Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update

stackoverflow.blog

Post reply on HN
Print view View original

51–60 of 207 posts

Re: Security Update

#51

Post by ekianjo »

rhamzeh wrote: post #16
kuzimoto wrote: post #3

Earlier quoted context omitted.

I've made it a point to start self hosting anything that's particularly sensitive that I don't want third parties to have access to. KeePass and SyncThing probably have my most important information, and it's all owned by me.

I hear you. But I worry that that's not enough. I trust Syncthing and the (many) Keepass (X/C)++ developers, but how hard really would it be to slip something in unnoticed. All it requires is some minuscule bug somewhere. It doesn't need to be in the software itself! It can be in the compiler, or in the crypto or in the machine running it. If the OpenSSL debacle taught us, open source and the fact that many people ca…

> All it requires is some minuscule bug somewhere

You can say the exact same thing for any proprietary software or web service. The point of self-hosting is reducing the attack surface and probability of an attack.

Re: Security Update

#52

Post by mehrdadn »

rhamzeh wrote: post #37
mehrdadn wrote: post #22

Earlier quoted context omitted.

Why offline? (And how do you sync?)

I feel it's slightly better to rely on something else for the syncing (even better if you do it manually). I just feel like a password safe would have a draw immense interest from bad actors, so you marginally decrease your chances by using something else for syncing. That way if password storage code was compromised somehow, it can't do much. Then again, a password storage solution is probably investing so much more…

What kinds of threats are you imagining though? KeePass2Android doesn't e.g. open any listening ports does it (I haven't checked)? (Not that NAT would make it easy to connect to it if it did anyway?) Are you imagining it would "accidentally" open a port? And you don't browse the web on it or otherwise run untrusted code on it. How are you imagining it would possibly get hacked? If it's connecting to e.g. Google Drive, then Google Drive or your DNS would need to get hacked somehow, and I'd hope it's checking certificates to prevent that (shouldn't be hard to verify this if this is your concern). If it's via Syncthing, your Syncthing would need to get hacked. In both cases your database would be hacked in which case you'd have the same issue with the offline version too...

OTOH you're losing entry-level syncing which is quite the inconvenience...

Re: Security Update

#53

Post by Reedx »

rhamzeh wrote: post #2

I think we've reached a point where it's safe to say that if you're using a service - _,any_ service - assume your data is breached (or willingly given) and accessible to some unknown third party. That third party can be the government, it can be some random marketer or it can be a malicious hacker. Just hope that you have nothing anywhere that may be of interest or value to anyone, anywhere. Good luck.

Just imagine a Gmail or Mint breach. Oy.

Re: Security Update

#54

Post by rcfox »

mehrdadn wrote: post #18
solidasparagus wrote: post #15

Earlier quoted context omitted.

I think this belief that personally run software is more secure than professionally run software is a bit optimistic.

It doesn't have to be more secure, it just has to be less likely to get hacked.

I'm not sure that off-the-shelf software on your own server is necessarily less likely to get hacked. It's easy to fall behind on security updates when you don't think about deploys regularly.

Look at the logs for your existing infrastructure. I can pretty much guarantee that there are drive-by Wordpress attacks, regardless of what software is actually serving requests. There will be ssh login attempts.

Re: Security Update

#55

Post by hellcow »

shpx wrote: post #43
StavrosK wrote: post #17

Earlier quoted context omitted.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

Last I checked, Chrome on desktop stores all your passwords in plaintext on disk. Unless something's changed... I wouldn't use that.

Firefox at least offers you the ability to set a master password to encrypt all the rest.

Re: Security Update

#56

Post by beachy »

toomuchtodo wrote: post #46
beachy wrote: post #35

Earlier quoted context omitted.

This is a great idea and someone should do it. Specialize in storing personal data (name, address etc.) Provide APIs that only allow gentle exfiltration of data. e.g. Have alternate paths (e.g. manual procedures) when greater volumes are required (e.g. for disaster recovery testing). Then get it audited to death by some serious security firms.

Would this be something companies would pay for?

A FAANG wouldn't, but a corporate building e.g. a second-tier system holding customer data might.

Re: Security Update

#57

Post by judge2020 »

identity0 wrote: post #49
shpx wrote: post #43

Earlier quoted context omitted.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

Pretty sure every single modern browsers has that. The downside with using chrome is handing all your browsing history and bookmarks to Google.

Unless they on-the-fly decrypt your chrome sync (which would require non-encrypted password storing), the stuff you sync to Google is encrypted with your Google password, and if you're paranoid, you can encrypt the sync with a separate password.

Re: Security Update

#58

Post by paxys »

plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

So, a database?

Re: Security Update

#59

Post by mey »

Reedx wrote: post #53
rhamzeh wrote: post #2

I think we've reached a point where it's safe to say that if you're using a service - _,any_ service - assume your data is breached (or willingly given) and accessible to some unknown third party. That third party can be the government, it can be some random marketer or it can be a malicious hacker. Just hope that you have nothing anywhere that may be of interest or value to anyone, anywhere. Good luck.

Just imagine a Gmail or Mint breach. Oy.

Quickbooks Online would also be horrific

Re: Security Update

#60

Post by Sea_Wulf »

9nGQluzmnq3M wrote: post #40

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

If Stack Overflow's enterprise knowledge management systems were breached then that could potentially be a big deal. A release of knowledge on development and production systems from companies could potentially lead to larger hacks in the future.

Of course, that is all speculative until the extent of the breach is released. From the press release, they seem to imply that the only affected areas were public facing.

Post reply on HN