Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HipChat security notice

blog.hipchat.com

Post reply on HN
Print view View original

91–100 of 119 posts

Re: HipChat security notice

#91

Post by Godel_unicode »

bjoernw wrote: post #89
MichaelGlass wrote: post #71

Earlier quoted context omitted.

My assumption has always been that companies large enough to have a security team also have better security practices than my small company. E.g. I'd guess Atlassian infrastructure folks don't share ssh keys over chat. Maybe they do.

When a zero day drops the size of the security team is irrelevant.

Who do you think is responsible for detecting a breach with that 0day? How about containing (and ensuring your believed containment is effective) and eradicating it? Would you rather have a dedicated security team do this, or would you prefer to have your devs wipe and rebuild naively, hoping they got everything? Even if you go MSSP, do they know your network?

Security is just as much (if not more) responding to a breach effectively and quickly as it is preventing one.

Re: HipChat security notice

#92

Post by Consultant32452 »

problems wrote: post #31

Doubt this will be a popular view around here, but using a 3rd party service for internal business communications is just a bad idea. I've seen companies posting root passwords, ssh keys, salaries, internal financial details, etc in Slack and HipChat. Just waiting for a disaster to strike, adding value for every additional company to the target. Maybe this breach won't be the last straw, but it's a consistent risk. Y…

I had a gig at a company that used Hipchat once. I generally like the app, but I was shocked/appalled that posting files to the chat got uploaded to the AWS cloud with a URL that is retrievable anywhere. Do you know how often things like logs, config files, etc. got posted to chats? That place wrote insurance software too, so plenty of juicy financial information in their systems.

Re: HipChat security notice

#93

Post by briandear »

Consultant32452 wrote: post #92
problems wrote: post #31

Doubt this will be a popular view around here, but using a 3rd party service for internal business communications is just a bad idea. I've seen companies posting root passwords, ssh keys, salaries, internal financial details, etc in Slack and HipChat. Just waiting for a disaster to strike, adding value for every additional company to the target. Maybe this breach won't be the last straw, but it's a consistent risk. Y…

I had a gig at a company that used Hipchat once. I generally like the app, but I was shocked/appalled that posting files to the chat got uploaded to the AWS cloud with a URL that is retrievable anywhere. Do you know how often things like logs, config files, etc. got posted to chats? That place wrote insurance software too, so plenty of juicy financial information in their systems.

HipChat has been a pile of crap for a long time. Why people willingly use that over Slack remains a mystery.

Re: HipChat security notice

#94

Post by [deleted] »

akerl_ wrote: post #66
jordache wrote: post #15

WTF? I got the email from HipChat. It includes this sentence. Without additional non-techy context "HipChat hashes passwords using bcrypt with a random salt." This is a good example of how not to do mass e-mails targeting the general population.

If they'd just said "We securely store your passwords", they would have tech people with pitchforks and torches about how they need to name their password hashing algorithm. If they'd explained both ways, somebody would accuse them of the notification being too long as part of a scheme to bury the details below the fold. As a company reporting an issue, no matter what you do, the internet's gonna nit pick

[deleted]

Re: HipChat security notice

#95

Post by mirashii »

fao_ wrote: post #84
Gaelan wrote: post #57

Earlier quoted context omitted.

What about private code on GitHub? Email/files on Google? Heck, customer data in AWS?

You can host your own versions of them. For that extra layer of security, you can stick them behind a domain that's only accessable behind a company-wide VPN.

What about using one of those pesky popular operating systems that everyone else uses. They're such big targets, using them only increases the bounty someone would get if they exploited them. You can build your own internal operating system to minimize the risk that anyone can break into your company's machines.

Re: HipChat security notice

#96

Post by problems »

mirashii wrote: post #95
fao_ wrote: post #84

Earlier quoted context omitted.

You can host your own versions of them. For that extra layer of security, you can stick them behind a domain that's only accessable behind a company-wide VPN.

What about using one of those pesky popular operating systems that everyone else uses. They're such big targets, using them only increases the bounty someone would get if they exploited them. You can build your own internal operating system to minimize the risk that anyone can break into your company's machines.

That's a bit different - no one here is suggesting recreating tools, merely using existing tools in a more secure manner and segmenting them off from the general public and sometimes the rest of your network too. Lowering your attack surface is often the cheapest way to stop attacks.

Re: HipChat security notice

#97

Post by Jach »

925dk wrote: post #11

Why are they force resetting everyone's password if they are bcrypt'ed?

Bcrypt isn't magic. It will help slow down a full crack against everyone when every pw takes some tens of ms to check (though even if they had a hefty work factor of 1 second on a beefy ec2 instance, you can check a million accounts for 'password' in 11.5 days on a single machine, much less when you can spin up many more instances / leverage a botnet of many if less powerful machines). And if you want to target an individual user, you can try a million different PWs on their account over the same period. That's why it's best practice for everyone to rotate, though if your PW is complex and you're not a particularly juicy target you can probably get away with not doing it right now.

Re: HipChat security notice

#98

Post by X-Istence »

briandear wrote: post #93
Consultant32452 wrote: post #92

Earlier quoted context omitted.

I had a gig at a company that used Hipchat once. I generally like the app, but I was shocked/appalled that posting files to the chat got uploaded to the AWS cloud with a URL that is retrievable anywhere. Do you know how often things like logs, config files, etc. got posted to chats? That place wrote insurance software too, so plenty of juicy financial information in their systems.

HipChat has been a pile of crap for a long time. Why people willingly use that over Slack remains a mystery.

Slack does the same thing... files are uploaded to S3 as well. Slack isn't a panacea when it comes to security.

Re: HipChat security notice

#99

Post by pavel_lishin »

briandear wrote: post #93
Consultant32452 wrote: post #92

Earlier quoted context omitted.

I had a gig at a company that used Hipchat once. I generally like the app, but I was shocked/appalled that posting files to the chat got uploaded to the AWS cloud with a URL that is retrievable anywhere. Do you know how often things like logs, config files, etc. got posted to chats? That place wrote insurance software too, so plenty of juicy financial information in their systems.

HipChat has been a pile of crap for a long time. Why people willingly use that over Slack remains a mystery.

Hipchat offers a self-hosted option, which is a requirement for many companies that very specifically don't want their chat logs and files living in some s3 bucket.

Re: HipChat security notice

#100

Post by Consultant32452 »

briandear wrote: post #93
Consultant32452 wrote: post #92

Earlier quoted context omitted.

I had a gig at a company that used Hipchat once. I generally like the app, but I was shocked/appalled that posting files to the chat got uploaded to the AWS cloud with a URL that is retrievable anywhere. Do you know how often things like logs, config files, etc. got posted to chats? That place wrote insurance software too, so plenty of juicy financial information in their systems.

HipChat has been a pile of crap for a long time. Why people willingly use that over Slack remains a mystery.

As far as usability and all that I really like Hipchat. I haven't gotten the chance to use Slack, but I've got no complaints on the Hipchat application itself. My current megacorp employer uses it as part of a big contract with Atlassian, but ours is hosted internally. I don't know the intimate details of self-hosting, but I assume that mitigates most of the security concerns.
Post reply on HN