Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked, CCs and passwords leaked

slashdot.org

Post reply on HN
Print view View original

171–180 of 418 posts

Re: Linode hacked, CCs and passwords leaked

#171

Post by spkthed »

homosaur wrote: post #113
nivla wrote: post #74

Earlier quoted context omitted.

Great, now I am feeling paranoid although I don't see any unauthorized charges on my card. Does anyone know if debit cards are legally protected the same way as credit cards with 0% liability.

You should talk to your bank as it depends on the network your bank uses. Most of the time it's something like a 48 hour window to challenge charges but it's far less at some banks.

No, it's covered by the FDIC. Banks can offer better protections but at least 48 hours within discovery is mandatory. http://www.fdic.gov/consumers/consumer/news/cnfall09/debit_v...

Re: Linode hacked, CCs and passwords leaked

#172

Post by pw7 »

clicks wrote: post #111
AlexMuir wrote: post #87

Ah this is so shit. I want to support Linode, I've had nothing but a good experience. But I just had to check my credit card to be sure they hadn't lost my details. I've NEVER had to do that before with anyone - they've got to respond fast here because if I don't trust them with my CC then I can't leave five-figure contracts at jeopardy hosted on their servers. I've been living comfortably on Linode servers for over…

I've now heard from a number of people using Linode that have suspicious activities on the cc which they used with Linode. I just called up my bank to tell them to 'block' it as a precaution (I will now have to give them a visit later today to get a new card). I encourage all other Linode customers to do the same, because it'll be easier to just spend half an hour doing this instead of spending hours upon hours dispu…

Yeah I did the same thing, but new card takes 5-7 days in my case. Very disappointed that I had to find out about this incident here, imagine all the customers who dont happen to look on slashdot or hacker news.

Re: Linode hacked, CCs and passwords leaked

#173

Post by xhrpost »

nlh wrote: post #130
xhrpost wrote: post #83

Off topic but still relevant, but doesn't it seem a bit primitive that companies have to store you CC# for recurring payments? The one number that uniquely identifies your account and everyone you want to re-use it has to keep a copy. Couldn't the credit card company issue some unique ID to each vendor for recurrent payments? Ex. the vendor issues your CC# to the CC Company for charge and recurring process. The CC Co…

This is basically what Stripe does. The "CC Company" basically doesn't offer more than a simple yes/no API -- "approved w/ #" or "declined". It'd be great if they could do more, but that's where the opportunity for folks like Stripe lies.

I guess it just surprises me that the CC companies don't do it themselves. Is the additional overhead of such a feature so high such as to warrant the choice between no payment processor (x% fee per transaction) vs. third party middle guy (x% + a bit more)? Not to mention the money the CC companies would save by not having so many fraudulent transactions (assuming they come out of their pocket, I honestly don't know).

Re: Linode hacked, CCs and passwords leaked

#174

Post by carbocation »

spkthed wrote: post #171
homosaur wrote: post #113

Earlier quoted context omitted.

You should talk to your bank as it depends on the network your bank uses. Most of the time it's something like a 48 hour window to challenge charges but it's far less at some banks.

No, it's covered by the FDIC. Banks can offer better protections but at least 48 hours within discovery is mandatory. http://www.fdic.gov/consumers/consumer/news/cnfall09/debit_v...

From your link:

> [With a debit card,] "Until the bank provides provisional credit, you could temporarily be out of pocket for the amount in dispute," said Richard Foley, an FDIC attorney who specializes in consumer issues. "This would not typically happen with a credit card because consumers can withhold payment of the amount in dispute."

> Also, as discussed on the next page, consumers have better federal protections when they purchase faulty goods with credit cards.

Re: Linode hacked, CCs and passwords leaked

#175

Post by Zancarius »

dale386 wrote: post #150
eridius wrote: post #134

Earlier quoted context omitted.

Despite what the other replies here are saying, this seems like a perfectly acceptable response to me. This comes off to me not as they're refusing to talk about it, but they _can't_ talk about it, presumably because of an ongoing investigation. I'm not sure what else people here are expecting them to say.

Then why not say that?

The pasted text from Linode appears to say exactly that:

> We are unable to release any additional details regarding this incident at this time, as there is an ongoing investigation.

Edit: Oops, didn't refresh before replying. jmilloy got it first! Sorry about that.

Re: Linode hacked, CCs and passwords leaked

#176

Post by xhrpost »

msbarnett wrote: post #135
xhrpost wrote: post #83

Off topic but still relevant, but doesn't it seem a bit primitive that companies have to store you CC# for recurring payments? The one number that uniquely identifies your account and everyone you want to re-use it has to keep a copy. Couldn't the credit card company issue some unique ID to each vendor for recurrent payments? Ex. the vendor issues your CC# to the CC Company for charge and recurring process. The CC Co…

> Off topic but still relevant, but doesn't it seem a bit primitive that companies have to store you CC# for recurring payments? You really really don't have to. Any payment processor that isn't horribly incompetent does the unique token authorization scheme. Storing CC #s for recurring payments is solely the domain of incompetents who have no business accepting payments from anyone.

It seems there are a LOT of incompetents then. Are the payment processors you're talking about something the vendor interfaces with in the background and not a third party that is directly utilized by the customer (eg. Stripe, Paypal)?

Re: Linode hacked, CCs and passwords leaked

#177

Post by farmdawgnation »

dom96 wrote: post #36
danso wrote: post #6

From a purported abridged chatlog with the alleged hacker: > 05:42 credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security > 06:00 They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Here is what Linode replied to me when I asked them about that chat log in a support ticket: Hello, Thank you for reaching out. We appreciate and understand your concerns. At this time the evidence suggest that this activity was targeting a specific customer. We are unable to release any additional details regarding this incident at this time, as there is an ongoing investigation. We have no comment regarding ryan*'s…

They probably can't say anything just yet. It's fair to be mad about them not realizing (or worse, covering up) the breadth of this breach, but do keep in mind that if they're working with the FBI, they've probably been asked to keep a lid on their official response for a few hours.

Re: Linode hacked, CCs and passwords leaked

#178

Post by chc »

hosay123 wrote: post #72
icey wrote: post #62

Earlier quoted context omitted.

You missed the step where you have to find all charges going to your old CC and then deal with moving every one of those accounts to your new one when it gets there. Hopefully you don't incur any late fees while you're going through the process! Kind of sucks to have to spend hours doing that for someone else's oversight. It's not the end of the world, but it paints a clear picture about where a company's priorities…

Maybe I'm weird, but I know exactly which binding credit agreements I'm in and how they're paid, and definitely none of them get paid using another binding credit agreement. :)

You don't pay for Netflix, Adwords, Amazon Prime, AWS, etc. using a card? If so, yes, I think you're weird. What do you do? Give them all your bank details?

Re: Linode hacked, CCs and passwords leaked

#179

Post by umsm »

austengary wrote: post #79
Kudos wrote: post #61

Earlier quoted context omitted.

Yeah, a week sounds like plenty of time to assess a hosting provider.

Oh, and the years of Linode assessment were adequate?

Every site can be hacked. It's just a matter of time. You just have to properly react: call your CC provider, check for any charges on your bill, and move on.

Re: Linode hacked, CCs and passwords leaked

#180

Post by windsurfer »

jdboyd wrote: post #139
windsurfer wrote: post #136

Earlier quoted context omitted.

Anyone know of any good way to export linode images to other VPS providers? Seems like I'll have to be doing it manually.

Generally speaking, this is one example where having a good deployment system starts to look extremely valuable (along with tested backups and restores for non-deployed data).

I'd have to agree with you, but I didn't figure creating such a system for my hobby projects was worth it.
Post reply on HN