Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update

stackoverflow.blog

Post reply on HN
Print view View original

31–40 of 207 posts

Re: Security Update

#31

Post by baroffoos »

mehrdadn wrote: post #25
baroffoos wrote: post #21

Earlier quoted context omitted.

Less likely to have targeted attacks but you are still at risk of someone finding an exploit in the software and sending a bot to scan the internet for the software

Sure. Nobody claimed you could get the risk down to zero.

Its even more of a risk potentially because big companies have people full time working on keeping systems up to date and monitored. How many self hosters have a full monitoring system powerful enough to detect attacks and keep their software up to date and secured as soon as updates come out?

How many people self hosting are even qualified to run a secure system? I bet most of them are just regular devs who know just enough about linux to get something online.

Re: Security Update

#32

Post by toyg »

plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

A single target for all gangsters on the planet? A convenient one-stop-shop, as opposed to having to penetrate multiple different services with vastly different technology stacks and protections and to then normalize data stored in a multitude of different formats? Sounds great, for attackers.

Re: Security Update

#34

Post by Hackbraten »

baroffoos wrote: post #21
mehrdadn wrote: post #18

Earlier quoted context omitted.

It doesn't have to be more secure, it just has to be less likely to get hacked.

Less likely to have targeted attacks but you are still at risk of someone finding an exploit in the software and sending a bot to scan the internet for the software

I thought this kind of attack was usually done with relatively old bugs, for which patches are often available.

If you sat on a fresh exploit, would you really waste it with automated, untargeted mass scans, which may draw a lot of attention, causing your bug to burn out quickly?

Re: Security Update

#35

Post by beachy »

plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

This is a great idea and someone should do it.

Specialize in storing personal data (name, address etc.)

Provide APIs that only allow gentle exfiltration of data. e.g. Have alternate paths (e.g. manual procedures) when greater volumes are required (e.g. for disaster recovery testing).

Then get it audited to death by some serious security firms.

Re: Security Update

#36

Post by solidasparagus »

baroffoos wrote: post #21
mehrdadn wrote: post #18

Earlier quoted context omitted.

It doesn't have to be more secure, it just has to be less likely to get hacked.

Less likely to have targeted attacks but you are still at risk of someone finding an exploit in the software and sending a bot to scan the internet for the software

Probably more at risk too because how rigorous are you really about staying up to date on the most recent security patches? How much time and money did you actually spend setting up security infrastructure like automated security testing or vulnerability bounties? Enterprises, even many of the ones that have had data breaches, dump a ton of time and money into those areas.

Re: Security Update

#37

Post by rhamzeh »

mehrdadn wrote: post #22
rhamzeh wrote: post #19

Earlier quoted context omitted.

* KeePass2Android Offline :)

Why offline? (And how do you sync?)

I feel it's slightly better to rely on something else for the syncing (even better if you do it manually). I just feel like a password safe would have a draw immense interest from bad actors, so you marginally decrease your chances by using something else for syncing. That way if password storage code was compromised somehow, it can't do much.

Then again, a password storage solution is probably investing so much more into security that it may be actually better than using something else..

Re: Security Update

#39

Post by [deleted] »

rhamzeh wrote: post #2

I think we've reached a point where it's safe to say that if you're using a service - _,any_ service - assume your data is breached (or willingly given) and accessible to some unknown third party. That third party can be the government, it can be some random marketer or it can be a malicious hacker. Just hope that you have nothing anywhere that may be of interest or value to anyone, anywhere. Good luck.

[deleted]

Re: Security Update

#40

Post by 9nGQluzmnq3M »

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/

As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally embarrassing material and many of if not most StackExchange users post with handles easily associated to their real names.

Post reply on HN