Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

501–510 of 648 posts

Re: Internet Archive: Security breach alert

#501

Earlier quoted context omitted.

It may not even be that nefarious — perhaps they did the hack “for the lulz” then had pangs of conscience afterward and scrabbled around for a (false) excuse. In any case, the IA was in some cases the only public host of important documents about Palestinian history, which are currently inaccessible, to say nothing about how important the Wayback Machine has been over the past year.

Sounds more like they hacked it for the lulz and then put up the tweets for even more lulz. Attacking the IA to support palestine is about as nonsensical as you can get.

There is a lot of embarassing pro-Zionist material archived on IA, but scrubbed elsewhere from the Internet:

https://www.google.com/search?client=safari&rls=en&q=zionist...

So just to play devils advocate, since Zionism is being critically received all across the Internet - it is more likely that IA was attacked in order to censor those materials, and then a sockpuppet was created to shift the blame to pro-palestinian voices - which makes no sense, since pro-palestinian voices would want IA to stay up so that embarassing Zionist material was made more available - but such is the nature of agitprop campaigns during war time: through subterfuge and obfuscation, deny your enemy the materials it requires to continue its campaigns, and also deny them the ability to identify the cause of that material going missing, also - or, at the very least, obfuscate the actors responsible for denying it, using sockpuppetry ..

Re: Internet Archive: Security breach alert

#502
post #455
post #194

Earlier quoted context omitted.

I think it is safer to have 2FA in your password manager than not using 2FA at all. Because even if they got your password, if they don't have access to your password manager they can't login. If you protect your password manager with a yubikey or any other hardware key, then your 2FA inside your password manager is quite secure and convenient. But this is very individual, what your threat model is and how secure you…

See also the considerations mentioned in the sibling thread btw: https://news.ycombinator.com/item?id=41793846 > even if they got your password, if they don't have access to your password manager they can't login. Wouldn't the same argument go for a non-2fa password? What's the difference between a randomly generated 2fa secret and a randomly generated password here?

An eavesdropper able to intercept connections could record your password in transit but would only get the current 2FA token which quickly becomes useless. But with TLS eavesdroppers are not a realistic concern for most people so the actual benefit is still questionable.

Re: Internet Archive: Security breach alert

#503

Well this should be fun. Now I'll have to dig through my IA account and remember if I donated to them directly via credit card (and if they stored it), or if it was through PayPal.

If they stored your email from your donation the IA would have already used it to spam you themselves, no attackers needed.

Re: Internet Archive: Security breach alert

#504
post #449

Earlier quoted context omitted.

I think it does if you want to install anything from the Play Store.

Aurora store gets around that

the search doesn't really work does it? you have to search on Google and then click on it to open with aurora.

but you're right, it does help!

Re: Internet Archive: Security breach alert

#505

Earlier quoted context omitted.

An issue is for most sites/services an email has just become a standard authentication method, rather than something that can easily be more unique per account. So any usernames across sites/services that share it identify that user as being the same person (for data broker profiling, doxxing, etc), which is the privacy issue (not the email address per se, unless it perhaps contained one's real name). For contrast tr…

Proton Mail and iCloud’s hide my e-mail feature allow users to have unlimited e-mail addresses. You can also get unlimited e-mail addresses by running your own e-mail server or using something like Office 365’s business e-mail (costs about $4 per month).

is running your own e mail server a good idea in 2024? Security issues aside, you are at the mercy of the big email providers and whatever rules they want you to follow

Re: Internet Archive: Security breach alert

#507

They use bcrypt and I always use a really long password so I’m not gonna freak out over this one for once.

Are bcrypt password hashes difficult to crack? I signed up for IA over 10 years ago with a much weaker password than those I use today.

If you don't reuse that password anymore, does it matter tho. Some services might use older hashing for older passwords without updating the hash algorithm. But I don't know what is the case here.

brypt passwords are very slow to crack.

Re: Internet Archive: Security breach alert

#508

They use bcrypt and I always use a really long password so I’m not gonna freak out over this one for once.

Are bcrypt password hashes difficult to crack? I signed up for IA over 10 years ago with a much weaker password than those I use today.

The difficulty is configurable. You can play around with it at https://bcrypt-generator.com/

I found this, not sure if it's still up-to-date:

◉ PHP's default implementation of bcrypt uses 10 rounds.

◉ Python's bcrypt library uses 12 rounds by default.

◉ Node.js's bcrypt library uses 10 rounds by default.

See also: https://gist.github.com/Chick3nman/32e662a5bb63bc4f51b847bb4...

Post reply on HN