Ok, so can anyone recommend an established VPS provider, with a comparable management interface, and a track-record of excellent security practices?
Linode Manager Two-Step Authentication
21–30 of 87 posts
Re: Linode Manager Two-Step Authentication
#22After being bitten the first time with Linode I don't care what technical measures they are taking. I want to know what process and policy changes have been made. Do they still store public/private keys on the same server ? How often are they doing security audits (which clearly never happened before) ? Are they still going to be dodgy and withhold key information from their users ? Are users still going to find out…
I also find it really troubling they haven't released a "Here's what we're doing different" blog post in response to the attack. Their only blog post on the matter came a week (2 weeks?) after the intrusion, which they were of course pressured to release after everyone found out via a pastebin IRC transcript... By chance I happened to sign up for my first Linode account the day before that hit HN.
I hope their silence on the aftermath is due to an ongoing investigation with feds, or something, where they can't talk about it yet. Do they think their customers are stupid and will forget the incident?
Imagine if AWS had a security breach of that magnitude. They would release an initial 4000 word blog post in grave technical detail, and then follow up with a 25 page white paper, or whatever.
Oh, and to stay on topic, I tried Linode's 2-factor with Google Authenticator and it works well.
Re: Linode Manager Two-Step Authentication
#23Earlier quoted context omitted.
The problem wasn't in passwords being stolen. CC information was allegedly leaked.
Allegedly? They admitted it was.
They admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.
Re: Linode Manager Two-Step Authentication
#24Glad to see Ann Arbor's Duo Security listed as a choice. Know the team and if you chose the Duo option you won't regret it.
Re: Linode Manager Two-Step Authentication
#25This will do absolutely nothing if Linode themselves are hacked, which is what happened the past two (100% of the) times.
Ok, so they get hacked and passwords are stolen and those are cracked. Guess what? They're useless. With 2FA, the attackers still won't be able to get in.
No, if you hack the portal, you can get whatever info it mediates; the attackers don't need to then use the passwords and 2fa tokens to log in to get it, they just bypass authentication entirely.
It's totally reasonable to believe linode is enough of a clusterfuck internally, based on past performance that this kind of thing is plausible. Yes, this protects you from one kind of attack if an attacker only gets limited access to linode's systems.
The other issue is it doesn't protect you from password reuse. If a user is dumb and uses his global password for his linode password, and linode is hacked again, and the password is recovered, the attacker uses that userid/password/email/etc. to attack other accounts of that user at other services.
Re: Linode Manager Two-Step Authentication
#26Ok, so can anyone recommend an established VPS provider, with a comparable management interface, and a track-record of excellent security practices?
Pick two of those and you have options.
Re: Linode Manager Two-Step Authentication
#27Earlier quoted context omitted.
Allegedly? They admitted it was.
They admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.
It was also made clear that the encryption key was protected by a passphrase which was not stored on the machine.
Re: Linode Manager Two-Step Authentication
#28Earlier quoted context omitted.
Allegedly? They admitted it was.
They admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.
Linode confirmed that the private encryption key was stored on the same machine. They've been parroting lines about the password on the private key being too strong to crack.
Re: Linode Manager Two-Step Authentication
#29Ok, so can anyone recommend an established VPS provider, with a comparable management interface, and a track-record of excellent security practices?
Pick two of those and you have options.
I'm happy with "established VPS provider", and "a track-record of excellent security practices".
After posting, I realized 1 and 3 are a bit redundant. You have to be established to have a track-record, of course.
Re: Linode Manager Two-Step Authentication
#30After being bitten the first time with Linode I don't care what technical measures they are taking. I want to know what process and policy changes have been made. Do they still store public/private keys on the same server ? How often are they doing security audits (which clearly never happened before) ? Are they still going to be dodgy and withhold key information from their users ? Are users still going to find out…
"Do they still store public/private keys on the same server?"
As phrased, this is not a problem - there's never any worry to including your public key wherever you have your private key; your attacker can be assumed to have your public key anyway if it'll do them any good.
The problem was private keys (encrypting important things!) on a web-accessible server, was my understanding.