Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update

stackoverflow.blog

Post reply on HN
Print view View original

41–50 of 207 posts

Re: Security Update

#41

Post by mehrdadn »

baroffoos wrote: post #31
mehrdadn wrote: post #25

Earlier quoted context omitted.

Sure. Nobody claimed you could get the risk down to zero.

Its even more of a risk potentially because big companies have people full time working on keeping systems up to date and monitored. How many self hosters have a full monitoring system powerful enough to detect attacks and keep their software up to date and secured as soon as updates come out? How many people self hosting are even qualified to run a secure system? I bet most of them are just regular devs who know jus…

I don't think you understood my point. Yes, one particular risk might be higher. But you don't need to do security better or even on par with a big company. You just need your total risk of data exposure to be lower. You can bet big companies have lots of hackers trying to break into them with the newest 0-days, spearphish their employees, etc... there are so many threats you practically don't face if you're self-hosting.

Re: Security Update

#42

Post by herpderperator »

StavrosK wrote: post #17
kuzimoto wrote: post #3

Earlier quoted context omitted.

I've made it a point to start self hosting anything that's particularly sensitive that I don't want third parties to have access to. KeePass and SyncThing probably have my most important information, and it's all owned by me.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

After using KeePass2Android for the last 5 years I decided to donate to the author. It has truly been a useful piece of software for me.

I sync with Seafile over WebDAV.

Re: Security Update

#43

Post by shpx »

StavrosK wrote: post #17
kuzimoto wrote: post #3

Earlier quoted context omitted.

I've made it a point to start self hosting anything that's particularly sensitive that I don't want third parties to have access to. KeePass and SyncThing probably have my most important information, and it's all owned by me.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps.

The only thing I miss sometimes is you can't manually add passwords.

Re: Security Update

#44

Post by smelendez »

9nGQluzmnq3M wrote: post #40

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

And passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.

Re: Security Update

#46

Post by toomuchtodo »

beachy wrote: post #35
plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

This is a great idea and someone should do it. Specialize in storing personal data (name, address etc.) Provide APIs that only allow gentle exfiltration of data. e.g. Have alternate paths (e.g. manual procedures) when greater volumes are required (e.g. for disaster recovery testing). Then get it audited to death by some serious security firms.

Would this be something companies would pay for?

Re: Security Update

#47

Post by 9nGQluzmnq3M »

smelendez wrote: post #44
9nGQluzmnq3M wrote: post #40

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

And passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.

I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.

Re: Security Update

#48

Post by CydeWeys »

Hackbraten wrote: post #34
baroffoos wrote: post #21

Earlier quoted context omitted.

Less likely to have targeted attacks but you are still at risk of someone finding an exploit in the software and sending a bot to scan the internet for the software

I thought this kind of attack was usually done with relatively old bugs, for which patches are often available. If you sat on a fresh exploit, would you really waste it with automated, untargeted mass scans, which may draw a lot of attention, causing your bug to burn out quickly?

Um, yes? You'd use it as widely and as quickly as possible, ideally compromising every single vulnerable host on the entire Internet before any sort of coordinated response can be mounted.

You see these kinds of attacks frequently with cryptolocking/cryptojacking software. The more quickly you deploy an attack targeting a new vulnerability, the more victims you'll have.

Re: Security Update

#49

Post by identity0 »

shpx wrote: post #43
StavrosK wrote: post #17

Earlier quoted context omitted.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

Pretty sure every single modern browsers has that. The downside with using chrome is handing all your browsing history and bookmarks to Google.

Re: Security Update

#50

Post by bpye »

herpderperator wrote: post #42
StavrosK wrote: post #17

Earlier quoted context omitted.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

After using KeePass2Android for the last 5 years I decided to donate to the author. It has truly been a useful piece of software for me. I sync with Seafile over WebDAV.

I should check out Seafile...
Post reply on HN