Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet Archive breached again through stolen access tokens

bleepingcomputer.com

Post reply on HN
Print view View original

11–20 of 376 posts

Re: Internet Archive breached again through stolen access tokens

#11

Post by semicolon_storm »

badlibrarian wrote: post #10

Restating my love for Internet Archive and my plea to put a grownup in charge of the thing. Washington Post: The organization has “industry standard” security systems, Kahle said, but he added that, until this year, the group had largely stayed out of the crosshairs of cybercriminals. Kahle said he’d opted not to prioritize additional investments in cybersecurity out of the Internet Archive’s limited budget of around…

In security, industry standard seems to be about the same as military grade: the cheapest possible option that still checks all the boxes for SOC.

Re: Internet Archive breached again through stolen access tokens

#12

Post by brendoelfrendo »

_fat_santa wrote: post #6

I don't know what their funding model looks like but if they have some cash I'd say hiring a security team would be on top of the list of things to invest in.

I believe that, at this point in time at least, IA's funding model consists of sweating profusely while awaiting a colossal legal judgement.

Re: Internet Archive breached again through stolen access tokens

#13

Post by pessimizer »

The Internet Archive has a management problem. They seem to be more comfortable disrupting libraries than managing an online, publicly accessible database of disputed, disorganized material.

Despite all of the positive self-talk, I don't know if they realize how important they are, or how easy it would be for them to find good help and advice if their management were transparent and everything was debated in public. That may have protected it to some extent; as a counterexample, Wikipedia has been extremely fragile due to its transparency and accessibility to everyone. With IA being driven by its creator's ideology, maybe that ideology should be formalized and set in stone as bylaws, and the torch passed to people openly debating how IA should be run, its operations, and what it should be taking on.

I don't mean they should be run by the random set of Confucian-style libertarian aphorisms that is running the credibility of Wikipedia into the ground, but Debian is a good model to follow. Or maybe do better than both?

Re: Internet Archive breached again through stolen access tokens

#14

Post by galleywest200 »

TheFreim wrote: post #4

> "It's dispiriting to see that even after being made aware of the breach weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets," reads an email from the threat actor. This is quite embarrassing. One of the first things you do when breached at this level is to rotate your keys. I seriously hope that they make some systemic changes, it seems that…

>"It's dispiriting to see that even after being made aware of the breach weeks ago..."

These people are not dispirited whatsoever, if anything they are half-cocked that these script kiddies found an easy target.

Re: Internet Archive breached again through stolen access tokens

#15

Post by oytis »

trompetenaccoun wrote: post #5

We need archives built on decentralized storage. Don't get me wrong, I really like and support the work Internet Archive is doing, but preserving history is too important to entrust it solely to singular entities, which means singular points of failure.

We'll need to find even more people willing to expose themselves to legal threats and cyberattacks then.

Re: Internet Archive breached again through stolen access tokens

#16

Post by thaumasiotes »

myself248 wrote: post #8

I'd like to imagine a world where every lawyer, when their case is helped by a Wayback Machine snapshot of something, flips a few bucks to IA. They could afford a world-class admin team in no time flat.

That's a terrible solution. The Wayback Machine takes down their snapshots at the request of whoever controls the domain. That's not archival.

If the state of a webpage in the past matters to you, you need a record that won't cease to exist when your opposition asks it to. This is the concept behind perma.cc.

Re: Internet Archive breached again through stolen access tokens

#17

Post by avazhi »

pessimizer wrote: post #13

The Internet Archive has a management problem. They seem to be more comfortable disrupting libraries than managing an online, publicly accessible database of disputed, disorganized material. Despite all of the positive self-talk, I don't know if they realize how important they are, or how easy it would be for them to find good help and advice if their management were transparent and everything was debated in public.…

https://www.wired.com/story/internet-archive-memory-wayback-...

I appreciate their ethos and I've used the site many times (and donated!), but clearly it's at the point where Kahle et al just aren't equipped either personally (as a matter of technical expertise) or collectively (they are just a handful of people) to be dealing with what are probably in many cases nation-state attacks. Kahle's attitude towards (and misunderstanding of) copyright law is IMO proof that he shouldn't be running things, because his legal gambles (gambles that a first year law student could have predicted would fail spectacularly) have put IA at long term risk (see: Napster). And this information coming out over the past few weeks about their technical incompetence is arguably worse, because the tech side of things are what he and his team are actually supposed to be good at.

It's true that Google and Microsoft and others should be propping up the IA financially but that isn't going to solve the IA's lack of technical expertise or its delusional hippie ethos.

Re: Internet Archive breached again through stolen access tokens

#18

Post by myself248 »

thaumasiotes wrote: post #16
myself248 wrote: post #8

I'd like to imagine a world where every lawyer, when their case is helped by a Wayback Machine snapshot of something, flips a few bucks to IA. They could afford a world-class admin team in no time flat.

That's a terrible solution. The Wayback Machine takes down their snapshots at the request of whoever controls the domain. That's not archival. If the state of a webpage in the past matters to you, you need a record that won't cease to exist when your opposition asks it to. This is the concept behind perma.cc.

Ooo, excellent. Yes, hiding items is imperfect, but I understood that it was legally required or something. (IANAL and IDFK, TBH) I wonder how perma.cc gets around that.

Re: Internet Archive breached again through stolen access tokens

#19

Post by badlibrarian »

pessimizer wrote: post #13

The Internet Archive has a management problem. They seem to be more comfortable disrupting libraries than managing an online, publicly accessible database of disputed, disorganized material. Despite all of the positive self-talk, I don't know if they realize how important they are, or how easy it would be for them to find good help and advice if their management were transparent and everything was debated in public.…

Don't forget the time Brewster tried to run a bank -- Internet Archive Federal Credit Union. Or that the physical archives are stored on an active fault line and unlikely to receive prompt support during an emergency. Or that, when someone told him that archives are often stored in salt mines he replied, "cool, where can I buy one?"

Re: Internet Archive breached again through stolen access tokens

#20

Post by MattPalmer1086 »

trompetenaccoun wrote: post #5

We need archives built on decentralized storage. Don't get me wrong, I really like and support the work Internet Archive is doing, but preserving history is too important to entrust it solely to singular entities, which means singular points of failure.

Lots of Copies Keeps Stuff Safe

https://www.lockss.org/

This is a brilliant system relying on a randomised consensus protocol. I wanted to do my info sec dissertation on it, but its security model is extremely well thought out. There wasn't anything I felt I could add to it.

Post reply on HN