Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billion-record stolen Chinese database for sale on breach forum

theregister.com

Post reply on HN
Print view View original

41–50 of 258 posts

Re: Billion-record stolen Chinese database for sale on breach forum

#41

Post by toomuchtodo »

compumike wrote: post #40
throwaway787544 wrote: post #21

Earlier quoted context omitted.

Starting today, this will be known as "Shanghai'd credentials" and be reason #1 why we use ephemeral credentials (e.g. AWS STS/SSO) rather than static credentials (e.g. IAM Users)

Doesn't the client still need to know a long-lived secret (or a long-lived refresh token) in order to generate the ephemeral credentials?

It can either use a secret injected into an env var to bootstrap rotating ephemeral/refresh tokens or use a role provided by the environment (which can also provide short lived tokens), depending on your runtime environment and use case (on prem, cloud, k8s, etc).

Static, long lived secrets with limited governance that have no conditional access guards are weapons of mass self destruction.

Re: Billion-record stolen Chinese database for sale on breach forum

#42

Post by samus »

t_mann wrote: post #36
MadsRC wrote: post #18

Earlier quoted context omitted.

IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to ident…

Church books were used to find Jews? Do you have a source for that?

Antisemitism was not really about religion. Many Jews had actually converted to Christianity for generations. The Nazis still considered them to be Jews.

Re: Billion-record stolen Chinese database for sale on breach forum

#43

Post by JamesSwift »

luke-stanley wrote: post #8

In 2018 I saw a local branch office were using Windows XP and an old Internet Explorer. You cannot expect that to be secure. This does not surprise me at all.

A lot of those are actually pirated/modified installs of Windows. I think its called Tomato Windows or something like that? I forget, but its incredibly prevalent in China.

Re: Billion-record stolen Chinese database for sale on breach forum

#46

Post by hutzlibu »

throwaway4good wrote: post #44

Who would buy this? How could anyone possibly make money off this data set? I could understand if the Chinese government would pay for it to avoid embarrassment but making the sale public kinda voids that.

"Who would buy this?"

Foreign intelligence agencies for classic espionage. If you want to do blackmailing in china, such a DB would be a good start.

Otherwise, data brokers. Advertisement, financial credibility, trustworthines of buisness partners etc.

Re: Billion-record stolen Chinese database for sale on breach forum

#48

Post by toomuchtodo »

throwaway2037 wrote: post #30
throwaway787544 wrote: post #21

Earlier quoted context omitted.

Starting today, this will be known as "Shanghai'd credentials" and be reason #1 why we use ephemeral credentials (e.g. AWS STS/SSO) rather than static credentials (e.g. IAM Users)

I never heard about "ephemeral credentials" before your post. I have some Googling to do!

The other term of art is “dynamic secrets.”

https://www.vaultproject.io/use-cases/dynamic-secrets

Re: Billion-record stolen Chinese database for sale on breach forum

#49

Post by TazeTSchnitzel »

t_mann wrote: post #36
MadsRC wrote: post #18

Earlier quoted context omitted.

IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to ident…

Church books were used to find Jews? Do you have a source for that?

It's not a religious thing: in Denmark, the church is the arm of the state tasked with civil registration. Until 1991 it was the same in Sweden.

Re: Billion-record stolen Chinese database for sale on breach forum

#50

Post by mgdlbp »

MadsRC wrote: post #18
pyinstallwoes wrote: post #4

Earlier quoted context omitted.

In history what have databases of people and state actor interests usually led to if any events are similar?

IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to ident…

IIRC there was a central registry of religion in the Netherlands that had the same effect. Can't find anything on that now, though (it's mentioned in Wikipedia in an unsourced paragraph; I think I first read about it on HN, actually).

-----

Tangent: the info pages on the Anne Frank House site have sections cycling through different pastel background colours.[0] I've wondered before whether something like that would the brain acquire context in a long page, making comprehension more like that of a physical book. Seeing it implemented, it doesn't seem to help. I think being able to easily flip to a previous page and back was one of the advantages of printed paper, so maybe a sticky TOC with the same colours or a minimap scrollbar would allow that? Actually, why not have that standard in browsers?

Hmm, the concept of coloured sections was known in 2013 already.[1]

[0] https://www.annefrank.org/en/anne-frank/go-in-depth/netherla...

[1] https://ux.stackexchange.com/questions/62808/website-layout-...

Post reply on HN