Trello handed over my personal account to my previous company • Hacker News Board

Re: Trello handed over my personal account to my previous company

#271

Post by nasalgoat » Fri, Apr 17, 2020, 5:21 PM UTC

necovek wrote: post #267

nasalgoat wrote: post #217

Earlier quoted context omitted.

I worked at a place that had virtually zero internal systems, including version control, and relied heavily on Github in particular for things like access control, beyond just source control. One of their remote devs had his Github account hacked (pre 2FA) and then had access to Slack as well, and the hacker managed to socially engineer his way into a number of sensitive areas and increased access, to the point the c…

But that sounds like a case where the attacker would have gained access to most relevant stuff anyway, and the difference in effect was mostly to the tune of $35k in costs (instead of spending resources on companies' own hardware)? While that's a big chunk for a start-up, it's not even one year of a developer salary. While I am of the similar old school like you (I run my own mail server, web server, nextcloud, used…

It was more that their entire code repo was downloaded, which included a number of third party access codes, nevermind the intellectual property involved.

If that stuff is only hosted internally behind a firewall, with a VPN requirement to access, it would have been fine. Instead it was all on Github.

Re: Trello handed over my personal account to my previous company

#272

Post by necovek » Sat, Apr 18, 2020, 5:35 AM UTC

nasalgoat wrote: post #271

necovek wrote: post #267

Earlier quoted context omitted.

But that sounds like a case where the attacker would have gained access to most relevant stuff anyway, and the difference in effect was mostly to the tune of $35k in costs (instead of spending resources on companies' own hardware)? While that's a big chunk for a start-up, it's not even one year of a developer salary. While I am of the similar old school like you (I run my own mail server, web server, nextcloud, used…

It was more that their entire code repo was downloaded, which included a number of third party access codes, nevermind the intellectual property involved. If that stuff is only hosted internally behind a firewall, with a VPN requirement to access, it would have been fine. Instead it was all on Github.

Right, but if they hacked a particular remote employee who had access to it, they could have gotten access to the same stuff — their attack vectors might have been more limited, that is true.

Re: Trello handed over my personal account to my previous company

#273

Post by ssorallen » Thu, Apr 23, 2020, 10:02 PM UTC

alexis_fr wrote: post #249

ssorallen wrote: post #168

Earlier quoted context omitted.

> It would have been better if Mozilla had added a better interface to profiles. Profiles in Chrome and their ease of use (Cmd+Shift+M to open a new window in a different profile) is the primary reason I still use Chrome over Firefox. I have a Personal, a Work, and a Development profile. The development profile is where I install dev extensions like React Devtools, Redux Devtools, etc. because they require full acces…

Upside of Chrome profiles: Use a bright red theme for prod sysadmin profile, and blue for work. So you never type « p... » on your work profile by mistake... Don’t laugh, usage is widespread.

I do exactly this too: I have 3 distinctly different themes for the three profiles I use. A split second glance at the color of the tab bar informs me which profile I'm working with.

Re: Trello handed over my personal account to my previous company

#274

Post by mjd » Sun, Apr 26, 2020, 6:54 PM UTC

dx034 wrote: post #91

mjd wrote: post #31

They emailed me about this back on January 30: Subject: Your company ExampleCo will soon manage your Trello account Good news! Your Trello account is getting an upgrade. ExampleCo will now manage Trello accounts with a example.com email address, which includes yours (mjd+trello@example.com). The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact…

Isn't it standard to open separate accounts for companies? My employers would've never even allowed me to use a personal account or personal email for business content. In the end, they need to be able to claim the content if an employee leaves the company. Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.

I opened the account with my personal address. Then later, I added a secondary email address to it so that I could post items to my personal account by emailing them from my work email. I didn't realize that Trello would interpret this as the account now being owned by my employer and, in hindsight, I don't think I could have foreseen this.