Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update

stackoverflow.blog

Post reply on HN
Print view View original

101–110 of 207 posts

Re: Security Update

#101

Post by pvg »

blackoil wrote: post #92
pvg wrote: post #86

Earlier quoted context omitted.

You're going to be entering these passwords into a browser most of the time so if a compromised browser is your problem, no password manager is really going to help you.

That depends on time between compromise and detection. With password manager you'll lose only passwords for sites you actually logged in to. While with browser, you'll lose all passwords instantly.

I'm not sure I follow. If your browser is compromised that's it - it's compromised for everything. Your system is compromised. If I have control over your browser, I don't really need your passwords although I can likely get them out of whatever local password manager you have, to boot.

Re: Security Update

#102

Post by rblatz »

plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

Like azure Key Vault? I’m sure AWS and google have something similar.

Or host your own by using Hashicorp Vault.

Re: Security Update

#103

Post by hkjayakumar »

9nGQluzmnq3M wrote: post #40

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

Possibly StackOverflow Careers data?

Re: Security Update

#105

Post by bredren »

9nGQluzmnq3M wrote: post #47
smelendez wrote: post #44

Earlier quoted context omitted.

And passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.

I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.

I work on an enterprise infosec tool that just demonstrated 48 trillion MD5s per second using AWS GPUs.

Hashed passwords are cracked so easily it is a minor obstacle at this point. It is a question of when not if a hash table is fully cracked.

Re: Security Update

#106

Post by rlt »

> We have not identified any breach of customer or user data.

As usual, this is a meaningless statement. It could mean they have full packet captures they've completely audited, or it could just as easily mean "we don't keep logs of any kind so we have no fucking clue".

Re: Security Update

#107

Post by sroussey »

pavanagrawal123 wrote: post #24
plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

Wouldn't this really just turn into a database as a service?

No. It should prevent something like "SELECT * FROM users WHERE sex="F" and age=18".

Re: Security Update

#108

Post by viraptor »

pavanagrawal123 wrote: post #24
plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

Wouldn't this really just turn into a database as a service?

Since it's users, maybe call it a directory... And since it's changing, maybe even an Active Directory? Like this https://aws.amazon.com/directoryservice/ ?

Re: Security Update

#109

Post by dhritzkiv »

bredren wrote: post #105
9nGQluzmnq3M wrote: post #47

Earlier quoted context omitted.

I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.

I work on an enterprise infosec tool that just demonstrated 48 trillion MD5s per second using AWS GPUs. Hashed passwords are cracked so easily it is a minor obstacle at this point. It is a question of when not if a hash table is fully cracked.

MD5 is one thing as a password can be retrieved from a hash table. But pulling out passwords from a hashed + salted value (e.g. via bcrypt) is many orders of magnitude more infeasible, no?

Re: Security Update

#110

Post by dboreham »

xfitm3 wrote: post #83
nerdbaggy wrote: post #80

Earlier quoted context omitted.

I worked at a company that logged every single SQL query and made a rule set based on that. May not of been the most efficient but it worked great. There was basically a whitelist of sorts and if the query structure wasn’t in there then action taken. Also worked by knowing what queries came in what order when doing certain things.

What tooling did you use to audit queries?

Not parent but it reads like they wrote their own (presumably driven by DB server log data with query logging enabled).
Post reply on HN