Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#211

Post by gnfurlong »

craftoman wrote: post #203
onei wrote: post #195

Earlier quoted context omitted.

I think "http only" is a bit misleading given [1], but I'm no expert. In essence, apt doesn't use HTTPS because it provides limited value for a package manager. However see the link for a more comprehensive explanation. [1] https://whydoesaptnotusehttps.com

Apt create 20 years ago, it's using HTTP protocol almost everywhere even today. They should have redesigned the whole project and ban the HTTP completely IMHO. I'm using HTTPS even on localhost services when I have for example a project that needs Grafana and influxDB.

I'll admit to being ignorant of apt as my primary distributions aren't debian based, but aren't packages cryptographically signed? If package signatures are validated after download, then it shouldn't matter right? Edit: Skimming and I shamefully didn't the read grandparent post. The link addresses exactly this point.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#213

Post by jhasse »

dlitz wrote: post #173
jhasse wrote: post #155

Earlier quoted context omitted.

Wouldn't that mean you need to find a collision?

I think yall are using the terminology differently from each other in this thread. "Checksum" historically did not imply resilience against intentional modifications. Nowadays, it's arguably a best-practice when designing a new protocol or storage format to simply make all checksums cryptographically strong unless there's a reason not to. I think that might be where the confusion is coming from.

You're right, I confused checksum with hash.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#214

Post by efficax »

ghusbands wrote: post #154

Knowing the hash algorithm, work factor and salting details would be helpful in knowing whether or not passwords may be compromised. This should be standard information given in a breach, rather than just whether passwords were hashed. Though, as they say that passwords need changing, we can safely assume that their salting, hashing and work factor were insufficient and not following best practice. Just like the lack…

Eh, if hashes leaked I would still suggest changing passwords no matter the crypto practices involved. If you change the password, the hash is useless. If you don't, it's sill an attack vector, even if a technically impractical one (for now)

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#215

Post by darkarmani »

gtsteve wrote: post #169
toxik wrote: post #137

Earlier quoted context omitted.

A checksum’s typical use is to detect transmission errors. A cryptographically secure signature is what’s needed.

It uses SHA-256 right? My understanding is that there isn't yet a workable collision attack on the SHA-2 family. Regardless, I think it's certainly an excellent hardening step.

Why do you need a collision? If you control the build, you control the sha-256 hash. But you can't sign it with a key that you don't have.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#216

Post by sterlind »

cyphar wrote: post #158
Polyisoprene wrote: post #150

Earlier quoted context omitted.

You can pull an image using the sha: docker pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2

Which effectively nobody does. Package managers and distribution packaging systems default to the safe method rather then defaulting to insecure rewritable tags. To be fair, the docker.io/library/* images are signed but no other images are and there are a bunch of issues with how the signing policies work for users that want to enforce that some images must be signed.

I do it! Everything I pull is pinned with sha256 since I use Nix/Kubenix, so I'm required to pin sha256 if I'm fetching from the Docker registry (or build the package deterministically myself.)

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#218

Post by billconan »

I’m curious, how can a database be accessed without authorization? If authorization is enabled? Also how unauthorized access can be discovered?

Say I use Mongodb and enabled authorization. Will I be fine then? How to discover unauthorized access?

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#219

Post by windexh8er »

sigotirandolas wrote: post #206
rqs wrote: post #116

Earlier quoted context omitted.

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

I found this snippet on Docker Hub's Linked Account Settings: > Service user (or machine/bot account) suggested > Attaching your personal GitHub or Bitbucket account to this Docker Hub organization will allow other organization owners to create builds from your private repositories. We suggest using a service user (also referred to as a machine user or bot account). c.f.: https://docs.docker.com/docker-cloud/builds/a…

> > Attaching your personal GitHub or Bitbucket account to this Docker Hub organization will allow other organization owners to create builds from your private repositories. We suggest using a service user (also referred to as a machine user or bot account).

> c.f.: https://docs.docker.com/docker-cloud/builds/automated-build/....

Did they remove this language from your link? I don't see it anymore.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#220

Post by jite »

I've seen some failed attempts to log on to my GitHub account from 'Quito, Provincia de Pichincha, Ecuador' (which is quite far from where I live, as I live in Sweden...). Not sure this is related at all, but they started appear after this leak was announced...

Luckily I use both 2fa and random password for github, would suck to loose that account ;)

Post reply on HN