31–40 of 53 posts
fascinating stuff. I'm still amazed at how many username/passwords are freely available via github search: https://github.com/search?p=96&q=gmail+password&ref=searchre... even if they have 2-step auth setup, people choose "complete the email address" as a form of authentication which you can most likely get from their github profile. the moral of the story here is - if you do not want someone to find it - do not publ…
>Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password.
What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password.
That means that an attacker who gains access to the application can easily just look at the file where the password is stored and then use that to access the database.
Even if you'd go great lengths at keeping asking for the password at server start and only keeping it in memory - once an attacker is on the application server, the password is in memory and can be snooped.
So the question is: Why even use a password for the web application? In my case, I'll just let the application servers connect to the database without password.
Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password. What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password. That means that an attacker who g…
Auditing (per tool)?
Not all attackers come "through the front door"
Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password. What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password. That means that an attacker who g…
Different access levels? (your app may not have the right to erase data/drop tables for example) Auditing (per tool)? Not all attackers come "through the front door"
Earlier quoted context omitted.
Different access levels? (your app may not have the right to erase data/drop tables for example) Auditing (per tool)? Not all attackers come "through the front door"
Yes. But I'm talking about the password for the account that the web application itself is using. That one IMHO is superflous. Other access levels, of course, might require a password.
Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password. What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password. That means that an attacker who g…
Interesting. It's also interesting that Facebook developers are using Pastebin for things such as this. I would assume that they'd have an internal wiki, or gist-like app. It's also noteworthy to see how they set up their accounts: first initial, full lastname—same standard as many other companies. But seeing it laid out can help in the guessing of other names (or common name occurances, as you don't even need a full…
I'm not surprised they don't have a gist/pastebin like app. When I interned at Amazon this summer, they were just developing one, and it was still pretty alpha (persistence was buggy and lost me an entire design review of notes). Facebook is younger, so it seems fair that they don't have one.
Interesting. It's also interesting that Facebook developers are using Pastebin for things such as this. I would assume that they'd have an internal wiki, or gist-like app. It's also noteworthy to see how they set up their accounts: first initial, full lastname—same standard as many other companies. But seeing it laid out can help in the guessing of other names (or common name occurances, as you don't even need a full…
We have an internal pastebin, it's built into Phabricator. There is no preset format for unixnames. Most people use their names but I've seen many pseudonyms. One intern famously broke some internal tools by requesting her initials, which were "www".
Somewhat ominous for top HN users: http://pastebin.com/6GeZnS9b
Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password. What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password. That means that an attacker who g…
A password means you can't access the database server from a mail server or file server. Complex environments have more than just a database server and a few web servers.