Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

Post reply on HN
Print view View original

231–240 of 648 posts

Re: Internet Archive: Security breach alert

#231

Post by floam »

lordfrito wrote: post #226

Confused about this breach... I received a notification from HIBP about this hack, but I don't recall ever creating an account on archive.org (was creating an account there even a thing?). What info does archive.org have on people? Is this info scraped from other websites and stored in the archive.org database? Or is this info related to personal archive.org accounts (as I said I don't recall making an account)?

They are actual archive.org accounts. Maybe you made an account to upload something, or to check out a digitized book from their library?

Re: Internet Archive: Security breach alert

#232

Post by nostromo »

pentagrama wrote: post #218

The reported alert on the site states: > Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP! But is this an official message from the company? It sounds odd and unprofessional, especially the "See 31 million of you on HIBP!" part, which jokingly refers to a huge privacy issue for users.…

The hackers wrote that.

https://www.bleepingcomputer.com/news/security/internet-arch...

Re: Internet Archive: Security breach alert

#233

Post by floren »

nostromo wrote: post #230
xyst wrote: post #214

One of the many benefits of owning my own email server: - I have a catch all setup to forward all emails to specific user on mail server - able to setup adhoc email addresses for each online service (ie, iarch@example.com) - able to claim example.com in haveibeenpwned Now I get breach emails from hibp for the whole domain. Unfortunately, I was exposed in this IA breach

The only drawback being that all of your outgoing email is sent directly to the receiver’s spam folder..?

Memes are fun and all but this one is both untrue and just serves to entrench the big bastards, who don't need any more help.

Re: Internet Archive: Security breach alert

#234

Post by hsbauauvhabzb »

viraptor wrote: post #193
Aachen wrote: post #87

Earlier quoted context omitted.

How long does an average hard drive last? You'd have to spend that 700k every that many years (plus the extra bits you mentioned). Quite an operation actually

Backblaze keeps good stats. https://www.backblaze.com/cloud-storage/resources/hard-drive... 1.71% a year failure rate if you care for the hardware as much as they do.

But that number would increase year on year, a 10 year old drive is far more likely to fail than a 1 year old drive

Re: Internet Archive: Security breach alert

#235

Post by appendix-rock »

gtirloni wrote: post #220
pentagrama wrote: post #218

The reported alert on the site states: > Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP! But is this an official message from the company? It sounds odd and unprofessional, especially the "See 31 million of you on HIBP!" part, which jokingly refers to a huge privacy issue for users.…

It's a thankless job to be always begging for donations to keep something working when the Internet at large doesn't value it as much as it should. And now getting targeted like that? I wouldn't judge them if this is an official communication coming from exhausted and frustrated staff.

Just a reminder that AI tried pivoting to much more clear-cut legitimate piracy, presumably because they got bored or something, and certainly put ‘donations’ toward that effort.

IA is an incredibly valuable resource, but let’s not put them on a pedestal.

Re: Internet Archive: Security breach alert

#236

Post by pshc »

Aachen wrote: post #183
nikisweeting wrote: post #172

Earlier quoted context omitted.

There are people still working on trying to make it happen but it's just a collosal amount of data and filesystems are notoriously hard, so it's very slow going. From my own personal experience doing distributed archiving with no relation to Archive.org, Filecoin/IPFS's UX isn't quite there yet. They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of you…

> They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of your stuff so you end up double-storing data or you have to give into everything being stored as inscrutable binary blobs. I don't understand this part. What data would you have to give them? Why can't it just live next to your stuff on your OS' filesystem?

IPFS is all content-hash-addressed, so my guess is the IPFS service spirits the files away to a (hopefully) immutable store for the sake of sanity.

Re: Internet Archive: Security breach alert

#237

Post by dannyobrien »

Aachen wrote: post #183
nikisweeting wrote: post #172

Earlier quoted context omitted.

There are people still working on trying to make it happen but it's just a collosal amount of data and filesystems are notoriously hard, so it's very slow going. From my own personal experience doing distributed archiving with no relation to Archive.org, Filecoin/IPFS's UX isn't quite there yet. They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of you…

> They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of your stuff so you end up double-storing data or you have to give into everything being stored as inscrutable binary blobs. I don't understand this part. What data would you have to give them? Why can't it just live next to your stuff on your OS' filesystem?

For IPFS, I'm fairly sure you can now serve from your normal filesystem, rather than load it into their blockstorage -- or at least the blockstorage has pointers to real data blocks that are part of your existing files (it's the nocopy option[1]; it's marked as experimental, so there may be some sharp edges.)

For Filecoin, if you want fast access, you do need to keep a second hot plaintext copy, as well as the sealed Filecoin copy. But that works for the backup case for IA, because the hot copy would be served from the archive's existing infrastructure (and/or a distributed IPFS hot cache) -- you'd just use Filecoin for the proven safe backup.

The project to back up IA to Filecoin is still ongoing. The IA dashboard that shows the current state is (perhaps predictably) down at the moment, but it crossed the 1PiB line last year[2], and they've been optimising the onboarding flow recently.

[1] https://docs.ipfs.tech/reference/kubo/cli/#ipfs-add

[2] https://blog.archive.org/2023/10/20/celebrating-1-petabyte-o...

(Disclosure: I work at the Filecoin Foundation/Filecoin Foundation for the Decentralized Web, which partners with the Archive on this project, as well as supporting other Internet Archive backup projects.)

Re: Internet Archive: Security breach alert

#238

Post by alwa »

jonahx wrote: post #125
Aachen wrote: post #115

Earlier quoted context omitted.

I'm not sure that placing free long distance calls isn't harmful to the org whose infrastructure you're using for your own benefit, but 2600 (Hz) is a respected hacker magazine and phreaking and Cap'n crunch whistles are seen as cool Hacking the Internet Archive and only placing an alert with a provocative message, I could see my teenage self do that. My judgment of the character is going to depend on what it turns o…

There's a spectrum and case by case judgement. I'd agree your examples are harmless even if technically they harm the phone company. Taking down the internet archive just for the hell of it has a distinctly less "cool" or "fun" flavor, to my eye.

And I mean… one was a profit-making monopoly, and the other is a hacker-flavored charity doing a public service on a shoestring budget of donations.

Re: Internet Archive: Security breach alert

#239

Post by lolinder »

xyst wrote: post #214

One of the many benefits of owning my own email server: - I have a catch all setup to forward all emails to specific user on mail server - able to setup adhoc email addresses for each online service (ie, iarch@example.com) - able to claim example.com in haveibeenpwned Now I get breach emails from hibp for the whole domain. Unfortunately, I was exposed in this IA breach

In case anyone would like these benefits but doesn't want to actually run an email server: All you actually need to accomplish this is a domain name and a decent provider. Fastmail is what I use and it's been great for me.

Re: Internet Archive: Security breach alert

#240

Post by lordfrito »

floam wrote: post #231
lordfrito wrote: post #226

Confused about this breach... I received a notification from HIBP about this hack, but I don't recall ever creating an account on archive.org (was creating an account there even a thing?). What info does archive.org have on people? Is this info scraped from other websites and stored in the archive.org database? Or is this info related to personal archive.org accounts (as I said I don't recall making an account)?

They are actual archive.org accounts. Maybe you made an account to upload something, or to check out a digitized book from their library?

Thank you.. was worried at first as I didn't understand the true scope of the breach. For such a vital website, the info gleaned seems relatively harmless (for those of us who don't reuse passwords that is)
Post reply on HN