Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

331–340 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#331

Post by m00x »

dtech wrote: post #256
lmilcin wrote: post #206

Earlier quoted context omitted.

That's incorrect. The usual way of using this service is to have backend network configured that connects your services that is not available from outside (ie you have to traverse through services to reach it). The so called "security" is just a paid feature for companies that want to use ElasticSearch but want to use it in "legacy" way because, presumably, they don't have people to design it correctly.

That's still really insecure, because it means that as soon as someone manages to gain any access to that network or any of the services on that network has a security issue your database is wide open. That means that if someone manages to get access to the. I'd say public internet with proper (encrypted) password auth is more secure than that.

If an attacker gets a hold of your app server, they will be able to get the connection details for that DB, including the username/password.

Having a password adds a small layer of protection to databases that the affected app wasn't meant to connect to.

It adds some protection in that case, but the user should use best judgement if it's worth doing.

Re: Personal and social information of 1.2B people discovered in data leak

#332

Post by layoutIfNeeded »

acangiano wrote: post #329
skissane wrote: post #207

Earlier quoted context omitted.

My gmail is my first initial followed by my last name. There are other people on this planet with same first initial and last name, some of whom seem to think that must be their email too, because I keep on getting emails where they used it to sign up for things.

I get several on a weekly basis. It's amazing how many services do not verify emails and just trust their users to own the email they claim to own.

It’s a common “growth hack” to postpone email verification.

Re: Personal and social information of 1.2B people discovered in data leak

#333

Post by geofft »

YawningAngel wrote: post #313
GhettoMaestro wrote: post #273

Earlier quoted context omitted.

> At some point you just have to call out people for being utter morons. The blame is on them, 100%. [...] Your attitude is a symptom of a broader issue that plagues this industry: Indifference to risk*probability. If you don't ship software with "secure defaults" (depending on the threat/attack model), you essentially are handing out loaded shotguns, then blaming the "dumb" user when they inevitably point it at thei…

Is it a secondary concern, though? As a startup, uptake is as vital as oxygen

If startups prioritize their growth over the good of society, isn't the logical conclusion that startups are a threat to society?

Re: Personal and social information of 1.2B people discovered in data leak

#334

Post by m00x »

z3t4 wrote: post #275
jillesvangurp wrote: post #187

Earlier quoted context omitted.

It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…

Software should be secure by default. Don't blame the user. mySQL in comparison wont even let you install without setting a root password. And it only listen on localhost/unix-socket by default. Then you need to explicitly add another user if you want to allow it to login from a non local ip. I don't think it's even possible - to both set a blank root password and allow it to login from a public IP. So you really thi…

This is ridiculous.

Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96.

Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL injections, insecure cryptography. Security is part of our job and matters we must know.

You don't blame a plane for a pilot mistake that was meant to be part of his training. Engineers in every other sector are responsible for their mistakes, we should be too.

Also, you don't sue the worker, you sue the company.

Re: Personal and social information of 1.2B people discovered in data leak

#335

Post by phatfish »

rohan1024 wrote: post #18

Firefox monitor can tell you if your information was leaked in data breaches. I don't think they have this data set though. https://monitor.firefox.com/

Mozilla are now reporting on this data set. Top marks for getting it online so quickly.

Re: Personal and social information of 1.2B people discovered in data leak

#336

Post by ta999999171 »

wizzwizz4 wrote: post #254
dmw_ng wrote: post #214

Earlier quoted context omitted.

I signed up for a disposable Gmail account using my real name at one point, and accepted the randomly suggested address it offered. Gmail loaded with someone else's obviously in use mailbox IIRC I logged out again and back in, same thing, my credentials worked. Went back to it a few days later and the password no longer worked

Hash collisions most likely.

Have heard this so many times about Gmail...

How have they not resolved this?

Re: Personal and social information of 1.2B people discovered in data leak

#337

Post by staticassertion »

jwandborg wrote: post #330
staticassertion wrote: post #325

Earlier quoted context omitted.

Other databases learned that not requiring a user/password upon install is completely irresponsible. ES and other dbs need to catch up ASAP, it's ridiculous. Documentation is not security. If you need to "RTFM" to not be in an ownable state it's ES's fault.

Trusting software you install to be secure is ridiculous and completely irresponsible, especially if you did not pay for someone else to take the blame. The only thing you can do to secure your software is to restrict its communication channels. Once you've secured the communication channels, the software auth is decorative at best.

That doesn't absolve ES of providing basic security defaults.

Re: Personal and social information of 1.2B people discovered in data leak

#338

Post by miohtama »

m00x wrote: post #334
z3t4 wrote: post #275

Earlier quoted context omitted.

Software should be secure by default. Don't blame the user. mySQL in comparison wont even let you install without setting a root password. And it only listen on localhost/unix-socket by default. Then you need to explicitly add another user if you want to allow it to login from a non local ip. I don't think it's even possible - to both set a blank root password and allow it to login from a public IP. So you really thi…

This is ridiculous. Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96 . Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL inj…

Onions. You need layers and defense in depth. Because even the best humans make mistakes and it is inhuman to assume perfectionism. Never rely on just one engineering feature.

Re: Personal and social information of 1.2B people discovered in data leak

#339

Post by [deleted] »

jwandborg wrote: post #324
cobookman wrote: post #222

Earlier quoted context omitted.

There's something called defense in depth. Even with ES deployed in an environment with proper network firewall rules...etc, I'd still want some sort of authentication/RBAC

"Defense in depth" sounds, to me, like a phrase to justify multiple layers of imperfect security. A single layer of cloth might not hold water, adding more layers of cloth may hold water for longer, but it's probably more cost effective to start with the right material.

[deleted]

Re: Personal and social information of 1.2B people discovered in data leak

#340

Post by codetrotter »

jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

> It's indeed really easy to setup. But setting it up properly still requires RTFMing, dismissing the warning above

I would bet that in a lot of cases, people that configure their servers like in the OP just don’t read the official docs at all.

Stack Overflow, Quora, etc. are great places to get answers, because of the huge amount of questions that have already been asked and answered there.

But when people rely solely on SO, Quora, blog posts and other secondary, tertiary, ..., nth-ary sources of information, Bad Stuff will result, because of all the information that is left unsaid on Q&A sites and in blog posts. (Which is fine on its own – the problem is when the reader is ignorant about the unsaid knowledge.)

> and having some clue about what ip addresses and ports are and why having a database with full read write access on a public ip & port is a spectacularly bad idea.

Again, not necessarily, for the same reason as above.

But even if they did, it is a sad fact that a lot of people dismiss concerns over security with the kinds of “counter-arguments” that I am sure we are all too familiar with. :(

Thankfully though, we are beginning to see a shift in legislation being oriented towards protecting the privacy of people whose data is stored by companies.

Ideally, the fines should cause businesses to go bankrupt if they severely mishandle data about people. Realistically that is not what happens. For the most part they will get but a slap on the wrist. But it’s a start.

Companies that can’t handle data securely, have no business handling data at all.

Post reply on HN