Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

451–460 of 648 posts

Re: Internet Archive: Security breach alert

#451

Earlier quoted context omitted.

> This raises an interesting question: should email addresses be private? I sadly don't think that's viable. What might be, in our current world, would be having a mail server/client setup where you can generate random addresses for yourself like Wf1JJUBHLu@domain.com and never re-use an e-mail address, much like with passwords, while being able to see all of the incoming mail in the same place and respond with the c…

Yes, but privacy suffers with this approach, because if one of emails ending in @domain.com is tied to your identity, all are.

This is true for someone manually searching for your info, but sufficient to fool spam lists and most data brokers. This really depends on your threat scenario.

Re: Internet Archive: Security breach alert

#452
post #437

What kind of asshole attacks the Internet Archive of all places on the web??

Pro-palestine activists: https://x.com/Sn_darkmeta/status/1844080692772401399 & https://x.com/Sn_darkmeta/status/1844104165192253945

Both tweets have received a community note disproving this.

Re: Internet Archive: Security breach alert

#453

Earlier quoted context omitted.

It's quite trivial. 1. Buy a domain. About $10/year for a .com 2. Buy a /24 ipv4 block with good reputation (maybe like $10k) 3. Get a rack in a nearby datacenter, rack up a BGP-capable router and your servers for redundancy to run email. Takes about $30k initial setup costs if you buy all new, and about $5k initial setup costs if you cut corners and buy used. It'll be $2k/mo after that, so less than the cost of 1 $1…

Hold on. Why do you need a dc rackspace and a /24 just to have your email ?

Satire

Re: Internet Archive: Security breach alert

#454
post #437

What kind of asshole attacks the Internet Archive of all places on the web??

Pro-palestine activists: https://x.com/Sn_darkmeta/status/1844080692772401399 & https://x.com/Sn_darkmeta/status/1844104165192253945

...or someone attempting to blame palestinian activists. This smells a lot more like someone trying to ape activist language.

Re: Internet Archive: Security breach alert

#455
post #194
post #140

A few minutes ago (22:48 UTC), I got three emails from HIBP about accounts of mine breached on the Internet Archive. Troy is quick! And I'm surprised the author of that alert() actually had the data as well as followed through Bit of a shame the emails contain an ad for a password manager, saying there's two easy steps to become more secure: Step 1: use our password manager (fair enough), "Step 2: Enable 2 factor aut…

I think it is safer to have 2FA in your password manager than not using 2FA at all. Because even if they got your password, if they don't have access to your password manager they can't login. If you protect your password manager with a yubikey or any other hardware key, then your 2FA inside your password manager is quite secure and convenient. But this is very individual, what your threat model is and how secure you…

See also the considerations mentioned in the sibling thread btw: https://news.ycombinator.com/item?id=41793846

> even if they got your password, if they don't have access to your password manager they can't login.

Wouldn't the same argument go for a non-2fa password? What's the difference between a randomly generated 2fa secret and a randomly generated password here?

Re: Internet Archive: Security breach alert

#457

Earlier quoted context omitted.

Pro-palestine activists: https://x.com/Sn_darkmeta/status/1844080692772401399 & https://x.com/Sn_darkmeta/status/1844104165192253945

Both tweets have received a community note disproving this.

The note currently displayed to my account disputes the claims made in the linked tweet (that the Internet Archive is run by the US government(???)), not the supposed motivation of the attackers.

That said, this just seems to me like the attackers are trying to come up with some justification after the fact to explain why they would go after something as universally beloved as the Internet Archive. Actual pro-Palestine activists are not happy, eg (strong language): https://x.com/Aldanmarki/status/1844155616199413969

Re: Internet Archive: Security breach alert

#458

Earlier quoted context omitted.

Pro-palestine activists: https://x.com/Sn_darkmeta/status/1844080692772401399 & https://x.com/Sn_darkmeta/status/1844104165192253945

Both tweets have received a community note disproving this.

The current community notes I see on these tweets just basically say: the Internet Archive is not part of the US government.

Re: Internet Archive: Security breach alert

#459

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

> This raises an interesting question: should email addresses be private?

Yes and no. Both of them. As any powerful tool, email is going to be abused, like any other alternative would be when it will come one day. Those services allowing creation of dynamic email addresses do their job (until they're banned, that's why I'm not mentioning them), however using them isn't automatic and most people don't even know about their existence. What if we then did upgrade email protocols to reflect current needs wrt privacy and modified existing mail servers so that they could create dynamic addresses when asked by a simple flag? Example: I want to subscribe to a service from company XYZ, however I'm not sure how much I can trust them, therefore, when writing an email or filling a web form I can activate the option to create a new address that is tied to the recipient I'll be writing to, and will work as a dedicated proxy for my real address, that is, every mail I send to the recipient using my real address will be actually sent from the new dynamic address, then all replies to the dynamic address will be routed to my real one, but a field in its headers will always contain either a memo by me (example: "signup with XYZ") or the original recipient (example: "info@xyz_trustuswerenotspammers_yeahsure.com"). This way one can immediately spot whoever sold their address to others and blacklist them. As said, those services work well but not being built in into mail servers and clients their adoption is quite restricted. I don't see why that function shouldn't be embedded in a new upgraded email protocol as the modification would neither be that hard nor consume any serious resource. I would however expect heavy resistance against the adoption, of course.

Post reply on HN