Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billion-record stolen Chinese database for sale on breach forum

theregister.com

Post reply on HN
Print view View original

201–210 of 258 posts

Re: Billion-record stolen Chinese database for sale on breach forum

#201

Post by LilBytes »

steelaz wrote: post #54
compumike wrote: post #40

Earlier quoted context omitted.

Doesn't the client still need to know a long-lived secret (or a long-lived refresh token) in order to generate the ephemeral credentials?

We got rid of all IAM users used by applications and moved to role-based access. Nowhere in the application do you need to enter AWS credentials. AWS SDK will attempt to discover short-lived credentials for you and will assume the role specified at the infrastructure layer, e.g. in a task definition.

same here, but we still have IAM Users for service accounts. E.g. some customers have on premise infra that needs to talk to our services of infrastructure.

Do you know a way where RBAC can be used for the above?

For us, we're using long lived credentials in this space using IAM Users but with very tightly controlled authorisations.

Re: Billion-record stolen Chinese database for sale on breach forum

#202

Post by throwawaylinux »

AustinDev wrote: post #194
alchemist1e9 wrote: post #164

Earlier quoted context omitted.

As a US citizen I want to believe bravado like this but I’m guessing this is just your fantasy world talking not actual knowledge of the government being competent, which in my personal experience seems extremely unlikely.

The government isn't competent as a whole.. but the intelligence agencies are rather powerful. I've worked for DARPA and IARPA and you wouldn't believe half the stuff I could say publicly and none of the stuff I can't disclose.

We're always told that grand "conspiracy theories" are impossible because if hundreds or thousands of people are involved someone will always leak something about it. Interesting there's all these people out there who seem to know much bigger things than Snowden revealed.

What can you say publicly?

Re: Billion-record stolen Chinese database for sale on breach forum

#203

Post by boomboomsubban »

moneywoes wrote: post #129
black_puppydog wrote: post #109

Earlier quoted context omitted.

Nitter is the only sane way to read twitter nowadays. Even if I still had an account it would be better for reading.

I keep getting timeouts from them interestingly

A different instance may work for you https://github.com/zedeus/nitter/wiki/Instances

Re: Billion-record stolen Chinese database for sale on breach forum

#204

Post by edmcnulty101 »

thomassmith65 wrote: post #127
gonzo41 wrote: post #53

Earlier quoted context omitted.

Covid is a good excuse to wear a mask, and pair it with a set of mirror sun glasses in public. Maybe that's how we live now.

We should probably consider a person's voice-print, too. To be safe, you need a mask with a real-time voice changer.

And gait. Everyone walks a specific way and a person can be identified by their gait. So have to change up the walk.

Re: Billion-record stolen Chinese database for sale on breach forum

#206

Post by carapace »

lagrange77 wrote: post #130
carapace wrote: post #67

Earlier quoted context omitted.

> What do we do now? Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". In the "Star Trek" future the people in charge are themselves also subject to the panopticon, and the world is ruled fairly and humanely. (The other name I use for this is the "Tyranny of Mrs. Grundy".) In the "North Korea" future ther…

> Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". Nice analogy. Do you really believe, that us being on an utopian trajectory is realistic?

> Do you really believe, that us being on an utopian trajectory is realistic?

Oh yes. Very much so. In fact, by many measures we have been on an utopian trajectory for several centuries. Today even our failures are the result of unimaginable power. We have to learn to wield our power with wisdom.

We have all of the physical technology we need already. We can practice regenerative agriculture that increases topsoil fertility and volume; we have methods of construction that can build housing for everyone; machines and factories that churn out the physical necessities of life; etc. We need only deploy our resources and technology efficiently. It's down to logistics now, and we have more than enough computer power to sort that out.

The only thing holding us back is that most people still don't realize this yet.

https://en.wikipedia.org/wiki/Design_science_revolution

It's taking longer than anticipated but the process never stopped. Reading this now you are a part of it, if you want to be.

Re: Billion-record stolen Chinese database for sale on breach forum

#207

Post by carapace »

tintor wrote: post #190
carapace wrote: post #67

Earlier quoted context omitted.

> What do we do now? Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". In the "Star Trek" future the people in charge are themselves also subject to the panopticon, and the world is ruled fairly and humanely. (The other name I use for this is the "Tyranny of Mrs. Grundy".) In the "North Korea" future ther…

You could replace North Korea with China.

The interesting question (in this context) is whether the Social Credit system will be applied to the members of the CCP, eh?

https://en.wikipedia.org/wiki/Social_Credit_System

Re: Billion-record stolen Chinese database for sale on breach forum

#208

Post by remram »

jewel wrote: post #115
TecoAndJix wrote: post #96

Earlier quoted context omitted.

I wonder if you could make a luhn-like check that would require an additional approval step to post if it comes back positive. Something like "It looks like you may be posting a secret *****. Do you wish to continue?

If vendors agreed to a common prefix on all secret key values then it'd be easy for everyone to add checks, to everything. Something like "_SECRET88_". Of course, then your secret key checker would need to build that string by concatenating so that it wouldn't set off itself.

RFC 8959 registered the 'secret-token:' prefix / URI scheme.

https://www.rfc-editor.org/rfc/rfc8959.html

Re: Billion-record stolen Chinese database for sale on breach forum

#209

Post by nijave »

LilBytes wrote: post #198
flyt wrote: post #187

Earlier quoted context omitted.

AWS best practices is to use AWS SSO, which accomplishes this same effect but without any long-lived local credentials. It works really well.

Depending on your IdP there's a few tools in addition to AWS CLI v2 that works well in this space. aws-vault is one of them, though out of support now, aws-okta [1] is another. [1] https://github.com/segmentio/aws-okta

Used to use that a few years ago and it worked pretty well--you can also set it as a credential helper in your AWS config.

Just an FYI it's no longer supported and it looks like the fork has gone stagnant, too.

Post reply on HN