Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

121–130 of 277 posts

Re: Matrix.org hacked

#121

Post by nurettin »

hutzlibu wrote: post #48
zaarn wrote: post #6

Doesn't surprise me that much, Matrix doesn't seem to be too concerned with security, more with security theatre (considering you can still not easily disable read receipts in your client, a major privacy leak IMO, among other issues).

Maybe you should disclose, that you have a personal dispute with the founder of Matrix.

Maybe you should just leave this mentality of "if said thing disapproves of somoene's business, the person saying the thing must be opposed to someone in person." behind.

Because with this mentality of yours means you have a personal dispute with me. Better disclose that before saying such things.

Re: Matrix.org hacked

#122

Post by lbeltrame »

tannhaeuser wrote: post #69
pferde wrote: post #44

Earlier quoted context omitted.

While you bring up valid concerns about the Matrix team's security hygiene, the point of an open standard is that anyone can (try to) spot flaws in it, and anyone can (try to) create their own implementation. I myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix for anything non-ephemeral - even if it takes years. Perhaps I'll even try my hand at writing a c…

> myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix Good luck with that. Right now there's only the centralized matrix.org server, or actually there isn't because it's down. If you want open standards and multiple servers (or your own) use XMPP period. It's not so much a technical question as it is the attitude of "hey we're implementing our own chat proto…

> Right now there's only the centralized matrix.org server,

I wasn't affected one bit by the outage. Why? Because I run my own homeserver.

Re: Matrix.org hacked

#123

Post by lelf »

laumars wrote: post #101
lelf wrote: post #80

Earlier quoted context omitted.

Of course you can. It’s «ESC .» or «^[.» Or you can check “Profiles → Keyboard → Use Option as Meta” for Terminal.app [or just press ⌥⌘O]. And then use option as meta.

> Of course you can. It’s «ESC .» or «^[.» Thanks, I wasn't aware of that. However it's a different hotkey and only pulls the last parameter. The shell I use, you could hit + and you would get a parameter of that number completed - not just the last parameter. It was very handy for rebuilding long command lines with different arguments. > Or you can check “Profiles → Keyboard → Use Option as Meta” for Terminal.app [o…

ctrl-meta-y (readline’s yank-nth-arg) pulls any argument.

Re: Matrix.org hacked

#124

Post by metafunctor »

syntonym wrote: post #119
metafunctor wrote: post #110

Earlier quoted context omitted.

Do you keep your keys on the proxy host, then? Otherwise, "ForwardAgent yes" and you're back to the same situation.

ProxyJump uses the keys from the original host, not the proxy host.

I know. That's why I asked. Chained agent forwarding will serve your keys just the same, so ProxyJump is not "a secure alternative that achieves the same outcome".

Re: Matrix.org hacked

#125

Post by felipelemos »

DblPlusUngood wrote: post #116
aidos wrote: post #99

Earlier quoted context omitted.

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.

OpenSSH does have confirmation: use the '-c' switch to ssh-add. https://man.openbsd.org/ssh-add

This could be a sane default.

Re: Matrix.org hacked

#126

Post by syntonym »

notyourday wrote: post #106
Arathorn wrote: post #53

Project lead for Matrix.org here - you can see our initial statement on this at http://matrix.org/blog/2019/04/11/security-incident/ . It will be updated shortly to reflect the DNS defacement linked here (which was because we failed to rotate a leaked cloudflare API token; we aimed to rotate the master API token but rotated a personal one instead). To our knowledge the rebuilt production infrastructure itself is secu…

Have you implemented hole punching?

What is hole punching and how would it have helped against the attack?

I only know the term for UDP firewall transversal.

Re: Matrix.org hacked

#127

Post by hutzlibu »

nurettin wrote: post #121
hutzlibu wrote: post #48

Earlier quoted context omitted.

Maybe you should disclose, that you have a personal dispute with the founder of Matrix.

Maybe you should just leave this mentality of "if said thing disapproves of somoene's business, the person saying the thing must be opposed to someone in person." behind. Because with this mentality of yours means you have a personal dispute with me. Better disclose that before saying such things.

"means you have a personal dispute with me"

I never talked to you, unless you are the same guy who "operates the single federated independent matrix server" and who does have a personal dispute with matrix.

It seems you confused your socket accounts?

https://news.ycombinator.com/item?id=19418111

Re: Matrix.org hacked

#128

Post by [deleted] »

metafunctor wrote: post #109
scanr wrote: post #93

Earlier quoted context omitted.

Is there a secure alternative that achieves the same outcome?

Here are a few ideas that might help. Use separate keyboard-interactive 2FA (I recommend google-authenticator) for production ssh access. Use a key system which requires confirmation or a PIN to authenticate (such as a Yubikey). Use a persisting ssh connection with Ansible (ControlPersist) to avoid unnecessary multiple authentications. Allow connections only from whitelisted IPs, or Uuse port knocking to open tempora…

[deleted]

Re: Matrix.org hacked

#129

Post by majewsky »

comboy wrote: post #81
dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

> The matrix.org homeserver has been rebuilt and is running securely; We should have more bounties. Let users donate and put wallets on servers. Attacker will be able to take these funds. It's a reasonable measure of an infrastructure security.

To avoid perverse incentives, you should also build in some reward for the developers/operators. As in: If the server gets hacked, the money goes to the whitehat. If the server does not get hacked for $TIMEFRAME, the money goes to the people responsible for its security.

Re: Matrix.org hacked

#130

Post by hutzlibu »

zaarn wrote: post #113
hutzlibu wrote: post #48

Earlier quoted context omitted.

Maybe you should disclose, that you have a personal dispute with the founder of Matrix.

Why should I disclose untrue things? I have no issue, personal or otherwise with the founder.

You edited your post? Before it said, you operated "the" single federated independent Matrix Server.

And there was only one guy doing this as far as I recall.

Post reply on HN