Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billion-record stolen Chinese database for sale on breach forum

theregister.com

Post reply on HN
Print view View original

91–100 of 258 posts

Re: Billion-record stolen Chinese database for sale on breach forum

#91

Post by maxbond »

cm2012 wrote: post #85
mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

Well, leak can mean a lot of things. The standard "leak" of names and addresses of people is totally meaningless, though HN "privacy" obsessives blow it out of the water all the time. It's basically public information, we used to have everyone in phone books in the US and almost no one cared. Cell phone number is a riskier one because of the opportunity for 2FA hacks. It's not hard to get people's cell phone numbers…

Names and addresses can absolutely be used to stalk and harass people, and there are password reset flows that involve physically mailing secrets to people. Perhaps almost no one cared about phone books, but if you thought about the differences between phone books and a website for a moment, you'd see that these are different technologies that have different implications, and that it is entirely reasonable for people to have a different reaction.

You've chosen some arbitrary amount of information where you begin to care and become interested, and decided everyone with a different cutoff is an absolutist you don't need to listen to. But it's really just that your situation permits you to leak that information without fear, and you haven't deigned to imagine that other people are in a different situation.

I'd encourage you to rethink this perspective.

Re: Billion-record stolen Chinese database for sale on breach forum

#92

Post by toomuchtodo »

robonerd wrote: post #87
toomuchtodo wrote: post #41

Earlier quoted context omitted.

It can either use a secret injected into an env var to bootstrap rotating ephemeral/refresh tokens or use a role provided by the environment (which can also provide short lived tokens), depending on your runtime environment and use case (on prem, cloud, k8s, etc). Static, long lived secrets with limited governance that have no conditional access guards are weapons of mass self destruction.

Keeping secrets in environmental variables has always seemed dodgy to me. Unless specifically cleared, they get inherited by all child processes. Maybe there are never any child processes in your application, or that could be desired behavior in some circumstances, but generally it seems like asking for trouble.

Its safety is proportional to your isolation model. Never use env vars for secrets when you’re executing arbitrary code, for example.

Re: Billion-record stolen Chinese database for sale on breach forum

#94

Post by googlryas »

pyinstallwoes wrote: post #4
mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

In history what have databases of people and state actor interests usually led to if any events are similar?

Not quite the same, but the US used census records that were supposed to be protected to round up the west coast japanese for their internment during WWII.

Re: Billion-record stolen Chinese database for sale on breach forum

#95

Post by ceeplusplus »

baybal2 wrote: post #27
luke-stanley wrote: post #8

In 2018 I saw a local branch office were using Windows XP and an old Internet Explorer. You cannot expect that to be secure. This does not surprise me at all.

Surprise, it's 2022, and XP is still a de-facto standard Windows version, with hacked Win7 slowly gaining. Why? Tons of Software was written for XP, and then abandoned without any support. Many of that stuff in the government sector. A lot of online banking clients outright say "only works on XP," and copyright years reads 2006. This is similar how Android 7+ support was almost nuked in China for nearly a year becaus…

That was not why they refused to port it to newer APIs though. It was because Google changed the permissions API to be more granular and request permissions at runtime, which would have meant Tencent would have to request tons of permissions to gather user data (presumably users would not be inclined to grant so many permissions).

Re: Billion-record stolen Chinese database for sale on breach forum

#96

Post by TecoAndJix »

bilekas wrote: post #34
tpaksoy wrote: post #16

Apparently there was a "blogpost" of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: https://archive.ph/mP3bh This is completely unverified though, so take it with a grain of salt.

It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.

I wonder if you could make a luhn-like check that would require an additional approval step to post if it comes back positive. Something like "It looks like you may be posting a secret *****. Do you wish to continue?

Re: Billion-record stolen Chinese database for sale on breach forum

#98

Post by nonethewiser »

hansel_der wrote: post #75
himinlomax wrote: post #72

This is interesting, this could be a major blow to the Chinese dictatorship.

why?

I am guessing he means that it highlights the incompetence or even just the consequences of centralizing power.

Personally I don't expect this to bear true. Historically in China, government failures have been cited as evidence for further centralizing the power of the federal government. And this argument is bought hook-line-and-sinker by the people. I don't think that will change until there is serious economic hardship.

Re: Billion-record stolen Chinese database for sale on breach forum

#100

Post by twicetwice »

r721 wrote: post #55

Karen Hao (WSJ): "I downloaded the sample the hacker provided and called dozens of people listed. Nine picked up & confirmed exactly what the data said." https://twitter.com/_KarenHao/status/1543949945614393344 (thread)

nitter link, since Twitter put up what seems to be a timed login gate when I was halfway through reading the thread: https://nitter.net/_KarenHao/status/1543949945614393344
Post reply on HN