431–440 of 606 posts
Earlier quoted context omitted.
uber engineer here, we have 2fa set up for everything. Starting my day takes about 5 different 2fa checks (ssh access, aws, phabricator, team chat, etc)
That sounds really inefficient
Yep. About that time my Uber account was 'hacked' and someone kept requesting rides in Florida and I had to cancel them as fast as they made them. I emailed Uber support and they got back to my 3 days later. Then someone proceeded to try to gain access to every account I had with that email and password (yeah, yeah, I know). The next worse was someone getting into my DigitalOcean account and launching an instance. It…
Earlier quoted context omitted.
> use their personal phones seems like a very bad solution Why? You're not any less secure by using a personal phone. What are the odds that an employee is going to be phished and have their phone compromised by the same entity.
IANAL, but here is my thinking: The problem with personal phones is they are hard to audit. When a phone belongs to the corp, corp owns the phone, and "probably" can audit it as it wished.
Earlier quoted context omitted.
I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of moti…
You're in charge of security at a large e-commerce company, and your view is that your company is bound to get hacked? I think that's a very sad commentary on how little your company values security.
If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems.
Otherwise, you'll be like a former coworker that refused to secure internal systems because "We paid a lot of money for our firewall, it's going to block any hackers". It took me less than 30 minutes on my first day to hack the login passwords of senior executives because they logged into a non-SSL reporting server (and I did through a simple MAC overflow attack on a network switch from a network port in the break room)
> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?
Earlier quoted context omitted.
Let me quote from your original comment: > people don't actually care. It's just virtue signaling. You're making claims about their underlying motivation, and dismissing their actions as just virtue signaling. "They're not doing A, they're only doing B" Showing the presence of B is not sufficient to demonstrate the absence of A. Second, you haven't actually shown that they're virtue signaling. Note that your definiti…
Hmmm, lots of good points here. > You're making claims about their underlying motivation, and dismissing their actions as just virtue signaling. This is true. > Showing the presence of B is not sufficient to demonstrate the absence of A. This is also true. > Second, you haven't actually shown that they're virtue signaling. Note that your definition specifically includes intent: "publicly expressing opinions or sentim…
Your profile says "Contact me" but there's no contact info.
(It also says: “if you're going to claim something, please cite!” :) )
Why was this only worth 100K? How did they verify info was deleted? And how does this show up on an expense report at the end of the year?
Gotta be careful dealing with company like Uber. At some price point they might just hire hitmen to kill you instead.
> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
Dumb question: What's the best practice to share authentication credentials across the team for services that don't have an IAM feature?
Sometimes I just go on google hangouts and share my screen if I'm feeling lazy.
Man, I don't know if Uber is evil or if most tech companies are evil and Uber just doesn't drop the kind of money on PR strategery that an evil company need to drop in order to seem normal. But either way, holy cow does that company come off as toxic. They've completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work enviro…
Earlier quoted context omitted.
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...
that doesn't protect you from GitHub employees snooping around.