101–110 of 120 posts
Earlier quoted context omitted.
It should be mentioned that none of that should ever make its way into a Git repo in the first place. If a secret is committed to Git, it's compromised, period. Suck it up and generate a new secret.
Agreed ... use a pre-commit hook to scan your repository for high-entropy strings before they are forever enshrined in your history ( https://github.com/dxa4481/truffleHog ).
This is one of those cases where I probably should feel bad for the company being repeatedly hacked to the point of being ripe for being shut down, but I just can't muster the will right now. If you are in the business of collecting data without users' explicit permission, and can't protect that data from being accessed or deleted, you shoudln't be in business.
I wish they had done one more thing: notified everyone on whose devices this software was installed. If someone put this on my phone without my knowledge, I would want to know. (I would also almost certainly sue.)
Earlier quoted context omitted.
Do you have a recommended security checklist for something like this? I remember seeing an old github repo with a bunch of good information but I cannot seem to find it and my search results are... unhelpful at best.
You wont like it, but... How would you feel being asked for a checklist for 'good software development' or something similar by a cooking chef? Hire skilled and dedicated DevOps/SRE/SysAdmin/hype-of-the-week person. ;)
This is a good case of vigilante justice, but vigilantism is problematic in general. We should probably be formally outlawing the sort of practices these companies have and also putting in place far stronger real privacy measures for all data-collecting companies. Until (if ever) the law catches up, vigilantism will be better than nothing.
We already have such laws in the US. Two-party consent wiretapping laws at the state level and the Computer Fraud and Abuse Act at the Federal Level.
How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?
This is by design. For the apps on Google Play Store, Google wouldn't look at these because it's been possible to do all these and more using the APIs provided by the Android OS all along, even before the granular runtime permission model came with Android 6 (Marshmallow). I always dread the thought of people not understanding these permissions and letting apps have all kinds of permissions — access to all text messs…
Earlier quoted context omitted.
only if your git is published.. I assume this is what you mean - that said: separate integration repo containing encrypted keys + separate, manual managment/configuration of the decryption process is fine for most cases. but yes, bare and in mainline and published, I will agree this is terrible. see also: http://docs.ansible.com/ansible/2.4/vault.html
No, you should never commit your secrets, not even to a private github repo, and not even to a privately hosted git server. Doing so increases your attack surface, sometimes in surprising ways. Now, if your secrets are encrypted before being committed (using something like ansible vault) and the encryption key is not stored in the repo, that may be ok. However, you still need to be aware that any time you rotate that…
Earlier quoted context omitted.
To be fair, though, history can be rewritten, albeit sometimes with some difficulty.
If a secret has ever been in Git then you probably can't know where it's been copied to and should treat it as likely to have been leaked.
Earlier quoted context omitted.
We already have such laws in the US. Two-party consent wiretapping laws at the state level and the Computer Fraud and Abuse Act at the Federal Level.
I don't know exactly the legal details, but over the past several years "privacy policies" have evolved into some sort of "data use policies" (with no privacy to speak of) and the norm is to use terms on apps to basically give companies access to the most invasive and abusive stuff, and we don't see the legal system doing anything to stop this, as long as it isn't directly in medical or legal contexts…
Earlier quoted context omitted.
Their security was bad, no doubt. I don't see how that justifies deleting their data, though.
Ok. Then what does that justify in your mind?
Earlier quoted context omitted.
Their security was bad, no doubt. I don't see how that justifies deleting their data, though.
??!? Their 'data' includes all the photos YOUR KIDS take on their phones. Do you not realize how much absolutely idiotic shit kids do with their smartphones these days? Which they store in an an obviously unsafe way, as evidenced by the fact that they've been hacked via a super-super-super obvious software flaw... twice (that was widely reported on, most likely many more times). They deserve, and they should get, no…