Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet Archive breached again through stolen access tokens

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 376 posts

Re: Internet Archive breached again through stolen access tokens

#41

Post by compootr »

chrisrhoden wrote: post #36
galleywest200 wrote: post #14

Earlier quoted context omitted.

>"It's dispiriting to see that even after being made aware of the breach weeks ago..." These people are not dispirited whatsoever, if anything they are half-cocked that these script kiddies found an easy target.

The words came from a message written by the people you are calling script kiddies, rather than being editorializing by bleepingcomputer, as you seem to believe.

script kiddie or blackhat hacker is irrelevant. IA has shit security practices, and that's a fact regardless of who figures that out

Re: Internet Archive breached again through stolen access tokens

#42

Post by sksxihve »

riiii wrote: post #27
sksxihve wrote: post #22

Earlier quoted context omitted.

There's no real financial incentive for people to archive the data as a singular entity so even less for a distributed collection. Also it's probably easier to fund a single entity sufficiently so they can have security/code audits than a bunch of entities all trying to work together.

Some people are motivated by more than just financial incentive.

That's true, but something like archiving the internet is very costly, IA has an annual budget in the tens of millions.

Re: Internet Archive breached again through stolen access tokens

#43

Post by ghostly_s »

TheFreim wrote: post #4

> "It's dispiriting to see that even after being made aware of the breach weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets," reads an email from the threat actor. This is quite embarrassing. One of the first things you do when breached at this level is to rotate your keys. I seriously hope that they make some systemic changes, it seems that…

IA is in bad need of a leadership change. The content of the archive is immensely valuable (largely thanks to volunteers) but the decisions and priorities of the org have been far off base for years.

Re: Internet Archive breached again through stolen access tokens

#44

Post by [deleted] »

db48x wrote: post #29
thaumasiotes wrote: post #16

Earlier quoted context omitted.

That's a terrible solution. The Wayback Machine takes down their snapshots at the request of whoever controls the domain. That's not archival. If the state of a webpage in the past matters to you, you need a record that won't cease to exist when your opposition asks it to. This is the concept behind perma.cc.

No, they don’t delete the archived content. When the domain’s robots.txt file bans spidering, then the Wayback Machine _hides_ the content archived at that domain. It is still stored and maintained, but it isn’t distributed via the website. The content will be unhidden if the robots.txt file stops banning spiders, or if an appropriate request is made.

[deleted]

Re: Internet Archive breached again through stolen access tokens

#45

Post by Raed667 »

db48x wrote: post #29
thaumasiotes wrote: post #16

Earlier quoted context omitted.

That's a terrible solution. The Wayback Machine takes down their snapshots at the request of whoever controls the domain. That's not archival. If the state of a webpage in the past matters to you, you need a record that won't cease to exist when your opposition asks it to. This is the concept behind perma.cc.

No, they don’t delete the archived content. When the domain’s robots.txt file bans spidering, then the Wayback Machine _hides_ the content archived at that domain. It is still stored and maintained, but it isn’t distributed via the website. The content will be unhidden if the robots.txt file stops banning spiders, or if an appropriate request is made.

They do delete entire domains from the archive upon request & proof of ownership.

Re: Internet Archive breached again through stolen access tokens

#46

Post by echelon »

ghostly_s wrote: post #43
TheFreim wrote: post #4

> "It's dispiriting to see that even after being made aware of the breach weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets," reads an email from the threat actor. This is quite embarrassing. One of the first things you do when breached at this level is to rotate your keys. I seriously hope that they make some systemic changes, it seems that…

IA is in bad need of a leadership change. The content of the archive is immensely valuable (largely thanks to volunteers) but the decisions and priorities of the org have been far off base for years.

I support archival of films, books, and music, but those items need to be write-only until copyright expires. The purpose of the Internet Archive is to achieve a wide-reaching, comprehensive archival, not provide easy and free read access to commercial works.

Website caches can be handled differently, but bulk collection of commercial works can't have this same public access treatment. It's crazy to think this wouldn't be a huge liability.

Battling for copyright changes is valiant, but orthogonal. And the IA by trying to do both puts its main charter--archival--at risk.

The IA should let some other entity fight for copyright changes.

I say this as an IA proponent and donor.

Re: Internet Archive breached again through stolen access tokens

#48

Post by abadpoli »

Spivak wrote: post #30
semicolon_storm wrote: post #11

Earlier quoted context omitted.

In security, industry standard seems to be about the same as military grade: the cheapest possible option that still checks all the boxes for SOC.

Hot take, this is the way it should be. If you want better security then you update the requirements to get your certification. Security by its very nature has a problem of knowing when to stop. There's always better security for an ever increasing amount of money and companies don't sign off on budgets of infinity dollars and projects of indefinite length. If you want security at all you have bound the cost and have…

There never will be an adequate industry-wide certification. There is no universal “good enough” or “when to stop” for security. What constitutes “good enough” is entirely dependent on what you are protecting and who you are protecting it from, which changes from system to system and changes from day to day.

The budget that it takes to protect against a script kiddy is a tiny fraction of the budget it takes to protect from a professional hacker group, which is a fraction of what it takes to protect from nation state-funded trolls. You can correctly decide that your security is “good enough” one day, but all it takes is a single random news story or internet comment to put a target on your back from someone more powerful, and suddenly that “good enough” isn’t good enough anymore.

The Internet Archive might have been making the correct decision all this time to invest in things that further its mission rather than burning extra money on security, and it seems their security for a long time was “good enough”… until it wasn’t.

Re: Internet Archive breached again through stolen access tokens

#49

Post by withinboredom »

echelon wrote: post #46
ghostly_s wrote: post #43

Earlier quoted context omitted.

IA is in bad need of a leadership change. The content of the archive is immensely valuable (largely thanks to volunteers) but the decisions and priorities of the org have been far off base for years.

I support archival of films, books, and music, but those items need to be write-only until copyright expires. The purpose of the Internet Archive is to achieve a wide-reaching, comprehensive archival, not provide easy and free read access to commercial works. Website caches can be handled differently, but bulk collection of commercial works can't have this same public access treatment. It's crazy to think this wouldn…

I'd agree with you if you live in a country where you can walk into your local library and read these for "free." For people who live where there may not even be a library, your argument makes no sense except to make the publishers richer. They typically price some of these books at "library prices" so normal people won't be able to afford them, but libraries will.

Re: Internet Archive breached again through stolen access tokens

#50

Post by trompetenaccoun »

oytis wrote: post #15
trompetenaccoun wrote: post #5

We need archives built on decentralized storage. Don't get me wrong, I really like and support the work Internet Archive is doing, but preserving history is too important to entrust it solely to singular entities, which means singular points of failure.

We'll need to find even more people willing to expose themselves to legal threats and cyberattacks then.

The legal side is a big issue, true. The simplest and best workaround that I'm aware of is how the Arweave network handles it. They leave it up to the individual what parts of the data they want to host, but they're financially incentivized to take on rare data that others aren't hosting, because the rarer it is the more they get rewarded. Since it's decentralized and globally distributed, if something is risky to host in one jurisdiction, people in another can take that job and vice versa. The data also can not be altered after it's uploaded, and that's verifiable through hashes and sampling. Main downside in its current form is that decentralized storage isn't as fast as having central servers. And the experience can vary of course, depending on the host you connect to.

As for technical attacks, I'm not an expert but I'd assume it's more difficult for bad actors to bring down decentralized networks. Has the BitTorrent network ever gone offline because it was hacked for example? That seems like it would be extremely hard to do, not even the movie industry managed to take them down.

Post reply on HN