Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

Post reply on HN
Print view View original

351–360 of 648 posts

Re: Internet Archive: Security breach alert

#351

Post by Geezus_42 »

gabeio wrote: post #128
999900000999 wrote: post #93

A pulled an old friends website down from Internet Archive. He's moved on the next stage, but I was glad I was able to put his site back up. It'll be a shame if IA goes down permanently, but we need a decentralized solution anyway. Having a single mega organization in charge of our collective heritage isn't a good idea.

I have always thought about this. It would be interesting to have users actually store small amounts of redundant info on a device connected to the internet. Very similarly to what a torrent does but with more peers (more data shards than full copies) and less seeds. And try and keep a huge database for everyone. Obviously open source and it would end up something like tor where they just assist the network with secu…

This was a plot line in Silicon Valley.

Re: Internet Archive: Security breach alert

#352

Post by gaudystead »

bunabhucan wrote: post #269
nikisweeting wrote: post #162

Earlier quoted context omitted.

I don't want Elon anywhere near Archive.org, please don't give him any ideas. There are plenty of other people in the world with money.

"Based on historical records from the first half of the last century, Mr Musk (inventor of the car and the rocket) and President Xi were the most respected and popular individuals on earth."

History is written by the winners...

Re: Internet Archive: Security breach alert

#353

Post by ianhawes »

richbell wrote: post #203
ano-ther wrote: post #196

Earlier quoted context omitted.

> the Have I Been Pwned data breach notification service created by Troy Hunt, with whom threat actors commonly share stolen data to be added to the service Do they? Why?

If Troy authenticates the data, they can use that as an 'endorsement' when trying to sell it.

This. Typically HIBP attribution includes the email of the "submitter". Various data aggregators will contact them and buy the stolen data. Everybody wins*.

* Exceptions apply.

Re: Internet Archive: Security breach alert

#355

Post by Springtime »

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable.

This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren't aware of this detail if they've uploaded anything.

Re: Internet Archive: Security breach alert

#356

Post by tdeck »

MatthiasPortzel wrote: post #318
xyst wrote: post #279

Earlier quoted context omitted.

decentralization. I don’t want these massive entities (Google, MS, CF) controlling my data.

Cloudflare isn't even that big. They're 1/100th the size of Google or MS. They're not even the biggest CDN—Akamai has twice the revenue, but it depends on what you measure. Cloudflare gets brought up disproportionately often on HN because they have generous free tiers and cater to indie hackers more. So it feels a little ironic that they're perceived as "the big dog" by the indie hackers.

It feels like every website uses them as a web proxy, meaning they get to 1) decide which users can access the site using their own opaque methodology and 2) MITM/inspect a large percentage of web traffic.

Re: Internet Archive: Security breach alert

#357

Post by 1024core »

acherion wrote: post #251
1024core wrote: post #245

Why should an Archive need accounts anyways? This is like a public library: you don't need to authenticate yourself to enter a public library, do you?

To enter? No. To borrow? Yes.

What are you "borrowing" from the Archive?

Re: Internet Archive: Security breach alert

#358

Post by hunter2_ »

Springtime wrote: post #355

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.)

If someone wants to upload and never be found out, then they need to use a throwaway address in any case, lest they be providing their "private" address to the administrators of the service without explicitly forbidding further disclosure. If I say something to Alice without demanding that Alice keep it from Bob, then I implicitly don't mind if Alice tells Bob what I said.

Re: Internet Archive: Security breach alert

#360

Post by kmeisthax »

idle_zealot wrote: post #146
0x1ch wrote: post #139

Earlier quoted context omitted.

It does work, when you don't notice it. We need sane limits and permanent seeders. This is why so many regular people get hit with ISP notices, they don't know they've seeded Captain America for the last six months every time they started their PC.

Yup. If browsers built in support for magnet links and (on desktop) defaulted to seeding with some capped bandwidth then a lot of centralized hosting platforms would become unnecessary.

You can build something very similar with WebRTC. Browsers already have P2P networking capability, it's just not immediately interoperable with BitTorrent clients. Standardizing some sort of BitTorrent over WebRTC bridge and adding it to BT clients would fix this problem.

That being said, please do not host content this way. P2P blows away the already thin privacy guarantees that the web provides. Anyone seeding the site gets the IP addresses of everyone on that site, and can trivially correlate that with other sites to build detailed dossiers on, if not individual people, at least households[0] of people. After all, that's how the MAFIAA[1] sent your ISP DMCA scare letters back in the 2000s P2P wars.

[0] IPv4 CGNAT would frustrate this level of tracking, but IPv6 is still subnet per subscriber. Note that you can't use individual v6 addresses because we realized very early on that the whole "put the MAC in the lower 64 bits of the address" thing was also a privacy nightmare, so IPv6 hosts rotate addresses every hour or so.

[1] Music And Film Industry Association of America, a ficticious merger of the MPAA and RIAA in a hoax article

Post reply on HN