Linode hacked, CCs and passwords leaked • Hacker News Board

Re: Linode hacked, CCs and passwords leaked

#61

Post by Kudos » Mon, Apr 15, 2013, 6:23 PM UTC

austengary wrote: post #49

citricsquid wrote: post #9

My Visa card that I used with Linode was stolen and used on an Amazon order I didn't authorise last week, my bank successfully blocked the charge. Someone else reported their Visa had also been compromised in the thread 2 days ago, looks like that confirms the suspicions: https://news.ycombinator.com/item?id=5542015 Poor show Linode. (edit: worth noting I use the card with other things too, I have no confirmation it…

Switched to https://www.digitalocean.com/ last week. Excellent service and pricing.

Yeah, a week sounds like plenty of time to assess a hosting provider.

Re: Linode hacked, CCs and passwords leaked

#62

Post by icey » Mon, Apr 15, 2013, 6:23 PM UTC

hosay123 wrote: post #54

lawnchair_larry wrote: post #28

Well I'll wait for a response from linode, but it certainly looks like they were very dishonest. I think I will close my account.

So you're unfortunate enough to be a customer who had their CC leaked. So you spend 5 minutes changing your password (you use unique, non-formulaic passwords, right?) and 15 minutes on the phone to CC company to ask for a new card. Then you use your backup card for 2 weeks (you have a backup card, right?) A month later, spend 30 minutes on the phone with CC company only if strange transactions appeared. Not the end o…

You missed the step where you have to find all charges going to your old CC and then deal with moving every one of those accounts to your new one when it gets there. Hopefully you don't incur any late fees while you're going through the process!

Kind of sucks to have to spend hours doing that for someone else's oversight. It's not the end of the world, but it paints a clear picture about where a company's priorities are.

Re: Linode hacked, CCs and passwords leaked

#63

Post by ktsmith » Mon, Apr 15, 2013, 6:23 PM UTC

lawnchair_larry wrote: post #28

Well I'll wait for a response from linode, but it certainly looks like they were very dishonest. I think I will close my account.

Linode is always bad about communicating with customers over breaches and outages.

Re: Linode hacked, CCs and passwords leaked

#64

Post by Hilyin » Mon, Apr 15, 2013, 6:23 PM UTC

ConceitedCode wrote: post #24

If this is true then all the trust that Linode has built up over the years was just thrown out the window. According to the hacker they've known for 2 weeks and made a deal with the hackers. Ultimately, they were as far from transparent as it gets and on top of that they did a horrible job with their security. Hopefully, they own up and start being transparent. If this is true then what alternative hosts should I loo…

I am using digitalocean, check them out.

Re: Linode hacked, CCs and passwords leaked

#65

Post by ceejayoz » Mon, Apr 15, 2013, 6:25 PM UTC

pibefision wrote: post #34

I had a VPS on linode. I think that Linode did a big mistake here. Let's wait for a formal communication. But this is the moment to support them. Yes, maybe sounds crazy. When you host on any third party datacenter, you take risks that something like this could happen. So, deal with it. Check your credit card, if your receive something wrong, call to your card and that's all. But we need to support also the good work…

If this is true, they've blatantly lied thus far in their communications with their customers. I don't think that deserves support.

Re: Linode hacked, CCs and passwords leaked

#66

Post by perlgeek » Mon, Apr 15, 2013, 6:26 PM UTC

Really off-topic, but still sad: This is a link to slashdot, but it's on HN's frontpage before it's on slashdot's front-page (if it'll ever get there). (And IMHO that's sad, because /. used to be top notch).

I've noticed before that stuff from the HN frontpage appears on /. one to three days after, but I've never seen it for links to slashdot :-)

Re: Linode hacked, CCs and passwords leaked

#67

Post by whalesalad » Mon, Apr 15, 2013, 6:28 PM UTC

I'm looking forward to seeing an official response from Linode on this. Hopefully they are fast and honest about it. I've been a happy customer for quite a while, but this is definitely a concern.

Re: Linode hacked, CCs and passwords leaked

#68

Post by trafficlight » Mon, Apr 15, 2013, 6:29 PM UTC

tptacek wrote: post #44

toomuchtodo wrote: post #23

Earlier quoted context omitted.

I've done PCI "audits" for several companies I've worked for; it's a checklist you go down yourself . That's why its called a "pci self assessment".

Actually, if you're processing cards directly, you do in fact need to have an PCI-qualified outside firm† (a QSA) audit you for PCI compliance. But those audits are notoriously superficial; PCI audits are a race-to-the-bottom affair. † We are not one of those.

Every one of these reviews that I've been involved in has been conducted by a couple of guys with laughable abilities.

Re: Linode hacked, CCs and passwords leaked

#69

Post by mratzloff » Mon, Apr 15, 2013, 6:29 PM UTC

austengary wrote: post #49

citricsquid wrote: post #9

My Visa card that I used with Linode was stolen and used on an Amazon order I didn't authorise last week, my bank successfully blocked the charge. Someone else reported their Visa had also been compromised in the thread 2 days ago, looks like that confirms the suspicions: https://news.ycombinator.com/item?id=5542015 Poor show Linode. (edit: worth noting I use the card with other things too, I have no confirmation it…

Switched to https://www.digitalocean.com/ last week. Excellent service and pricing.

Until they're hacked, too...

Re: Linode hacked, CCs and passwords leaked

#70

Post by eridius » Mon, Apr 15, 2013, 6:29 PM UTC

pibefision wrote: post #34

I had a VPS on linode. I think that Linode did a big mistake here. Let's wait for a formal communication. But this is the moment to support them. Yes, maybe sounds crazy. When you host on any third party datacenter, you take risks that something like this could happen. So, deal with it. Check your credit card, if your receive something wrong, call to your card and that's all. But we need to support also the good work…

Well said. It's a fact of life that companies get hacked. So it's no surprise that it eventually happened to Linode. If you flee somewhere else, all you're doing is hoping that the other company you run to won't get hacked rather than using any logical thought.

I can think of two good reasons why you should flee Linode. It remains to be seen if either are actually true, and until indications say yes, then panic is unwarranted:

1. If it becomes apparent that Linode is far more vulnerable to hacking than other hosting providers. But one hack alone does not prove this.

2. If Linode grossly mishandles the situation. There have been a couple of allegations to that effect so far, but nothing substantial. I don't see any reason to claim that they've done this yet.