51–60 of 130 posts
[flagged]
Per HN guidelines, emphasis mine: "Please don't complain about tangential annoyances—e.g. article or website formats, name collisions , or back-button breakage. They're too common to be interesting." https://news.ycombinator.com/newsguidelines.html
LOL https://twitter.com/Ledger/status/1735326240658100414 FINAL TIMELINE AND UPDATE TO CUSTOMERS: 4:49pm CET: Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. The investigation continues, here is the timeline of what we know about the exploit at this moment: - This morning CET, a former Ledger Employee fell victim t…
> "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account." Ouch. A _former_ employee had active credentials to phish for. > "@Tether_to has frozen the bad actor’s USDT." Wasn't like, >30% of the point of crypto to not allow people to do this sort of high-level/centralized freezing?
The blacklists need to exist as per regulations though.
Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…
I’ve switched to a Coldcard. Everything from purchase to the device operation seems to be highly focused on security and protections against tampering. No client software… it’s all sneakernet. Coinkite even deleted my customer data a few weeks after purchase without me having to request.
I still have my ledger. I think it is a nice device but when I tried to repurpose it as an yubikey of sorts (it has fido and gpg micro apps) it didn’t actually worked alright. I never trusted ledger live though.
NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?
2FA only protects login. Pretty much all account security from that point on is based on portable bearer tokens.
NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?
2FA only protects login. Pretty much all account security from that point on is based on portable bearer tokens.
> To protect your packages, as a package publisher, you can require everyone who has write access to a package to have two-factor authentication (2FA) enabled. This will require that users provide 2FA credentials in addition to their login token when they publish the package.
> Require two-factor authentication and disallow tokens: With this option, a maintainer must have two-factor authentication enabled for their account, and they must publish interactively. Maintainers will be required to enter 2FA credentials when they perform the publish. Automation tokens and granular access tokens cannot be used to publish packages.
https://docs.npmjs.com/requiring-2fa-for-package-publishing-...
LOL https://twitter.com/Ledger/status/1735326240658100414 FINAL TIMELINE AND UPDATE TO CUSTOMERS: 4:49pm CET: Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. The investigation continues, here is the timeline of what we know about the exploit at this moment: - This morning CET, a former Ledger Employee fell victim t…
> "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account." Ouch. A _former_ employee had active credentials to phish for. > "@Tether_to has frozen the bad actor’s USDT." Wasn't like, >30% of the point of crypto to not allow people to do this sort of high-level/centralized freezing?
Earlier quoted context omitted.
Source? Their twitter says "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account." And Github Actions automatically redacts the secret in the log
You are right, I should have waited for the postmortem.. it appeared the likely way because the secret was in the release pipeline env. However.. something doesn't add up. There is no chance that a malicious actor gained access and in a couple of hours put together this exploit. Or, I can't see someone putting together this exploit, THEN trying to spear-phish in hope of getting lucky and pressing the button.
When will npm finally take security seriously? How many incidents do they need? Don’t allow non hardware mfa and add verified namespaces already!