Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode Manager Two-Step Authentication

blog.linode.com

Post reply on HN
Print view View original

51–60 of 87 posts

Re: Linode Manager Two-Step Authentication

#51

Post by kyrra »

rdl wrote: post #43
peddamat wrote: post #21

Ok, so can anyone recommend an established VPS provider, with a comparable management interface, and a track-record of excellent security practices?

Amazon AWS has the best security of any virtual server provider I've seen, by miles. There might be specialty providers (e.g. FireHost) which are good dedicated server offerings, too, but I haven't evaluated them -- it usually is "AWS, is it good enough?" and then if no, directly to a cage, do not pass go, do not collect $50k. AWS also has the best first and second derivative on everything related to product; they we…

How about for those that just want a small instance system. I just do the smallest linode setup for some personal projects. From my understanding, AWS is expensive for that type of use case?

Re: Linode Manager Two-Step Authentication

#52

Post by hkmurakami »

threeseed wrote: post #45
fiatpandas wrote: post #22

Earlier quoted context omitted.

I also find it really troubling they haven't released a "Here's what we're doing different" blog post in response to the attack. Their only blog post on the matter came a week (2 weeks?) after the intrusion, which they were of course pressured to release after everyone found out via a pastebin IRC transcript... By chance I happened to sign up for my first Linode account the day before that hit HN. I hope their silenc…

Do they think their customers are stupid and will forget the incident? Yes. They have done it before and people on here still recommend them with a straight face. It honestly confuses me that people care so little about security.

I'm one of those people who have a slight interest in the security but don't know enough about it to be properly informed about my own decisions.

For people like me who basically can't make my own decisions properly, where should I switch to? Is DigitalOcean better in this regard?

Re: Linode Manager Two-Step Authentication

#53

Post by hkmurakami »

agwa wrote: post #49
nullrouted wrote: post #47

I left Linode after 5 years of being a customer because I can no longer trust them. I let the first issue slide as I thought they would learn and communicate better to their customer base but the second incident has shown they learned nothing. Security issues will happen with any provider it is all in how a provider communicates and remediates those issues. Linode has shown it will not communicate thoroughly and does…

Out of curiosity, who did you switch to? I would leave too (after being a customer for nearly 8 years) but I'm having trouble finding other providers which don't have their own set of issues.

I'd really like to know this as well. (and I'm writing this post instead of just upvoting to hopefully encourage the grandparent poster by showing him that more than one person would like to know of the alternatives out there for switching)

Re: Linode Manager Two-Step Authentication

#54

Post by rdl »

kyrra wrote: post #51
rdl wrote: post #43

Earlier quoted context omitted.

Amazon AWS has the best security of any virtual server provider I've seen, by miles. There might be specialty providers (e.g. FireHost) which are good dedicated server offerings, too, but I haven't evaluated them -- it usually is "AWS, is it good enough?" and then if no, directly to a cage, do not pass go, do not collect $50k. AWS also has the best first and second derivative on everything related to product; they we…

How about for those that just want a small instance system. I just do the smallest linode setup for some personal projects. From my understanding, AWS is expensive for that type of use case?

AWS Free Tier is...free.

I'd probably go with http://prgmr.com/xen/ for low end above that.

Re: Linode Manager Two-Step Authentication

#55

Post by nullrouted »

agwa wrote: post #49
nullrouted wrote: post #47

I left Linode after 5 years of being a customer because I can no longer trust them. I let the first issue slide as I thought they would learn and communicate better to their customer base but the second incident has shown they learned nothing. Security issues will happen with any provider it is all in how a provider communicates and remediates those issues. Linode has shown it will not communicate thoroughly and does…

Out of curiosity, who did you switch to? I would leave too (after being a customer for nearly 8 years) but I'm having trouble finding other providers which don't have their own set of issues.

I have been testing/working with a few different providers. The three I'm currently working with the most are Ramnode, Gigenet and DigitalOcean.

Ramnode's panel is SolusVM which isn't as good as Linode but their performance blows Linode out of the water. They have ipv4/ipv6, multiple locations (Atlanta and Seattle) and a good owner who seems very open/honest with customers. I expect we'll see feature enhancements as they grow bigger.

Gigenet Cloud has multiple locations (Chicago and Los Angeles), ipv4/ipv6, good performance, good custom panel and a company that has been around for a long time. They use a SAN for all their nodes. Overall one of the most underrated cloud providers out there. (Note: I got free credits for beta testing their cloud)

DigitalOcean has multiple locations (San Francisco, New York, Amsterdam), a decent custom panel (would like to see more statistics and it seems a good staff. They did have a security issues that they seemed very open about (https://www.digitalocean.com/blog_posts/resolved-lvm-data-is...)

Other hosts I have tested/used but did not choose:

Rackspace - Excellent panel, ho-hum support/performance. My biggest issue is they lock instance throughput and refuse to change that. If you have a 512 instance you are locked to 20 mbit which doesn't make sense as you are billed per GB. I asked to have this unlocked as my instances push more and they refused.

Amazon AWS - Great interface but the lack of ipv6 (unless you buy ELB) and poor performance had me look elsewhere.

Others tested/used:

Joyentcloud, Terremark, Zerigo (Was a long time customer but they went downhill when 8x8 bought them), Voxcloud, Cloudsigma , Azure, HP Cloud, Stormondemand (Another good cloud provider that just didn't fit with me), VPS.net, Gandi

Re: Linode Manager Two-Step Authentication

#56

Post by jaxbot »

kyrra wrote: post #51
rdl wrote: post #43

Earlier quoted context omitted.

Amazon AWS has the best security of any virtual server provider I've seen, by miles. There might be specialty providers (e.g. FireHost) which are good dedicated server offerings, too, but I haven't evaluated them -- it usually is "AWS, is it good enough?" and then if no, directly to a cage, do not pass go, do not collect $50k. AWS also has the best first and second derivative on everything related to product; they we…

How about for those that just want a small instance system. I just do the smallest linode setup for some personal projects. From my understanding, AWS is expensive for that type of use case?

I second that question, and expand it a little. AWS is likely a more secure and trustworthy option given the recent controversy, but it really is comparing apples to oranges; they're both hosting solutions (fruit), but fundamentally very different.

Is there any service close to Linode that provides a similar service for a similar price? I know of DigitalOcean, but their CPUs are very underpowered in each plan compared to Linode's (especially after recent upgrades).

Re: Linode Manager Two-Step Authentication

#57

Post by nullrouted »

hkmurakami wrote: post #53
agwa wrote: post #49

Earlier quoted context omitted.

Out of curiosity, who did you switch to? I would leave too (after being a customer for nearly 8 years) but I'm having trouble finding other providers which don't have their own set of issues.

I'd really like to know this as well. (and I'm writing this post instead of just upvoting to hopefully encourage the grandparent poster by showing him that more than one person would like to know of the alternatives out there for switching)

Please see my reply above.

Re: Linode Manager Two-Step Authentication

#58

Post by jis »

rdl wrote: post #6
luser001 wrote: post #4

I was hoping for Yubikey support. But I'll take this for now. I'll have to see if the Google Authenticator app shows up on all of my iDevices linked to my Apple account and whether the code from any of them will work (from the setup process, I don't see why not). Does anybody know? If the app will work from any of iDevices, it would not be secure enough for a service storing bitcoins :) because the second factor shou…

It's per-device, not per account (I know the guy who developed it for Google; one of the smarter people in the industry). It uses protected storage for the credential so it isn't backed up to iCloud, either. Sadly on Android they don't have the same security features available, due to limitations in the OS; it would be fun to talk to Samsung and make a "actually secure Google Authenticator" specific to the S3/S4 sinc…

The Duo-Security people, who have an Android Token claim to use the secure element in NFC enabled phones. It is a TOTP token and can be used just like the Google Authenticator. You don't have to use Duo-Security's system to use it (though there system is worth looking at if you are rolling out your own authentication system).

Re: Linode Manager Two-Step Authentication

#59

Post by pyre »

dllthomas wrote: post #38
singlow wrote: post #33

Earlier quoted context omitted.

Well - it is not likely you will need you public key on the non-web-accessible server. In this type of application the public key is needed in the place that encryption happens and the private key is needed where decryption happens. If the two are on the same machine it likely means you messed up.

Or it means you didn't bother to delete the public key (since, hey, free backup at the cost of not typing rm) when you generated the keypair.

You're assuming a single piece of information has a single key-pair. E.g.:

  1. Obtain sensitive information
  2. Generate a new key-pair
  3. Encrypt with public key
  4. Store encrypted info
  5. Delete public key
  6. Use private key to decrypt when reading the data
It's also likely they they were using one key-pair to encrypt all of their data (or all of a specific type, e.g. one key-pair to encrypt all passwords). In this case, the public key would be needed to encrypt new data coming in.

Re: Linode Manager Two-Step Authentication

#60

Post by pyre »

pionar wrote: post #13
threeseed wrote: post #7

After being bitten the first time with Linode I don't care what technical measures they are taking. I want to know what process and policy changes have been made. Do they still store public/private keys on the same server ? How often are they doing security audits (which clearly never happened before) ? Are they still going to be dodgy and withhold key information from their users ? Are users still going to find out…

Of course the 2FA wouldn't prevent it from being hacked, but that's not the point of it. The point is that even if someone gets the password and cracks it, it's still useless as the attacker doesn't have the other factor.

If the attacker has open access to the network (from compromised machines), does the password to the admin console matter as much?
Post reply on HN