Billion dollar startup opportunity: un-hackable, secure databases as a service.
You mean like when Oracle claimed that its servers were "unbreakable"?
It's a ridiculous claim for anyone to make.
Hackers raid eBay in historic breach, access 145 million records
21–30 of 100 posts
Re: Hackers raid eBay in historic breach, access 145 million records
#22Just changed it.
I don't understand why eBay (and others) don't offer two-factor authentication. Of course this wouldn't have prevented the data theft but at least one can have a reasonable degree of certainty that your individual account will not be compromised with a simple password.
I also strongly suggest that you change the answer to the one-and-only secret question to something completely unrelated. For example, if the question is "What's the name of your high school?" the answer could be "violet and purple are similar". In other words, make it impossible to socially engineer the answer to such questions. I wonder if these answers were also stolen.
Re: Hackers raid eBay in historic breach, access 145 million records
#23Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme?
Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
Re: Hackers raid eBay in historic breach, access 145 million records
#24Amazon is probably next.
Re: Hackers raid eBay in historic breach, access 145 million records
#25Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
Make a law. I don't think there are actual laws in place that hold companies liable when stuff like this happens. I don't even think they are required to have regular security audits.
Re: Hackers raid eBay in historic breach, access 145 million records
#26With such a large user database, why isn't tar pitting db requests the norm?... or at the very least, instituting something as simple as a flag on dummy record requests?
A flag on dummy record requests? You mean have records that don't correspond to real accounts, and audit access to them? How would you censor them from legitimate full traversals of the user database? How would you tar-pit attackers without throttling such legitimate processes?
There's an interesting project called "Honeywords" (one of the authors is Ron Rivest) http://people.csail.mit.edu/rivest/honeywords/
Link to paper: http://people.csail.mit.edu/rivest/honeywords/paper.pdf
(see also recent paper "Some Remarks on Honeyword Based Password-Cracking Detection" https://eprint.iacr.org/2014/323.pdf)
Re: Hackers raid eBay in historic breach, access 145 million records
#27Can someone please help me understand why their stock price was not impacted by this? I observed Target when similar incident happened and nothing seemed to change.
Is the general market neglecting security exploitations or is the damage too small for those big companies? I personally think that it's a big hit for the companies. They will have to spend money to patch it up and also lose trusts from users.
Re: Hackers raid eBay in historic breach, access 145 million records
#28Is it safe to change my password now? All I read in the article is how much they are investigating this. How do I know the hackers don't still have access and are now actively monitoring password changes potentially getting more info?
I am concerned that there is nothing about this on the eBay front page and that I have not received an email from eBay about this
Re: Hackers raid eBay in historic breach, access 145 million records
#29Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
You need to know how they store passwords because ... what?
Re: Hackers raid eBay in historic breach, access 145 million records
#30Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
Make a law. I don't think there are actual laws in place that hold companies liable when stuff like this happens. I don't even think they are required to have regular security audits.
Not sure about the US laws, but in South Africa we have the Protection of Personal Information Act (Popi) and it became law on November 26 2013.
"Popi essentially regulates how anyone who processes personal information must handle, keep and secure that information.
Personal Information broadly means any information relating to an identifiable, living natural person or juristic person (companies, CC’s etc.) and includes, but is not limited to:
contact details: email, telephone, address etc. demographic information: age, sex, race, birth date, ethnicity etc. history: employment, financial, educational, criminal, medical history biometric information: blood type etc. opinions of and about the person private correspondence etc."