[deleted]
Yes, really.
It's a support system - do you want them to paste in their private key to login?
MongoHQ Security breach
11–20 of 130 posts
Re: MongoHQ Security breach
#12Long story short: MongoHQ is securing access to critical administration functionality behind a VPN and will be requiring two-factor authentication instead of having that functionality available to anyone on the internet via a simple password.
What's interesting is that I think we've all been there at one point. You start building something, it gains momentum, then you get so bogged down with adding functionality and fixing bugs that you never get around to implementing the security features you know you should. At what point do you say "Okay, we have too much at risk to not correct this immediately"?
Re: MongoHQ Security breach
#13One thing I hate seeing is startups and security. Not that mongo is bad or anything this is just a good time to say it.
Build your product correctly from the start and have a security policy early. Don't leave XSS in your website, don't just hack code together and throw it on a server. As a security guy I love seeing new startups products because so often the code is so freshly written and immature that anyone it's asking for trouble. Measure twice cut once
Re: MongoHQ Security breach
#14The name of this company is unfortunate. It doesn't appear that this service has any affiliation with MongoDB, Inc.
[deleted]
Re: MongoHQ Security breach
#15At least they used bcrypt to hash user passwords.
For the non-experts among us, does this imply that having the bcrypted passwords in hand is almost worthless from an attackers point of view? Would it be feasible at all to derive the plain-text passwords from that encrypted data?
Re: MongoHQ Security breach
#16If I were running a company, I'd buy everyone a license of 1Password and make its use mandatory. Sure there are still plenty of attack vectors, but it's just too easy, and 1Password is such a cheap way to mitigate risk (not to mention you're doing your employees a huge favor by reducing their vulnerability outside of work).
Re: MongoHQ Security breach
#17At least they used bcrypt to hash user passwords.
For the non-experts among us, does this imply that having the bcrypted passwords in hand is almost worthless from an attackers point of view? Would it be feasible at all to derive the plain-text passwords from that encrypted data?
Much harder, not impossible.
Re: MongoHQ Security breach
#18Re: MongoHQ Security breach
#19detected unauthorized access to an internal support application using a password that was shared with a compromised personal account Someone's updating their resume tonight.
Seems a bit harsh to fire someone for that. People make mistakes. If anything, you know that this person isn't going to make the same mistake ever again.
Of course, if they do, then firing might be the way to go. First time mistake, second time incompetence.
Re: MongoHQ Security breach
#20So I am wondering if any service I'm using is using MongoHQ to store my sensitive information in plain text and was breached. Like, it is a bigger deal than just "change your password" when an attacker can "god mode" into customer databases.