Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

101–110 of 162 posts

Re: Heroku Security Notification

#101

Post by wlll »

photon12 wrote: post #62

There's going to be a question about the expected probability of this across cloud service providers. I've done security work for multiple cloud service providers and know a lot of people in the industry. I'm not really privy to give details. I can say: dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, secur…

Unrelated to your main point, "I'm not really privy to give details.", that's not how you use privy. If you have the details but aren't allowed to share them then you are privy to the details, but you can't share them.

Privy means "sharing in the knowledge of (something secret or private)", but it has nothing to do with sharing that knowledge with others.

Re: Heroku Security Notification

#102

Post by DethNinja »

onphonenow wrote: post #4

Ugh - I got the password reset email w silly password complexity - never a good sign.

That email made it clear that Heroku lacks fundamental knowledge about security. I’m sure they lost some enterprise customers, I know I don’t open accounts on websites with silly password complexity requirements.

Re: Heroku Security Notification

#103

Post by xena »

glenngillen wrote: post #9
VWWHFSfQ wrote: post #3

> Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. What else was in this database? Typically the password field is stored alongside the rest of the user record. So was this the entire customer database that was stolen? Usernames, emails, salted/hashed passwords, what else?…

Yeah, the comms around this has been very concerning. Do I need to rotate every config var on all of my apps? Re-install every add-on? While the nature of what limited things they had disclosed to date pointed to this situation part of me wanted to believe it wasn't as bad as I was assuming. And now the trendline on this suggests I should have already done everything I've outlined above. And I'm low confidence anybod…

IIRC the environment variable settings are encrypted in a physically separate database. However it may be a good idea to rotate your secrets anyways. My hunch would be that there are so many "juicy" targets on Heroku that you probably don't need to worry too much right now unless you are or work for a "juicy" target.

This is gonna suck.

Re: Heroku Security Notification

#105

Post by dgb23 »

hnbad wrote: post #79
pm90 wrote: post #69

Earlier quoted context omitted.

Agreed. cloud providers’ incentives are aligned with growth which naturally mean easy accessibility; hence all the defaults being generally “open”. Its so easy to make a resource accessible to anyone, or an IP accessible from anywhere in the cloud without proper restrictions by internal teams in the company; and often the default is to give teams superadmin to “unblock their time sensitive project” rather than mainta…

> cloud providers’ incentives are aligned with growth which naturally mean easy accessibility; hence all the defaults being generally “open” So no different from every VC funded startup (or startup seeking VC funding) then? The sentiment of imposing tighter regulations around data security feels counter to the general idea that the lack of regulations around data security (e.g. strong data protection laws) are what a…

It’s quite simple. Doing the right thing has short term costs and long term benefits.

Re: Heroku Security Notification

#106

Post by adrr »

lovelearning wrote: post #49

> On April 7, 2022, a threat actor obtained access...GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation. Can some experienced security professionals weigh in on the cultural and organizational factors that allow this kind of major breach to go unnoticed for a week, that too in a reputed company like Heroku? I'm not asking this rhetoric…

Because Heroku/Salesforce doesn't have real security. Requiring special characters in passwords and sending out emails that have http and not https links to a password reset page. Their security is a joke.

Re: Heroku Security Notification

#107

Post by Dave3of5 »

ojame wrote: post #84
staindk wrote: post #82

Earlier quoted context omitted.

I'd maybe use this as an opportunity to prioritise moving everything over to AWS. I'm sure for some it may be an unwieldy amount of work but for others (depending on tech stack etc.) it ought to be fairly doable. In the long run it'll save money too.

I’m interested in peoples experience with this and if it’s relatively true. We (like many others I assume) pay more for Heroku than AWS as it allows us to “outsource” our dev ops. We are a small team (sub 15) with a decent sized, decade old app. We’ve had it on AWS before (and used platforms like BuildKite) but both required much more overhead (in terms of employee salary). Anecdotally I’ve heard the same from friend…

> I’m interested in peoples experience with this and if it’s relatively true.

My personal experience is that AWS is always more expensive. You don't use AWS because of the cost saving you use it because:

* Top of the line h/w * Always the first to bring out new features * Very high availability of resource, like seriously I've never had a time even during the pandemic where they struggled with resource availability * Resilience of AWS systems are very high * Very good support

There was an article a few months back where a teams tried moving from Heroku to AWS to save money and ended up spending nearly 3x the amount. Heroku give more resource than you actually pay for by default and it turns out they were using the extra resource during normal operation. When they done their calcs for a switch to AWS they used the quoted resource that Heroku say you get and there system died due to being under resourced. They had to up the resource which pushed them well over their budget. I'll try and find the article.

Please Note: Heroku servers are on AWS already

Re: Heroku Security Notification

#108

Post by Mandatum »

intern4tional wrote: post #100
richardfey wrote: post #97

Earlier quoted context omitted.

> fired speakers who do things they disagree with Can you please make an example? I am genuinely curious about what things

https://tech.slashdot.org/story/17/08/10/1919204/salesforce-... . is probably the most well known incident. There have been others though.

Hi Jim Alkove!

Re: Heroku Security Notification

#109

Post by sleepyhead »

henryaj wrote: post #75

Obviously Heroku have handled this horribly - but are any small startups out there considering replatforming? Still seems like a lot of hassle and the competition I've tried (Cloud66, excid3's thing) haven't been as good.

What was the problem with Cloud66?

I looked at Render but they move data out of the chosen region (so out of EU) and that is a huge issue for our clients. They also proxy through Cloudflare which is another big problem when you are dealing with sensitive data.

Re: Heroku Security Notification

#110

Post by t_sawyer »

I'm interested if application ENVs were stolen. If they stored Github APIs in plain text I'm sure our ENVs were too.

I went ahead and reset my planetscale passwords and moved my app out of Heroku. But I only had two apps hosted there I feel for anyone with a large number of apps on there.

Post reply on HN