Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update

stackoverflow.blog

Post reply on HN
Print view View original

61–70 of 207 posts

Re: Security Update

#61

Post by rcfox »

9nGQluzmnq3M wrote: post #47
smelendez wrote: post #44

Earlier quoted context omitted.

And passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.

I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.

10 years ago, almost to the day, they had a password vulnerability involving unsalted hashes. So not plain text, but who knows if they've learned the right lessons?

https://blog.codinghorror.com/i-just-logged-in-as-you-how-it...

Re: Security Update

#62

Post by paxys »

9nGQluzmnq3M wrote: post #40

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

Not all of Stack Overflow is public. E.g. https://stackoverflow.com/teams.

Re: Security Update

#63

Post by kerng »

Reedx wrote: post #53
rhamzeh wrote: post #2

I think we've reached a point where it's safe to say that if you're using a service - _,any_ service - assume your data is breached (or willingly given) and accessible to some unknown third party. That third party can be the government, it can be some random marketer or it can be a malicious hacker. Just hope that you have nothing anywhere that may be of interest or value to anyone, anywhere. Good luck.

Just imagine a Gmail or Mint breach. Oy.

I think a mature state of mind is that you should assume those systems are compromised.

Re: Security Update

#64

Post by robomc »

9nGQluzmnq3M wrote: post #47
smelendez wrote: post #44

Earlier quoted context omitted.

And passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.

I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.

They don't have to store them as plain text for it to be a problem.

If they're not salted it's trivial to crack the hashes, and if they are all uniquely salted, while it's time consuming, they can still gradually crack them.

Given that you could probably sift through the users to find particularly juicy targets (usernames of maintainers of top open source projects with github repos for example?) that could justify the work of a time consuming attack on the hashes.

Re: Security Update

#65

Post by desdiv »

Reedx wrote: post #53
rhamzeh wrote: post #2

I think we've reached a point where it's safe to say that if you're using a service - _,any_ service - assume your data is breached (or willingly given) and accessible to some unknown third party. That third party can be the government, it can be some random marketer or it can be a malicious hacker. Just hope that you have nothing anywhere that may be of interest or value to anyone, anywhere. Good luck.

Just imagine a Gmail or Mint breach. Oy.

Before 2013, data sent between Google data-centers were in plaintext (!!!) because Google incorrectly assumed that the their private fiber network was actually private[0].

So if you used Gmail or communicated with people who used Gmail before 2013, then a copy of your communications are backuped up in Utah[1] right now.

[0] https://www.wired.com/2013/10/nsa-hacked-yahoo-google-cables

[1] https://en.wikipedia.org/wiki/Utah_Data_Center

Re: Security Update

#66

Post by kerng »

shpx wrote: post #43
StavrosK wrote: post #17

Earlier quoted context omitted.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

The attack surface of a browser makes it a perfect target - I would not advise storing any critical passwords with the browser or in close reach to the browser.

Re: Security Update

#67

Post by interwho »

plasma wrote: post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

There's a group out of the University of Warwick that's trying to commercialize a similar idea.

https://www.hubofallthings.com/main/what-is-the-hat

Re: Security Update

#68

Post by bigiain »

judge2020 wrote: post #57
identity0 wrote: post #49

Earlier quoted context omitted.

Pretty sure every single modern browsers has that. The downside with using chrome is handing all your browsing history and bookmarks to Google.

Unless they on-the-fly decrypt your chrome sync (which would require non-encrypted password storing), the stuff you sync to Google is encrypted with your Google password, and if you're paranoid, you can encrypt the sync with a separate password.

> the stuff you sync to Google is encrypted with your Google password

Your Google Password is also available to Google. (At least every time you log in, even if they properly hash and discarded it after authenticating you and just use a token from there.)

Re: Security Update

#69

Post by nick_kline »

I'm glad it was a 'minor' breach. But where is the blog post from the clever and witty founder, about not trying to hire the top 5% of security engineers because everyone is?

Re: Security Update

#70

Post by butteroverflow »

hellcow wrote: post #55
shpx wrote: post #43

Earlier quoted context omitted.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

Last I checked, Chrome on desktop stores all your passwords in plaintext on disk. Unless something's changed... I wouldn't use that. Firefox at least offers you the ability to set a master password to encrypt all the rest.

Well, on Windows Chrome does use the system crypto API and encrypts, I believe, your whole profile, but only if you have a password set on your system account.
Post reply on HN