Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MongoDB security notice

mongodb.com

Post reply on HN
Print view View original

41–50 of 198 posts

Re: MongoDB security notice

#41

Post by webappguy »

insanitybit wrote: post #8

Nice and to the point, makes it clear that this is early, explains the current scope, tells us to expect a follow up as the information makes its way to them. I like this tbh and I hope people won't punish them for not including more info when this is clearly in the early days of investigation.

It was only DETECTED on the 13th, and they suspect had been going on 'for some time'. And basically not sure if user data was touched but they suspect or haven't provided it yet buly saying'NOT'.

I want answers.

Re: MongoDB security notice

#44

Post by webappguy »

salil999 wrote: post #42
goenning wrote: post #38

I never used/tried MongoDB, what are the reasons people choose MongoDB over other DBs?

It's pretty easy to start with. MQL is also pretty easy to understand + MongoDB kinda makes it fun. Note: I work at MongoDB

What's the update internally here? How long this been going on for? Any juice?

Re: MongoDB security notice

#45

Post by iaresee »

ThePowerOfFuet wrote: post #30
iaresee wrote: post #20

Earlier quoted context omitted.

On our side, Okta is saying the auth is good. I'm trying my personal account as well and it's telling me MFA isn't set up (it is) and it's making me go through the MFA setup flow again. All attempts to setup another 2FA code in 1Password or to get even an SMS code sent to my phone are failing. Edit: Personal account with a TOTP 2FA is working again now as well. This is feeling worse than they're letting on to.

You really should not be using SMS for 2FA.

You really aren't following along closely enough: all other options were failing for me.

Re: MongoDB security notice

#48

Post by Nextgrid »

forwardemail wrote: post #21
dnndev wrote: post #7

Earlier quoted context omitted.

What’s wrong with licensing?

Encryption at rest is not supported in the community/free version of MongoDB. We built an email service (IMAP support added a month ago) and wrote a WebSocket to SQLite layer to solve our encryption at rest needs for storage. See our deep dive at https://forwardemail.net/blog/docs/best-quantum-safe-encrypt... for insight.

I wonder, why would you want DB-managed encryption instead of just putting its storage directory in a LUKS-encrypted volume?

Re: MongoDB security notice

#49

Post by speedgoose »

iaresee wrote: post #45
ThePowerOfFuet wrote: post #30

Earlier quoted context omitted.

You really should not be using SMS for 2FA.

You really aren't following along closely enough: all other options were failing for me.

But you have setup SMS 2FA enabled, which is convenient this time but a big security hole. You should consider disabling it once the situation comes back to normal.

Re: MongoDB security notice

#50

Post by salil999 »

ThePowerOfFuet wrote: post #30
iaresee wrote: post #20

Earlier quoted context omitted.

On our side, Okta is saying the auth is good. I'm trying my personal account as well and it's telling me MFA isn't set up (it is) and it's making me go through the MFA setup flow again. All attempts to setup another 2FA code in 1Password or to get even an SMS code sent to my phone are failing. Edit: Personal account with a TOTP 2FA is working again now as well. This is feeling worse than they're letting on to.

You really should not be using SMS for 2FA.

For my own knowledge, if the options were between using SMS for 2FA or not having 2FA at all then what is better? I've heard mixed things about this.
Post reply on HN