101–110 of 490 posts
So why are they not invalidating exposed passwords like Github did the other day? At the very least they should have a security alert at the top of your feed or something. Edit: Looks like they are alerting users.
Github didn't invalidate passwords. They sent an email to affected users (or just everyone?) with a generic password reset link ( https://news.ycombinator.com/item?id=16972050 )
Earlier quoted context omitted.
"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?
It isn't a new trend. Section 508 of the Rehabilitation Act legislated that the government purchase accessible software. HIPAA legislated that your medical data be kept secure. Minnesota, Nevada, and Washington have enshrined some or all of PCI DSS into law: https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec... A little farther afield, seat belt technology has been legally mandated to be included in most au…
Earlier quoted context omitted.
seriously? pretty easily. somebody probably left a debug log message in place or something. guaranteed that this happens all the time and most people don't report it.
I doubt anyone left something that logged the plaintext password. No reasonable architecture necessitates holding onto a plaintext password for more than one line of code. One possibility is an HTTP server on the request path after TLS termination. But then why is an HTTP server logging the request body? My guess would be some sort of instrumentation process was blindly reading data in memory without distinguishing w…
POST request comes in from the client. Full URL and request body is logged. Sometimes for simply troubleshooting, sometimes for security reasons (e.g., wanting to know all data coming in so that it's possible to identify security holes after they've been exploited).
POST request comes in from client. Frontend server makes a GET request to a backend server, and the password ends up in the standard request logs. In one case, I've seen this happen because the developer thought path variables were cool, so every API they wrote looked like /a/b/c/d/e. Sigh.
Earlier quoted context omitted.
Why? I have a small app with a few thousand users that generate almost no money but contain sensitive data - if I were to be fine because of a leak, I would be dead financially. Where do you draw the line between the companies that should be fine and those which don't? No matter how advance our technology is or the security measures we take, any system connected to internet somehow will have a leak or an intrusion or…
Are you arguing that you should be allowed to be reckless because you cannot afford the cost of being careful?
For example, a common refrain on HN is how centralized the internet is becoming. Do punitive damages for mistakes prevent mistakes? How likely is it to create an environment where the only organizations that exist are those that can afford mistakes? Is that worth it, especially in the context of some Twitter passwords that were logged internally?
Also, one of the most important awakenings that need to happen in light of recent events is the personal responsibility of who you share your information with. It's just as important as the question of what an organization does with your information.
If there were no trade-offs, then we could fix everything with legislation.
> The glitch was related to Twitter’s use of a technology known as “hashing” that masks passwords as a user enters them by replacing them with numbers and letters, according to the blog. Sigh. They appear to have confused hashing with asterisks. > A bug caused the passwords to be written on an internal computer log before the hashing process was completed, the blog said. So "related" in almost no way whatsoever, then…
> We mask passwords through a process called hashing using a function known as bcrypt, which replaces the actual password with a random set of numbers and letters that are stored in Twitter’s system.
Which is slightly better, I guess.
[0] https://blog.twitter.com/official/en_us/topics/company/2018/...
A couple of steps you can take to reduce the chances of accidentally putting sensitive information in a log. 1. Make a list of all sensitive information that the test users in your test environment will be giving to your application. As part of your test procedure, search all logs for that information. This can be as simple as having a text file with all the sensitive information, and doing a 'grep -F -f sensitive.tx…
Do you know of an elegant way to do this when working with protobufs? Ideally, mark a field 'password', and the generated class' __str__ equivalent returns " "
We need a regulatory rulebook codified in law by congress that fines companies that make these "mistakes". Enough of a fine will force companies to take these "mistakes" seriously. In Yahoo's case, that might have forced Marissa to actually keep a cybersecurity team and not cut them when she knew the systems were in danger of being compromised. We aren't getting any jail time, but hefty fines that don't stifle growth…
I agree. But i'm not sure this sentiment applies here, twitter probably has an amazing security team and its clear that they were using good practices. they found a bug and disclosed the issue to their users.
Are Github & Twitter using the same logging tools/service? Btw, Happy World Password Day!
Earlier quoted context omitted.
Why? I have a small app with a few thousand users that generate almost no money but contain sensitive data - if I were to be fine because of a leak, I would be dead financially. Where do you draw the line between the companies that should be fine and those which don't? No matter how advance our technology is or the security measures we take, any system connected to internet somehow will have a leak or an intrusion or…
I'm not arguing for a fine, but companies should be legally obligated to tell their users when the personal data of their users might have been compromised.
If this happens in a month's time, will they have to pay out $96,000,000 via the GDPR? This came up at my place of work the other day: are data leaks as a result of bugs breaches of the act?
data leaks of course are always a breach and must be reported. that doesnt mean you get a fine though.