Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never Give Your Information To 10 Minute Old Startups

blog.ryankearney.com

Post reply on HN
Print view View original

181–185 of 185 posts

Re: Never Give Your Information To 10 Minute Old Startups

#181

Post by thisone »

sergiotapia wrote: post #143
thisone wrote: post #129

Earlier quoted context omitted.

it's something someone would do who's never worked with authentication and authorization before and doesn't have the fallback of a professional tester (aka breaker). As people have mentioned, rails doesn't have it built in. I've used gems to provide it since I don't trust myself to write good enough security algorithms (and really, why reinvent the wheel if I don't have to). In .net we can use the asp.net membership.…

In .NET you can protect controller action methods using `[Authorize]` data attribute above each method. You can even create your own custom filters. http://www.youtube.com/watch?v=BsxUsyMSGeA Just letting you know. :)

indeed, aren't specifics, wonderful.

However, I do think that authentication is where people may believe they can stop, forgetting or maybe not understanding, that authentication really doesn't do much, without an authorization system.

Re: Never Give Your Information To 10 Minute Old Startups

#182

Post by rlpb »

Silhouette wrote: post #22

10 minutes? Never give your information to a business that made a mistake like this, ever . That wasn't merely a "security vulnerability". It was also a demonstration that the people running the business have absolutely no idea what they are doing when it comes to security, privacy, or testing and release processes. (Actually, there is an alternative explanation, which is even worse: they knew and didn't care. I pref…

> a business that made a mistake like this

I go one step further. I refuse to give information that provides more access to a business than they need to have or that can even affect any other service I receive from anywhere else.

Here, I'd like to give them a key that works only with glacier vaults that they have created, and nothing else. If this isn't possible, then I'll go without.

Re: Never Give Your Information To 10 Minute Old Startups

#184

Post by rdl »

paulsutter wrote: post #92

I'd love to see some concrete suggestions on the right way to do security for a site like this. This would take far more than protecting a few web pages from unauthorized access. What else should they do? How should they store sensitive data like AWS keys? Should they include a feature to force the creation of a new temporary key to prevent users from naively storing their master key? Is there a better mechanism than…

I've been working on a similar kind of problem (linking to AWS); the right thing is to walk users through IAM credential creation (if you must have the keys), explaining exactly what rights are needed, why, and how to verify, and to not take anything more than you need.

I'd also encapsulate use of any user-provided sensitive data in an API then called by your service, and put some logic within the API (because I don't want a random web UI screwup to dump everything for everyone) -- rate limits, etc.

Re: Never Give Your Information To 10 Minute Old Startups

#185

Post by rdl »

paulsutter wrote: post #92

I'd love to see some concrete suggestions on the right way to do security for a site like this. This would take far more than protecting a few web pages from unauthorized access. What else should they do? How should they store sensitive data like AWS keys? Should they include a feature to force the creation of a new temporary key to prevent users from naively storing their master key? Is there a better mechanism than…

I've been working on a similar kind of problem (linking to AWS); the right thing is to walk users through IAM credential creation (if you must have the keys), explaining exactly what rights are needed, why, and how to verify, and to not take anything more than you need.
Post reply on HN