Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you didn't cancel the credit card you used for linode.com, now is the time

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 138 posts

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#111

Post by jmillikin »

icebraining wrote: post #85
jmillikin wrote: post #80

Earlier quoted context omitted.

> There is no reason the keys have to be stored > separately. That is orthogonal to the actual requirement > that the private key is private aka. secret. It's effectively required to store the keys separately because if you stored the public key on the key bastion, it would be useless. > In fact, the public key is public meaning it is assumed > that anyone has or could gain access to it. It is > purposefully publishe…

A public key is a file. It can be stored in more than one place. For example, you can generate both inside the key bastion, and then copy the public key to the public servers, while leaving a copy on the bastion.

But that's not what Linode did. Linode put the private key right next to the public key, where anyone who compromised their web frontend could get at it.

If they had kept their private key where it belonged, we wouldn't be having this discussion because their security alert would have said "...and we have verified that no credit card data was accessed".

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#112

Post by jmillikin »

dllthomas wrote: post #89
jmillikin wrote: post #82

Earlier quoted context omitted.

"You are arguing that storing the public and private key in a vault under the ocean is not less secure than just storing the private key there. While that is technically true, it's also missing the point."

Consider someone learning their way around this stuff, but not yet well versed. They've heard people on HN talking about how "storing public key and private key together" is bad. Would you recommend they 1) move .ssh/id_dsa.pub to a different directory, or 2) make sure .ssh isn't world-readable? The issue was insecure storage of the private key - presence or absence of the public key is entirely irrelevant.

I'd recommend they not store the private key next to the public key; that is, they shouldn't do "scp .ssh/id_dsa* remoteserver:"

It doesn't matter whether there's something stored with the private key, both because that location should be secure and because the private key can used to recover the public key.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#113

Post by [deleted] »

mbesto wrote: post #37

Please provide a little more evidence than starting a flame war. Although it could in theory be true, it's a fairly baseless claim until you present a little more evidence. For my online transactions I use prepaid cards that are easy to dispose of, and this card was used solely for linode. Couldn't the online card issuer be to blame? How do we know you haven't mistakenly used it for anything else? The fact that you u…

[deleted]

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#114

Post by prodigal_erik »

jmillikin wrote: post #109
jdbernard wrote: post #99

Earlier quoted context omitted.

I think you are not talking about the same thing that the rest of us are talking about. I see three locations or context involved: 1. The public area - meaning anyone has access. 2. The application context (server, etc) -- should be a "secured" location, meaning few people or processes have legitimate access, and measures should be taken to prevent unauthorized access. The private key should never be present in locat…

> The typical assumption in most scenarios is that context > 2 is secure, and by that I mean secure enough to house > the private key. I disagree. An application server is, by nature, running a lot of untrusted and unaudited code exposed to a (semi-)public network. It should not be considered trusted, because it will probably be the first system to be compromised in any attack. > I am saying that anyone who has acces…

Putting the private key somewhere that antagonists could read it was insane. The fact that the public key was also there didn't do any extra harm, and removing the public key wouldn't help at all. Any attacker has (or can get) your public key, because anyone interested can, that's its purpose.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#115

Post by ianmcgowan »

I just got notified by my bank about a fraud notice, and they cancelled the debit card I use for Linode.

It's a huge pain, but I'm inclined to give Linode the benefit of the doubt. I've done enough stupid things in my life to not cast the first stone. Hopefully they'll learn from this, and beef up both their approach to security and their transparency. Strike one.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#116

Post by mikeash »

marshray wrote: post #104
mikeash wrote: post #100

Earlier quoted context omitted.

Or much higher, but this is unrelated to credit cards.

"A credit card would give me the ability to instantaneously take on $10,000 in debt. I don't want this." is a responsible and admirable position for someone to take.

Agreed, but once again irrelevant, as that's not what anybody in this thread of conversation has said.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#117

Post by artjumble »

X-Istence wrote: post #71
greenyoda wrote: post #26

Signing up for on-line services is a good use for "virtual account numbers". This is a feature offered on some Citibank and Discover credit cards (maybe others) that allows you to generate a separate credit card number that's billed to your original account. The nice thing about them is that once a virtual account number has been billed by a vendor, it does not accept any charges in the future except from the same ve…

I've got an account with Bank of America and they have that feature as well. Downside, none of their service reps even know it exists, even worse they are slowly phasing it out (making it more and more difficult to find) even-though it is a feature I absolutely love.

Could you point me in the direction of finding this feature? I always thought BofA did not have this and would like to use it while I can.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#118

Post by [deleted] »

jmillikin wrote: post #78
tailrecursion wrote: post #73

Earlier quoted context omitted.

twbrownaw is exactly right. If the private key is already in a secure location then there is no need to move it to a secure location. So, any report that the public keys were stored with the private keys means nothing by itself.

You are arguing that storing the public and private key in a vault under the ocean is not less secure than just storing the private key there. While that is technically true, it's also missing the point.

[deleted]

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#119

Post by maukdaddy »

I just got an email yesterday from Amex about suspicious activity on my account. The card was used to make purchases from at least three dating sites, groupon, Microsoft, hidemyip, and a handful of others.

This card is tied to Linode, Amazon, and one or two other large merchants. Sure looks like Linode CC numbers were breached.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#120

Post by caw »

waterlesscloud wrote: post #90
rosser wrote: post #74

Earlier quoted context omitted.

How does that work? It doesn't. The GP comment is FUD.

It is, however, an element of your credit score.

In that your credit score has a factor of actual debt to total credit. Someone with $1000 of debt on $100,000 in credit is much better off than someone with $1000 of debt on $5,000 of credit.

So things like car loans and mortgages could be bad, since they start at 100% and go down.

Post reply on HN