Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

181–190 of 277 posts

Re: Matrix.org hacked

#181

Post by jwilk »

yjftsjthsd-h wrote: post #170
dmos62 wrote: post #58

Earlier quoted context omitted.

I do cat x | grep y, because that way you separate out the primary data being passed around and the secondary instructions for how to process it. Preferring functional programming, this is my bread and butter. It´s superior readability and simplicity is something that gets engraved on the inside of your mind after you do a pipe a few hundred times per day every day. This is not about being terse, terseness is almost…

I'm fond of this bashism: `<myfile command | command | etc`

This is portable syntax, not a bashism.

Re: Matrix.org hacked

#182

Post by peterwwillis »

notyourday wrote: post #131
syntonym wrote: post #126

Earlier quoted context omitted.

What is hole punching and how would it have helped against the attack? I only know the term for UDP firewall transversal.

The lame version of port knocking that solves 99.9% of issues. 1. Default policy for access to all of the development environment is deny all. 2. A developer triggers a temporary addition of developers current address to the allow list with an idle timer, punching a hole for developer's edge IP to access the infrastructure. 3. When the idle timer expires or when the developer says "i'm done", the allow rule is remove…

IP whitelisting and port knocking are not serious security methods. They're the very-poor-man's version of a VPN and access control policies, and they're not secure.

Re: Matrix.org hacked

#183

Post by pas »

metafunctor wrote: post #109
scanr wrote: post #93

Earlier quoted context omitted.

Is there a secure alternative that achieves the same outcome?

Here are a few ideas that might help. Use separate keyboard-interactive 2FA (I recommend google-authenticator) for production ssh access. Use a key system which requires confirmation or a PIN to authenticate (such as a Yubikey). Use a persisting ssh connection with Ansible (ControlPersist) to avoid unnecessary multiple authentications. Allow connections only from whitelisted IPs, or Uuse port knocking to open tempora…

https://github.com/StanfordSNR/guardian-agent

Re: Matrix.org hacked

#184

Post by pas »

scanr wrote: post #93
XMPPwocky wrote: post #90

Earlier quoted context omitted.

SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.

Is there a secure alternative that achieves the same outcome?

https://github.com/StanfordSNR/guardian-agent

Re: Matrix.org hacked

#185

Post by MayeulC »

chme wrote: post #82
dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

I would like for matrix protocol and implementation to be better prepared for such cases. While I didn't loose access to the encrypted messages, since I used the 'Encrypted Messages Recovery' function of Riot.im, I guess a lot of people have. Maybe allow to store more information on the client side?

I do not really like the fact that this feature can only backup keys server-side, so I did not enable it.

I do however have a keys backup dating back some time, that will hopefully restore some of my encrypted messages. But basically, I understand that every encrypted message was at risk of being lost, so it's not that big of a deal.

Re: Matrix.org hacked

#186

Post by [deleted] »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

[deleted]

Re: Matrix.org hacked

#187

Post by notyourday »

peterwwillis wrote: post #182
notyourday wrote: post #131

Earlier quoted context omitted.

The lame version of port knocking that solves 99.9% of issues. 1. Default policy for access to all of the development environment is deny all. 2. A developer triggers a temporary addition of developers current address to the allow list with an idle timer, punching a hole for developer's edge IP to access the infrastructure. 3. When the idle timer expires or when the developer says "i'm done", the allow rule is remove…

IP whitelisting and port knocking are not serious security methods. They're the very-poor-man's version of a VPN and access control policies, and they're not secure.

You are talking about organizations that have GPG private keys used for signing laying around and those that have Jenkins exposed to the outside world.

Dynamic IP white listing and port knocking are perfectly adequate for 99.9% of the organizations.

Re: Matrix.org hacked

#188

Post by notyourday »

viraptor wrote: post #150
notyourday wrote: post #102

Earlier quoted context omitted.

Matrix operational security is a joke and developers understanding of security is a joke. This is 2019, not 1992. Infrastructure with ssh access without hole punching for currently active authorized connections only? Decrypted signing keys accessible over the network? CI servers and developers having root access? Though the "we had to revoke all the keys so you lost access to your encrypted messages unless you backed…

> "we had to revoke all the keys so you lost access to your encrypted messages unless you backed them up" takes the cake This is just how it works. It's been well documented and mobile clients got updates that backs up the keys automatically. It's also effectively the same as WhatsApp and some other IMs (they just don't even save your encrypted messages). Either way - backup, or lose your history.

I stand by the assertion that it indicates the Matrix people are clueless.

If this is a design constraint, then the security model needs to accommodate that the user keys are the pot of gold, which means that there needs to be a service provided by a dedicated server which is inaccessible in the course of normal operation via any means other than a well defined braindead simple protocol :: providing the message manipulations/key store functions from only other authorized production hosts that need to be able to access this functionality.

The server running the service should have a security policy that would prevent one from running any software that is not supposed to be already present on a server ( use SELinux enforcement policy ) to minimize the attack surface; have its own SSH keys not generally accessible during the normal operation, be accessible only from specific IP addresses, etc etc etc. If it is on AWS, it should probably be in a separate account.

Re: Matrix.org hacked

#189

Post by dijit »

proy24 wrote: post #177
wink wrote: post #156

I think it boils down to the fact that infrastructure for projects (no matter the size) is usually a second class citizen at best. Either no one is eager to care for it, or the people who are actually focused on developing the software run it because they need to, or worst case - no contributor is trusted enough to handle infrastructure work, with access being given even more sparsely than commit rights to the whole…

It's just a problem with the industry that's like "let's just get something out there and achieve product market first..will worry about infra and security later" that later is just pushed into a backlog and forgotten.

As a classically trained sysadmin I've seen this trend going for the last decade.

Some developers seem to be pushing that ops shouldn't exist any longer or should be outsourced to google (who don't hire ops) or amazon (who do).

Managers see this trend and think that hiring only developers is a good way to save costs and do things the "new way".

Traditional ops roles are indeed not as required but security/process/reliability focused people should not be the same people who write new features. They're in contradiction of each other often.

If you're a developer who thinks ops shouldn't exist any longer consider this:

I can write software and design websites as a sysadmin, does that mean I don't need you now, or that I know everything you do?

I argue that it doesn't. A focus on automation is one thing but defenestrating the notion of operations/SRE is going to net you a bad time.

Re: Matrix.org hacked

#190

Post by upofadown »

kzcqt wrote: post #43
growt wrote: post #40

I'm probably really out of the loop, but what is matrix.org? Looks like an open source slack clone? Why do they have >5 million user accounts? Is that everybody who uses that chat tool?

Matrix is what happened when somebody looked at XMPP and yelled "NIH".

More they looked at IRC/Slack, isn't it? I suppose you could compare it with XMPP group chat which has recently gotten end to end encrypted.
Post reply on HN