241–250 of 418 posts
I wonder if they've deleted CC details of previous clients. Is Linode going to contact all relevant customers? Seems like the right thing to do. Not everyone reads HN.
I was just told by a customer service rep at linode that I "shouldn't trust everything I read on the internet" when I inquired about the possibility of deleting my personal information from their server. This seems like an extremely inappropriate way to handle this situation...
Earlier quoted context omitted.
That's totally shit. Its also why we invoice and take wire payments rather than storing CC details. There's just so much to go wrong. Also PKI is shit for this sort of thing. As demonstrated, the moment that public key is gone, then the whole system falls like a house of cards. For the non believers of this fact, why else would there be a certificate revocation list and root CA updates for windows periodically...
In what ways are wire payments better than using credit cards? In wire payments aren't you using the actual bank account numbers along with routing numbers which is also very sensitive information ? Also I do not think, but I am not sure, that fraudulent wire payments/transfers are reversible.
Wire transfers often are not able to be undone once they happen (and are accepted by the other bank). This is the reason why there's so much verification that happens in wire transfers. (I helped develop 2nd factor authentication used for authenticating wire transfers for a financial company)
Credit card charges can be reversed.
My Visa card that I used with Linode was stolen and used on an Amazon order I didn't authorise last week, my bank successfully blocked the charge. Someone else reported their Visa had also been compromised in the thread 2 days ago, looks like that confirms the suspicions: https://news.ycombinator.com/item?id=5542015 Poor show Linode. (edit: worth noting I use the card with other things too, I have no confirmation it…
Earlier quoted context omitted.
Woah woah woah isn't this just transferring the contents of /dev/sda in the clear over the wire? Shouldn't you at least do this over SSH?
>>Shouldn't you at least do this over SSH? Yeah, I mentioned that at the bottom of my post. Using ssh or some other inline encryption would be a good idea if it is a system you care about. If you have a site to site VPN tunnel between your systems, you can skip adding the encryption.
It wasn't there when windsurfer replied to you (I was reading the thread earlier), hence his question.
It's hard to get angry at anybody but Linode needs better auditing around sensitive data so they can tell people one way or the other.
I resigned to the fact that I'd find it easier to change my card details in 30-odd online shops than it is fight my bank to get my money back. Now I can't make any purchases for 7-10 days.
----------------------
dportalatin 30 minutes ago Hello,
Thanks for getting into contact with us about this. Linode has found no evidence that payment information of any customer was accessed. We have implemented all appropriate measures to provide the maximum amount of protection to our customers. If you have any other concerns we can address, please let us know.
Regards, Dolores
Earlier quoted context omitted.
Stripe is amazing... I trust them, someone hacks me, awesome, you got password hashes and stripe customer keys, all worthless.
Not exactly worthless, depending on the hack someone could still charge an awful lot to your customers and make you have a bad day. But yes, significantly better than other situations.
FYI, I just learned from Linode support that accounts have both a default LISH password AND a default API key, which means that even if you've never set a LISH password or generated an API key before , you still should still go and reset them. This is not what I would consider expected or desirable behavior.
I've never generated an API key, and Linode showed it as blank. I generated a new one anyway, but I can't imagine how they'd have a default key and somehow not show it in the UI.
Edit: Groan, here's their clarification. It's starting to look like they don't know what the heck they're talking about:
"Thanks for getting back to us. To be extra cautious it would not hurt to regenerate your Linode API key. You can do that in your user profile. Please let us know if you have any other concerns we can address."