Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#201

Post by tedmiston »

rqs wrote: post #116
lugg wrote: post #2

If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

You can authorize specific orgs your account has access to vs your whole account if that's what you're looking for.

Also not sure what access permissions you need but deploy keys are repo level.

https://developer.github.com/v3/guides/managing-deploy-keys/...

Machine users are another option.

https://developer.github.com/v3/guides/managing-deploy-keys/...

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#202

Post by tedmiston »

logophobia wrote: post #199
gtirloni wrote: post #193

Earlier quoted context omitted.

It looks like they have sent emails to everyone, not just the 5% affected.

I haven't received an e-mail, I've got multiple docker-hub accounts.

I haven't received one yet either.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#203

Post by craftoman »

onei wrote: post #195
dvdgsng wrote: post #183

Earlier quoted context omitted.

Wait, designed to work with http only? Link?

I think "http only" is a bit misleading given [1], but I'm no expert. In essence, apt doesn't use HTTPS because it provides limited value for a package manager. However see the link for a more comprehensive explanation. [1] https://whydoesaptnotusehttps.com

Apt create 20 years ago, it's using HTTP protocol almost everywhere even today. They should have redesigned the whole project and ban the HTTP completely IMHO. I'm using HTTPS even on localhost services when I have for example a project that needs Grafana and influxDB.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#204

Post by lentil »

r3bl wrote: post #185
lentil wrote: post #47

Earlier quoted context omitted.

It doesn’t require one to use it. I use it daily on MacOS and I don’t have an account.

It requires one to download the installer: https://hub.docker.com/editions/community/docker-ce-desktop-... Notice the big "Please Login to Download" button.

True, they make it look required there, but you can use one of the direct download links instead (eg linked from https://docs.docker.com/docker-for-mac/release-notes/) or use Homebrew to install it.

The problem is more that they make it harder to find if you don’t log in, which is really not great. But if you don’t want to create an account there is certainly no need to do so.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#205

Post by sodosopa »

franee wrote: post #188
reidrac wrote: post #91

Earlier quoted context omitted.

At the moment I can't change the password. It fails with "Failed to save password" error, no more information. EDIT: it finally worked, 4th attempt, and very slowly. Looks like something isn't working 100% as it should EDIT 2: aaaand I can't login now with the new password. A password reset did work, but it looks like their password database is under some stress at the moment.

Same can't change password

I could as of 10 minutes ago

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#206

Post by sigotirandolas »

rqs wrote: post #116
lugg wrote: post #2

If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

I found this snippet on Docker Hub's Linked Account Settings:

> Service user (or machine/bot account) suggested

> Attaching your personal GitHub or Bitbucket account to this Docker Hub organization will allow other organization owners to create builds from your private repositories. We suggest using a service user (also referred to as a machine user or bot account).

c.f.: https://docs.docker.com/docker-cloud/builds/automated-build/...

Seems worthwhile to do this, if you're an enterprise or otherwise have sensitive private repos. But I agree that it would be better to have an easier per-repo authorization system, since many users won't bother going through the hassle of setting up a service account.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#207

Post by nickgros »

matthewaveryusa wrote: post #200
Sukram21 wrote: post #131

Earlier quoted context omitted.

GitHub provides a way for more granular third-party access: GitHub Apps . There, access can be set on a repository level [1]. E.g. Netlify can be configured as a GitHub app. It seems like Docker Hub is implemented as an OAuth app [2], where these granular options are not available and you have to grant access to all your repositories. [1] https://developer.github.com/apps/differences-between-apps/ [2] https://docs.do…

I just looked at github OAuth scopes ( https://developer.github.com/apps/building-oauth-apps/unders... ) honest question, what's the point of using OAuth when the Authz is so coarse? Why not augment to have scopes per repo? Is it considered bad practice to have have a variable (repo name) as a scope?

IIRC the OAuth2-interfacing application needs to (or at least should) know beforehand exactly what to request access to, so if that's read/write access to all of the user's content, it's trivial. For the external application to know something specific like a particular resource is more complicated to deal with (especially with private/hidden content), so most OAuth providers don't provide that level of granularity. It can be done, it just requires more engineering than most (all?) off-the-shelf OAuth solutions provide, and it's more control than most users actually need.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#208

Post by quickthrower2 »

leowoo91 wrote: post #96
craftoman wrote: post #20

Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boycotted. Last time one user got hacked and they blamed NPM for letting it happened. Everyone went crazy...

NPM already freaks out many people.

I secretly love NPM. If your open source project’s first code section is “npm i ...” I’m happy.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#210

Post by AsyncAwait »

craftoman wrote: post #163
tomc1985 wrote: post #145

Earlier quoted context omitted.

Most distributions' package repos aren't a free-for-all, unlike NPM It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely different kettle of fish, and most of the mainstream distros take security pretty seriously

Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.

Not sure about apt, but this is solvable. Arch's pacman supports https and package signing and only packages signed by trusted maintainers will get installed. That means it should be fairly difficult to swap legit packages for malicious ones and them getting installed.

Not impossible, nothing ever is, but fairly difficult.

Post reply on HN