post #47

Earlier quoted context omitted.

>NEVER EVER PAY... you are making the problem larger for others That's true but for the individual payee it can make sense. Trying to get the ransomers back can work. They'll keep at it till they figure they can get harmed.

That's naive. If you pay a ransom they'll be back shortly for more. You've just turned yourself into an ATM for your attackers.

as someone who actually did this in their teens, i ddosed someone for 1 day then asked for a couple thousand bucks, but they wouldnt give any so they were ddosed for like 2 weeks. they ended up paying like 750 and i left them alone after that. they ended up losing like 250 grand in sales, could have been prevented by just paying a measly 2

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#97

Post by jacquesm »

paxtonab wrote: post #73
jacquesm wrote: post #65

Earlier quoted context omitted.

They put their customers in charge of the company? This gets weirder all the time. The problem is that they asked their customers in the first place. They should have simply communicated the fact that they would be under attack shortly and indicate that they would never ever pay a red cent . That would give their customers time to batten the hatches and/or migrate off the system for the time being while sending a cle…

"This was a collective decision taken by all impacted companies" I think they were put under pressure by other companies using the same IPS, not their customers.

That's even weirder. They have obligations to their customers not to their neighbors in the same DC, that's the territory of whoever handles their hosting.

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#98

Post by stingraycharles »

jacquesm wrote: post #86
nkurz wrote: post #82

It seems like the largest threat to the "ransom seeking industry" is for the public to come to believe that paying the the ransom will do no good. Sometimes, such as in cases like this, it becomes publicly known that a ransom is sought before it is paid. An interesting aspect of a Bitcoin ransom is that third parties can verify that a ransom was paid. Would it be in the legitimate interest of the public as a whole fo…

That's an interesting angle, but if traced to the source that source would still be 100% on the hook for any and all fall-out from such an attack and I really wonder if any government entity would be willing to sign off on such a vaccination service.

It doesn't necessarily have to be a government, things like this probably attract more vigilante "Anonymous" type of people anyway.

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#99

Post by ashishchaudhary »

SHIT_TALKER wrote: post #91
geofft wrote: post #68

Earlier quoted context omitted.

Poems by the man who romanticized the colonization of my grandparents' country are always cool, but the logic doesn't hold up. If you're not as well-armed as the British Empire, and you very much do not have the resources to defeat the Dane, it's nice that the end of the game is oppression and shame, but you're going to lose well before you even get to endgame.

The British created your grandparents' country and you should be thankful to them for it. It was nothing but fortunate for India to have sensible men like Charles James Napier working to put an end to barbarism like Sati: A story for which Napier is often noted involved Hindu priests complaining to him about the prohibition of Sati by British authorities. This was the custom of burning a widow alive on the funeral py…

What you say is true to your name. Take a look at https://www.youtube.com/watch?v=f7CW7S0zxv4

Re: ProtonMail pays $6k ransom, gets taken out by DDoS anyway

#100

Post by jacquesm »

SHIT_TALKER wrote: post #95
jacquesm wrote: post #92

Earlier quoted context omitted.

The fact that colonialism had some beneficial side-effects does not make it right and does not oblige anybody to be thankful.

When you are weak, you take what you can get. It was much better to have been colonized by the British, who actually had an interest in nation-building and respect for law and human rights (to the extent they deemed their subjects capable of handling them), than, say, to have become the personal fiefdom of Leopold II of Belgium.

That's a false dichotomy if there ever was one. The alternative to being colonized by the British was not to be colonized by Belgium but not to be colonized at all.
Post reply on HN