Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github seems to be experiencing security issues

github.com

Post reply on HN
Print view View original

41–50 of 59 posts

Re: Github seems to be experiencing security issues

#41

Post by cscheid »

m4tthumphrey wrote: post #40
phpnode wrote: post #39

Earlier quoted context omitted.

no, they definitely shouldn't, for the same reason they don't store the real passwords in plain text. it would be a terrible security hole.

Sorry for being ignorant, but why is providing the passwords they guess/automate a security issue?

For one, because if someone does find a hole that gives them access to Github data, they'll have all password attempts, which would include typos of the real password. Which is a terrible, terrible thing to store in a hard drive (see Adobe)

Re: Github seems to be experiencing security issues

#42

Post by csmuk »

bergie wrote: post #33
wgx wrote: post #13

The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts. As anyone who's put an EC2 up without secu…

I wonder if this is related to the recent Adobe and vBulletin user database breaches. They might be trying those passwords on GH.

Very likely.

We've just added a kill-list of known decrypted passwords and English language words and forced people to reset their passwords who are listed in the adobe breach.

Re: Github seems to be experiencing security issues

#43

Post by asdfaoeu »

aram wrote: post #5

Very strange; I just checked my security history and see that there have been 5 unsuccessful login attempts from China/Venezuela to my account (last 14 hours). Everything before that is pretty clean and without fake logins. Does anyone have more information on this?

Maybe they've just enabled reporting for failed logins?

If nothing else it would encourage people to care more about their security.

Re: Github seems to be experiencing security issues

#44

Post by asdfaoeu »

wgx wrote: post #13

The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts. As anyone who's put an EC2 up without secu…

Seems more like its just background noise and they've just enabled reporting of it. I don't really see the problem everyone should have secure passwords anyway or two factor. If some random botnet can guess your password after < 50 guesses your doing something wrong.

Re: Github seems to be experiencing security issues

#45

Post by envygeeks »

alexchamberlain wrote: post #35

If anyone from GitHub is reading, it would be cool if the failed IP addresses had an approximate location appended to them.

That's only useful if they plan to use location algorithms like banks to detect possible fraud login's. For example banks do basic location tracking to detect fraud, if you mostly shop in New York in a specific area and they suddenly detect a purchase in Canada your bank should block it, I know my bank does and they'll call me within 20 minutes to confirm it was me (enough time for me to call them and authorize it or if I switch to another card, quick enough for me to tell them I'm in Canada for the week.)

Re: Github seems to be experiencing security issues

#46

Post by luisivan »

aram wrote: post #5

Very strange; I just checked my security history and see that there have been 5 unsuccessful login attempts from China/Venezuela to my account (last 14 hours). Everything before that is pretty clean and without fake logins. Does anyone have more information on this?

Same here, 5 failed login attempts from Venezuela

Re: Github seems to be experiencing security issues

#47

Post by nadaviv »

bergie wrote: post #33
wgx wrote: post #13

The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts. As anyone who's put an EC2 up without secu…

I wonder if this is related to the recent Adobe and vBulletin user database breaches. They might be trying those passwords on GH.

I didn't have an account on either of those websites, but still had 5 failed login attempts.

Re: Github seems to be experiencing security issues

#48

Post by Sanddancer »

m4tthumphrey wrote: post #37

They should provide the password used to attempt to log in too.

That's a security risk in and of itself. Suppose someone has an account named 'bobs'. For whatever reason, they don't notice that they mistyped and put in 'bob' instead. They try a couple times with their correct password, and now the 'bob' user has in their logs someone else's valid password. Said user could then set up very minimal bits of automation to discover, and break in, to that account.

Re: Github seems to be experiencing security issues

#50

Post by pja »

awjr wrote: post #29
awjr wrote: post #25

I would strongly suggest people enable two factor authentication: https://github.com/settings/two_factor_authentication/config...

Just one foot note (as I have just taken my own advice and turned it on). Suddenly I couldn't push/pull through the git command line access as it would not accept my password. Took me a bit to work it out but you need to go here https://github.com/settings/applications and create personal access tokens.

If you need to store a personal access token in order to pull or push to your own repos, how is two-factor auth any better than a normal account with a secure (ie reasonably long, unique, randomly generated) password?
Post reply on HN