[deleted]
Gigabytes of user data from hack of Patreon donations site dumped online
51–60 of 151 posts
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#52Earlier quoted context omitted.
How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?
You can't :) There is a huge Market for Lemons ( https://en.wikipedia.org/wiki/The_Market_for_Lemons ) style scenario in IT systems with relation to security. Everyone will say "we take security seriously", but there's no way for ordinary consumers (or indeed most companies) to determine what the company meant by their statement, and to evaluate the relative security of the systems of two companies. This could actual…
I don't think it's actually that bad; for example, Patreon said that they don't store CCs and that they correctly hashed passwords, and as a consumer myself, I did take that into account. Obviously less knowledgeable consumers don't know what "bcrypt" is, but that's true of any product - you can't judge what you don't know how to judge.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#53There is a lot we can do as programmers to make data leaks of that scope a lot harder to pull off. I think web apps of a certain magnitude should not be talking directly to the database, they should be talking to their internal data API that resides on a different server. The reason for this is that a completely separate data layer is easier to lock down, and also way easier to monitor for unusual activity. Ideally,…
If the frontend layer needs to access the data anyway, how does that separation help? And why is it easier to monitor for unusual activity?
> If the frontend layer needs to access the data anyway, how does that separation help?
It helps in multiple ways. Since you define the data API yourself, you can tailor it tightly to only the exact operations you need. This makes it more difficult to flat-out drain everything (or even query everything, depending on your app). It's also another layer of insulation. The fact that it's another, non-standard access protocol also helps. If I'm an attacker, I'll probably have a harder time figuring out how the custom data layer works; and when I'm done with that I still need to actually siphon the data, which will ideally require me to either issue millions of suspicious requests, or try to break into the API server itself, which has a drastically reduced attack surface compared to a typical web app. Which is where your second question comes in:
> And why is it easier to monitor for unusual activity?
Because you know what the legitimate access patterns of your app look like, you can raise flags programmatically. In fact, you can incorporate certain checks right from the time you start writing your API. It puts you, as a programmer, into a position of control and you can use the global insight you have into your app's design to your advantage by defining what's normal and what's not.
Compare that with a general-purpose DB interface, which is ...well, general purpose. It doesn't know when it's doing something implausible. When something goes wrong with these databases, it's often the admin/ops people who notice it, if at all.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#54The centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?
People just won't sign up to a new service for each creator they come across it's that simple.
I wish Mozilla Persona or a similar privacy-protecting feature would succeed.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#55The centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?
So content creators should use PayPal then for donations? That's also a centralized service. How do you propose a transaction takes place without a service to process the details?
Simple standard bank transaction? If you want to support the creator regularly, you can easily set that up as well.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#56That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.
How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?
This is what things like PCI compliance are for. Admittedly PCI is a crappy ticklist, but it enables you to distinguish between organisations that at least try to check the boxes and those that don't.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#57Earlier quoted context omitted.
You can't :) There is a huge Market for Lemons ( https://en.wikipedia.org/wiki/The_Market_for_Lemons ) style scenario in IT systems with relation to security. Everyone will say "we take security seriously", but there's no way for ordinary consumers (or indeed most companies) to determine what the company meant by their statement, and to evaluate the relative security of the systems of two companies. This could actual…
I don't think it's actually that bad; for example, Patreon said that they don't store CCs and that they correctly hashed passwords, and as a consumer myself, I did take that into account. Obviously less knowledgeable consumers don't know what "bcrypt" is, but that's true of any product - you can't judge what you don't know how to judge.
so with two patreon style sites both of which say "we take security seriously" , until they have a breach, how would you judge which one would take better care of your data?
The information (AFAIK) about their security mechanisms only got released as a result of the breach, so even assuming you knew what the terms were and how to judge good security from bad, you wouldn't have the information until the site got compromised.
This is a very common problem, some more examples here http://raesene.github.io/blog/2014/06/08/finding-security/
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#58Earlier quoted context omitted.
So content creators should use PayPal then for donations? That's also a centralized service. How do you propose a transaction takes place without a service to process the details?
Simple standard bank transaction? If you want to support the creator regularly, you can easily set that up as well.
Bank transactions are anything but simple to set up in some places, and can also be very expensive to set up when you're talking about international transfers of money. Thankfully there are things like IBANs and BICs, but that doesn't help when a bank wants to charge you something like 5x the value of the transfer (when the transfer is a low value, like 5/month).
Credit card processing already handles the whole international transfer cost, and puts the burden on the processor instead of the payer. That processor can then do things like batch transactions to reduce the cost.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#59That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.
Fines? It would do more damage than good(if there's any good that is). One of the best things about the information age is the ability for anyone to take part in it. You could be selling glow sticks to a guy a thousand miles away from you.
If there were fines, it would scare away people with less technical skills who would want to start something new.
What we must do is introduce certifications, this would help make companies more security aware, but wont make it mandatory.
Re: Gigabytes of user data from hack of Patreon donations site dumped online
#60That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.
>massive fines so they actually "take security very seriously"
The bad publicity around such a hack can very much turn a company belly up. Massive fines will not alter the incentive structure significantly, they already know a hack is a bad thing.
On the other hand, there are plenty of interventions that would change the security incentives. For example, decriminalize white hat hacking to allow access to any internet connected system, as long as the vulnerability is reported within 7 days to the relevant bodies and no data is duplicated/altered. Heck, award prizes for it.