Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github seems to be experiencing security issues

github.com

Post reply on HN
Print view View original

51–59 of 59 posts

Re: Github seems to be experiencing security issues

#51

Post by 300bps »

pja wrote: post #50
awjr wrote: post #29

Earlier quoted context omitted.

Just one foot note (as I have just taken my own advice and turned it on). Suddenly I couldn't push/pull through the git command line access as it would not accept my password. Took me a bit to work it out but you need to go here https://github.com/settings/applications and create personal access tokens.

If you need to store a personal access token in order to pull or push to your own repos, how is two-factor auth any better than a normal account with a secure (ie reasonably long, unique, randomly generated) password?

I use 2FA with GMail and the same question could be asked. The answer is that an application password does not have admin rights to the account. It can be revoked at any time. It traces the breach directly back to a particular application. They are not meant to be memorized but rather to be set and remembered in a particular application which means they can be extremely complex and are by default. I have to think that at least some of this is applicable to GitHub's 2FA.

Re: Github seems to be experiencing security issues

#52

Post by thibaut_barrere »

m4tthumphrey wrote: post #40
phpnode wrote: post #39

Earlier quoted context omitted.

no, they definitely shouldn't, for the same reason they don't store the real passwords in plain text. it would be a terrible security hole.

Sorry for being ignorant, but why is providing the passwords they guess/automate a security issue?

For instance (just a quick idea): because if you make a mistake and enter your gmail password instead of your github password, now your gmail password is stored in clear text in their database, opening another can of worms etc.

Re: Github seems to be experiencing security issues

#53

Post by chalst »

aaronpk wrote: post #4

I don't get it... this is my own security page which looks normal to me. [edit] I see one failed login attempt from a chinese IP like other people are saying. Maybe that is what OP meant to point out?

I guess the point is that these auth failures were rare. I've seen 5 failed login attempts in the past 3 days, on an account that had none in its previous two years.

Re: Github seems to be experiencing security issues

#55

Post by pja »

300bps wrote: post #51
pja wrote: post #50

Earlier quoted context omitted.

If you need to store a personal access token in order to pull or push to your own repos, how is two-factor auth any better than a normal account with a secure (ie reasonably long, unique, randomly generated) password?

I use 2FA with GMail and the same question could be asked. The answer is that an application password does not have admin rights to the account. It can be revoked at any time. It traces the breach directly back to a particular application. They are not meant to be memorized but rather to be set and remembered in a particular application which means they can be extremely complex and are by default. I have to think tha…

Your points are good ones for something like GMail (where a single account allows access to many Google services and includes a potentially huge trove of other private data).

For github though, the the repos you have read (or commit if vandalism is the risk) access to are the data in question, so unless you use your github account for other things, I'm still not really seeing the benefit to the end user if you still have to store OAuth tokens everywhere you actually use git.

Can github issue OAuth tokens that are restricted to a specific repo? At least that would prevent a token leak exposing other repos that you had access to.

Re: Github seems to be experiencing security issues

#56

Post by dudus »

bergie wrote: post #33
wgx wrote: post #13

The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts. As anyone who's put an EC2 up without secu…

I wonder if this is related to the recent Adobe and vBulletin user database breaches. They might be trying those passwords on GH.

I wonder. I used the same username and password for both Adobe and github. But they were not able to break in.

Of course I changed the password for github now.

I have 14 failed attempts in the last 4 days.

Re: Github seems to be experiencing security issues

#57

Post by wgx »

lotsofcows wrote: post #34
wgx wrote: post #13

The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts. As anyone who's put an EC2 up without secu…

Or attached any box directly to the internet. This looks like bog standard background noise to me.

Amen.

Re: Github seems to be experiencing security issues

#58

Post by ValentineC »

csmuk wrote: post #42
bergie wrote: post #33

Earlier quoted context omitted.

I wonder if this is related to the recent Adobe and vBulletin user database breaches. They might be trying those passwords on GH.

Very likely. We've just added a kill-list of known decrypted passwords and English language words and forced people to reset their passwords who are listed in the adobe breach.

How do you find out that someone's using a known decrypted password on your service?

Re: Github seems to be experiencing security issues

#59

Post by csmuk »

ValentineC wrote: post #58
csmuk wrote: post #42

Earlier quoted context omitted.

Very likely. We've just added a kill-list of known decrypted passwords and English language words and forced people to reset their passwords who are listed in the adobe breach.

How do you find out that someone's using a known decrypted password on your service?

From here: http://stricture-group.com/files/adobe-top100.txt

We wrote a script that hashed these passwords with the stored salt for each user and compared the result with the stored hashed value. Basically we brute forced everyone's accounts with the dictionary provided. Anyone who was found with an account that was in the dictionary was locked out with forced password change. We changed the password policy before doing this to increase complexity and block dictionary and the decrypted list words. We also force people to change their password every 28 days anyway and keep the last 7 hashed passwords and salts to verify that the user hasn't reused.

We store financial data so it's pretty hardcore auth requirements.

Post reply on HN