Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode Manager Two-Step Authentication

blog.linode.com

Post reply on HN
Print view View original

31–40 of 87 posts

Re: Linode Manager Two-Step Authentication

#31

Post by sendob »

astrodust wrote: post #27
bndr wrote: post #23

Earlier quoted context omitted.

They admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.

It was also made clear that the encryption key was protected by a passphrase which was not stored on the machine.

"which was not stored on the machine", like they should be commended ( Reminds me of exams where you received some credit for including your name... ).

I am sorry, them confirming this fact, and even if I recall adding a smiley in the tweet they did it, just cemented that they do not understand their business.

They clearly wish to give the impression that they are "secure". They need more lock icons...they are almost as effective as the racing stickers on my car!

Re: Linode Manager Two-Step Authentication

#32

Post by oinksoft »

Not everybody owns or wants a smartphone. Linode needs to extend this to some non-smartphone device, like YubiKey, or offer SMS codes, like Google Authenticator. This is a step in the right direction, but is ultimately disappointing for me.

Re: Linode Manager Two-Step Authentication

#33

Post by singlow »

dllthomas wrote: post #30
threeseed wrote: post #7

After being bitten the first time with Linode I don't care what technical measures they are taking. I want to know what process and policy changes have been made. Do they still store public/private keys on the same server ? How often are they doing security audits (which clearly never happened before) ? Are they still going to be dodgy and withhold key information from their users ? Are users still going to find out…

"Do they still store public/private keys on the same server?" As phrased, this is not a problem - there's never any worry to including your public key wherever you have your private key; your attacker can be assumed to have your public key anyway if it'll do them any good. The problem was private keys (encrypting important things!) on a web-accessible server, was my understanding.

Well - it is not likely you will need you public key on the non-web-accessible server. In this type of application the public key is needed in the place that encryption happens and the private key is needed where decryption happens. If the two are on the same machine it likely means you messed up.

Re: Linode Manager Two-Step Authentication

#34

Post by johansch »

oinksoft wrote: post #32

Not everybody owns or wants a smartphone. Linode needs to extend this to some non-smartphone device, like YubiKey, or offer SMS codes, like Google Authenticator. This is a step in the right direction, but is ultimately disappointing for me.

How many of linode's subscribers do you think not own a smartphone? I mean, outside of your enclave?

Re: Linode Manager Two-Step Authentication

#35

Post by madsushi »

oinksoft wrote: post #32

Not everybody owns or wants a smartphone. Linode needs to extend this to some non-smartphone device, like YubiKey, or offer SMS codes, like Google Authenticator. This is a step in the right direction, but is ultimately disappointing for me.

I have to imagine the overlap between Linode customers and smart phone owners was so large (and the cost of implementation so low) that leaving out hardware authenticators makes sense for v1.

Re: Linode Manager Two-Step Authentication

#36

Post by dllthomas »

peddamat wrote: post #29
astrodust wrote: post #26

Earlier quoted context omitted.

Pick two of those and you have options.

I'm happy with "established VPS provider", and "a track-record of excellent security practices". After posting, I realized 1 and 3 are a bit redundant. You have to be established to have a track-record, of course.

Weeeellllll, maybe they established a track record of excellent security practice in a related field and are just getting into providing VPSs?

But yes, really, somewhat redundant...

Re: Linode Manager Two-Step Authentication

#38

Post by dllthomas »

singlow wrote: post #33
dllthomas wrote: post #30

Earlier quoted context omitted.

"Do they still store public/private keys on the same server?" As phrased, this is not a problem - there's never any worry to including your public key wherever you have your private key; your attacker can be assumed to have your public key anyway if it'll do them any good. The problem was private keys (encrypting important things!) on a web-accessible server, was my understanding.

Well - it is not likely you will need you public key on the non-web-accessible server. In this type of application the public key is needed in the place that encryption happens and the private key is needed where decryption happens. If the two are on the same machine it likely means you messed up.

Or it means you didn't bother to delete the public key (since, hey, free backup at the cost of not typing rm) when you generated the keypair.

Re: Linode Manager Two-Step Authentication

#39

Post by rdl »

oinksoft wrote: post #32

Not everybody owns or wants a smartphone. Linode needs to extend this to some non-smartphone device, like YubiKey, or offer SMS codes, like Google Authenticator. This is a step in the right direction, but is ultimately disappointing for me.

TOTP works fine with physical tokens. e.g. http://onlinenoram.gemalto.com/

All they need to do is let users locally generate (i.e. in the token) seeds and then enter those into the web portal, vs. generating seeds internal to the portal, displaying them, and having the user enter them into the authenticator app or token (because the tokens don't allow you to enter a seed).

Post reply on HN