Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked, CCs and passwords leaked

slashdot.org

Post reply on HN
Print view View original

401–410 of 418 posts

Re: Linode hacked, CCs and passwords leaked

#401

Post by douglasheriot »

taylorbuley wrote: post #326
thaumaturgy wrote: post #325

Linode hasn't been very forthcoming in the past where security "incidents" are concerned: http://arstechnica.com/business/2012/03/bitcoins-worth-22800... http://forum.linode.com/viewtopic.php?f=20&t=8509 I had really hoped that they had changed their stance on incident management. If it's true that they suppressed information about a possible wide-scale compromise where customer data could have been affected, then de…

Did you see http://www.linode.com/linode4.css and http://www.linode.com/linode3.css ? Nevermind the security concerns. These guys aren't using version control!

Renaming CSS files with numbers or whatever is one legitimate way to handle cache invalidation (not evidence of not using version control)

Re: Linode hacked, CCs and passwords leaked

#402

Post by cookiecaper »

nenolod wrote: post #223
voidlogic wrote: post #217

Earlier quoted context omitted.

That is one (good) way to handle the encryption. You don't want to leave out the compression or block size however, so add those back in. Most WAN links are low bandwidth enough that compression will not slow things down (this is usually true even on 1 GBE LAN links for pigz ) and in my experience the speed-up is substantial. pigz is much faster than using ssh compression as it is multicore. apt-get it or http://zlib…

the compression is unnecessary here, you're moving a max of less than a couple of hundred GB of data.

It's pretty necessary if you aren't moving between colocated boxes. "less than a couple hundred GB of data" is still a lot of data to be moving around, even on a 100Mb/s link, which almost no one in America has residentially, and isn't even a guarantee for colo'd machines.

In most cases, compression at the raw block level will result in HUGE size savings, especially since a lot of that may be free space. It might even make this transfer tenable.

Re: Linode hacked, CCs and passwords leaked

#403

Post by run4yourlives »

minib wrote: post #377
neya wrote: post #156

I am an ex-customer of Linode and I'm still worried about this incident - Do they still store your card after you've quit the service? This is terrible :(

I've asked them this question. Here is the answer: Credit card information continues to be stored in our database in an encrypted format, and the decryption key is not stored electronically. We are working on a process on remove the credit card details of past customers on request and can handle this for you soon if you would like. If you have any further questions or concerns please let us know.

So the answer really doesn't answer the question.

(It appears the answer is no, but given they haven't been forthright in the actual details of the hack, possibly not)

Re: Linode hacked, CCs and passwords leaked

#404

Post by kalleboo »

FooBarWidget wrote: post #400
ghshephard wrote: post #385

Earlier quoted context omitted.

It depends on how sophisticated the identify theft is. I had a good friend who was taken for about $9000 in credit card fraud in 1998/1999, with Well Fargo. It took him the better part of six months, and endless correspondence with WF to prove all of the purchases were not his. There are lots of stories of people who were financially wiped out, to the point of bankruptcy, because of Credit Card/Identify fraud. With t…

That makes me wonder why the credit card system is so insecure in the first place. Why are credit card systems not secured with a password that the merchant never gets to see? Yet at the same time credit card suppliers keep bragging about how "secure" their cards are.

> Why are credit card systems not secured with a password that the merchant never gets to see?

My bank in Sweden requires MasterCard SecureCode for all online transactions on their debit cards. Stores that don't support it simply won't work with the card.

So, it's up to the bank how secure they want it to be. The technology is there.

Re: Linode hacked, CCs and passwords leaked

#405

Post by lmm »

kalleboo wrote: post #404
FooBarWidget wrote: post #400

Earlier quoted context omitted.

That makes me wonder why the credit card system is so insecure in the first place. Why are credit card systems not secured with a password that the merchant never gets to see? Yet at the same time credit card suppliers keep bragging about how "secure" their cards are.

> Why are credit card systems not secured with a password that the merchant never gets to see? My bank in Sweden requires MasterCard SecureCode for all online transactions on their debit cards. Stores that don't support it simply won't work with the card. So, it's up to the bank how secure they want it to be. The technology is there.

Of course, the main difference being signed up with such a bank makes is it's now harder to legally dispute fraudulent transactions on your card.

Re: Linode hacked, CCs and passwords leaked

#406

Post by kalleboo »

GuyCall wrote: post #304
clauretano wrote: post #209

Earlier quoted context omitted.

Bank of America provides this [1], as does Citibank [2] and likely others. Paypal at one time provided this service as well, but it doesn't seem to anymore [3] 1: https://www.bankofamerica.com/privacy/accounts-cards/shopsaf... 2: https://www.citibank.com/us/cards/gen-content/messages/van/i... 3: https://www.paypal.com/va/webapps/mpp/security/general-freet...

Nice. I wonder if any UK providers do this

My bank in Sweden does (Swedbank), so it's not a US-only thing. They even have an iPhone app for it.

Re: Linode hacked, CCs and passwords leaked

#407

Post by kalleboo »

kyrra wrote: post #125
xr09 wrote: post #90

Earlier quoted context omitted.

I'd give another trust vote to Linode, anyway this could happen to anyone.

Linode really needs to make a statement about what happened with this hack, stating if credit card information was taken. A lack of communication does not help me trust them. I'd rather have them speak up as to what happened and know if I need to have my CC reissued.

They may not know if CC info was taken or not.

Re: Linode hacked, CCs and passwords leaked

#408

Post by kalleboo »

lmm wrote: post #405
kalleboo wrote: post #404

Earlier quoted context omitted.

> Why are credit card systems not secured with a password that the merchant never gets to see? My bank in Sweden requires MasterCard SecureCode for all online transactions on their debit cards. Stores that don't support it simply won't work with the card. So, it's up to the bank how secure they want it to be. The technology is there.

Of course, the main difference being signed up with such a bank makes is it's now harder to legally dispute fraudulent transactions on your card.

Yep. I believe that's also true of Chip-and-PIN transactions. The liability is shifted onto the consumer to keep their PIN secret.

Re: Linode hacked, CCs and passwords leaked

#409

Post by BrandonM »

voidlogic wrote: post #217
nenolod wrote: post #212

Earlier quoted context omitted.

dd if=/dev/sda bs=1M | ssh root@ dd of=/dev/sda bs=1M let SSH handle compression for you instead.

That is one (good) way to handle the encryption. You don't want to leave out the compression or block size however, so add those back in. Most WAN links are low bandwidth enough that compression will not slow things down (this is usually true even on 1 GBE LAN links for pigz ) and in my experience the speed-up is substantial. pigz is much faster than using ssh compression as it is multicore. apt-get it or http://zlib…

Just add -C to the ssh command to enable compression.

Re: Linode hacked, CCs and passwords leaked

#410

Post by laxk »

douglasheriot wrote: post #401
taylorbuley wrote: post #326

Earlier quoted context omitted.

Did you see http://www.linode.com/linode4.css and http://www.linode.com/linode3.css ? Nevermind the security concerns. These guys aren't using version control!

Renaming CSS files with numbers or whatever is one legitimate way to handle cache invalidation (not evidence of not using version control)

It is not the best way to handle cache invalidation. Why not /linode.css?v= ?
Post reply on HN