Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

101–110 of 277 posts

Re: Matrix.org hacked

#101

Post by laumars »

lelf wrote: post #80
laumars wrote: post #67

Earlier quoted context omitted.

Unfortunately not on Macs :( That's one of the features I miss the most when using terminals on a Mac.

Of course you can. It’s «ESC .» or «^[.» Or you can check “Profiles → Keyboard → Use Option as Meta” for Terminal.app [or just press ⌥⌘O]. And then use option as meta.

> Of course you can. It’s «ESC .» or «^[.»

Thanks, I wasn't aware of that. However it's a different hotkey and only pulls the last parameter. The shell I use, you could hit + and you would get a parameter of that number completed - not just the last parameter. It was very handy for rebuilding long command lines with different arguments.

> Or you can check “Profiles → Keyboard → Use Option as Meta” for Terminal.app [or just press ⌥⌘O]. And then use option as meta.

I use iTerm2 - which does seem to have similar options but I'm yet to get it working. I know that's down to user error but it's still a real pity that it isn't just the default behaviour (in either iTerm or Terminal).

Re: Matrix.org hacked

#102

Post by notyourday »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

Matrix operational security is a joke and developers understanding of security is a joke. This is 2019, not 1992.

Infrastructure with ssh access without hole punching for currently active authorized connections only? Decrypted signing keys accessible over the network? CI servers and developers having root access?

Though the "we had to revoke all the keys so you lost access to your encrypted messages unless you backed them up" takes the cake.

Re: Matrix.org hacked

#103

Post by XMPPwocky »

scanr wrote: post #93
XMPPwocky wrote: post #90

Earlier quoted context omitted.

SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.

Is there a secure alternative that achieves the same outcome?

I'm not sure. A secure, backwards-compatible (with older servers) alternative, which only exposes keys you explicitly choose to expose, should be doable and might help.

another option would be for a SSH client to present a full-screen "$HOST is trying to use your your SSH PRIVATE keys. Press enter, then type "~A" to allow." prompt.

Re: Matrix.org hacked

#106

Post by notyourday »

Arathorn wrote: post #53

Project lead for Matrix.org here - you can see our initial statement on this at http://matrix.org/blog/2019/04/11/security-incident/ . It will be updated shortly to reflect the DNS defacement linked here (which was because we failed to rotate a leaked cloudflare API token; we aimed to rotate the master API token but rotated a personal one instead). To our knowledge the rebuilt production infrastructure itself is secu…

Have you implemented hole punching?

Re: Matrix.org hacked

#107

Post by Leace »

aidos wrote: post #99
XMPPwocky wrote: post #90

Earlier quoted context omitted.

SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.

If you use Yubikey with touch-to-use enabled that'll be basically what you're asking - each authentication will require touching the token.

Re: Matrix.org hacked

#108

Post by laumars »

raverbashing wrote: post #86
laumars wrote: post #60

Earlier quoted context omitted.

I have no issue with people who want to prefix grep (nor any other command for that matter) with cat. However I do completely disagree with your 2nd point. It's literally just: grep [flags] search_pattern [filename] In GNU grep (eg Linux) it's even easier because your flags can appear wherever in the command you want (even at the end). Though I'd recommend sticking to the habit of having them after the executable nam…

It's easy, once you get it Take a look at the man page (linux) grep [OPTIONS] PATTERN [FILE...] grep [OPTIONS] -e PATTERN ... [FILE...] grep [OPTIONS] -f FILE ... [FILE...] Now -f does not specify the file to grep, it specifies a file where to read patterns from (and they have the same "variable" name there, confusing) Not to mention globbing and other shell escapes (which is not grep's fault, of course, but you migh…

That's not a typical usage of grep and nor is it even the first instruction in the man page.

Let's actually take a look at the man page shall we:

    Synopsis
    
    grep [OPTIONS] PATTERN [FILE...]
    grep [OPTIONS] [-e PATTERN | -f FILE] [FILE...]
That first line is more or less exactly what I posted, is your typical usage of grep, and is very easy to learn.

Sure, you can list of esoteric examples of grep usage but that's besides the point if it's not how people would typically use grep (in my ~25 years of command line usage, I can't even remember one occasion when I've needed `-f` - not saying it hasn't happened but it certainly isn't something I've needed regularly)

Re: Matrix.org hacked

#109

Post by metafunctor »

scanr wrote: post #93
XMPPwocky wrote: post #90

Earlier quoted context omitted.

SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.

Is there a secure alternative that achieves the same outcome?

Here are a few ideas that might help.

Use separate keyboard-interactive 2FA (I recommend google-authenticator) for production ssh access.

Use a key system which requires confirmation or a PIN to authenticate (such as a Yubikey). Use a persisting ssh connection with Ansible (ControlPersist) to avoid unnecessary multiple authentications.

Allow connections only from whitelisted IPs, or Uuse port knocking to open temporary holes in your firewall, or require connections to production infrastructure to go through a VPN.

Access production infrastructure from hardware dedicated for that purpose, never do anything else on it.

I wish there was a way in ssh to tag connections and only allow agent forwarding to keys with the same tag. That would prevent agent forwarding production keys from a dev host.

Post reply on HN