101–110 of 119 posts
Earlier quoted context omitted.
HipChat has been a pile of crap for a long time. Why people willingly use that over Slack remains a mystery.
Slack does the same thing... files are uploaded to S3 as well. Slack isn't a panacea when it comes to security.
Why are they force resetting everyone's password if they are bcrypt'ed?
Earlier quoted context omitted.
Serious question: Do you need the non-techy explanation?
no.. but I could be a non IT user using hipchat. This sentence is likely meaningless to me.
blah blah...We take your privacy very seriously...blah blah...
[1] Technically, we use bcrypt with a random salt.
Earlier quoted context omitted.
What about using one of those pesky popular operating systems that everyone else uses. They're such big targets, using them only increases the bounty someone would get if they exploited them. You can build your own internal operating system to minimize the risk that anyone can break into your company's machines.
That's a bit different - no one here is suggesting recreating tools, merely using existing tools in a more secure manner and segmenting them off from the general public and sometimes the rest of your network too. Lowering your attack surface is often the cheapest way to stop attacks.
Earlier quoted context omitted.
it's considered best security practice to do so
By whom?
You might find the below numbers interesting. Note that this performance is only one workstation with 8x gtx980. Even the mighty bcrypt (sidebar, look at the sha512 #s) won't save you if your password is bad. Now consider social media mining to enhance the word list. Now consider that (anecdotally) I have never done a hashcat audit and not had to have a conversation with someone about choosing better passwords:
Hashtype: bcrypt, Blowfish(OpenBSD) Workload: 32 loops, 2 accel
Speed.GPU.#1.: 6398 H/s Speed.GPU.#2.: 6507 H/s Speed.GPU.#3.: 6513 H/s Speed.GPU.#4.: 6643 H/s Speed.GPU.#5.: 6534 H/s Speed.GPU.#6.: 6512 H/s Speed.GPU.#7.: 6689 H/s Speed.GPU.#8.: 6542 H/s Speed.GPU.#*.: 52338 H/s
Fine, but I wonder why they didn't reset the API tokens while resetting password immediately. Are they managed by the different servers/services?Doubt this will be a popular view around here, but using a 3rd party service for internal business communications is just a bad idea. I've seen companies posting root passwords, ssh keys, salaries, internal financial details, etc in Slack and HipChat. Just waiting for a disaster to strike, adding value for every additional company to the target. Maybe this breach won't be the last straw, but it's a consistent risk. Y…
What about Matrix?
Doubt this will be a popular view around here, but using a 3rd party service for internal business communications is just a bad idea. I've seen companies posting root passwords, ssh keys, salaries, internal financial details, etc in Slack and HipChat. Just waiting for a disaster to strike, adding value for every additional company to the target. Maybe this breach won't be the last straw, but it's a consistent risk. Y…
I had a gig at a company that used Hipchat once. I generally like the app, but I was shocked/appalled that posting files to the chat got uploaded to the AWS cloud with a URL that is retrievable anywhere. Do you know how often things like logs, config files, etc. got posted to chats? That place wrote insurance software too, so plenty of juicy financial information in their systems.
Earlier quoted context omitted.
That's a bit different - no one here is suggesting recreating tools, merely using existing tools in a more secure manner and segmenting them off from the general public and sometimes the rest of your network too. Lowering your attack surface is often the cheapest way to stop attacks.
What's being suggested is still a significant increase in spend for infrastructure. Self-hosting is not free. You lose economies of scale on the services. You need to hire an inhouse IT and/or infrastructure/ops team to support them. Your probability of downtime increases significantly, which comes with a cost. It's the same tradeoff you're talking about, with the only difference being the scale of cost.
It's not remotely comparable to re-developing the whole system. If your developers can maintain their own machines, they can probably handle this.
If I use the library, and it is non-essential for my business, then I should know what it is so that I can remove it.