Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update

stackoverflow.blog

Post reply on HN
Print view View original

81–90 of 207 posts

Re: Security Update

#81

Post by 9nGQluzmnq3M »

taspeotis wrote: post #77
9nGQluzmnq3M wrote: post #40

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

I've seen plenty of questions that include API keys or credentials and they're later edited to "remove" them although the revision history is still there. It would make up a minority of content on Stack Overflow but it's still there.

Old revisions are already included in the public data dump:

https://meta.stackexchange.com/questions/2677/database-schem...

Re: Security Update

#82

Post by AnimalMuppet »

maccam912 wrote: post #79
rhamzeh wrote: post #2

I think we've reached a point where it's safe to say that if you're using a service - _,any_ service - assume your data is breached (or willingly given) and accessible to some unknown third party. That third party can be the government, it can be some random marketer or it can be a malicious hacker. Just hope that you have nothing anywhere that may be of interest or value to anyone, anywhere. Good luck.

Someone make a service that I can submit my email and you'll generate tons of fake passwords for me, then "accidentally" leak them all. When my email and password make their way into the big password lists I want to dilute the real one with thousands of fake ones. If it became the norm that password lists are suddenly full of junk the demand for them would proboably evaporate.

Interesting, but the result will be that they're going to blast all of those passwords at the login of whatever service you're trying to protect by this trick. That could DOS the service. It also could result in them locking your account, if they're awake at all.

Re: Security Update

#83

Post by xfitm3 »

nerdbaggy wrote: post #80
chairleader wrote: post #9

What tends to be the first indication of breaches? It's one thing to do a forensic analysis after learning of a breach, and it's another to detect it in the first place.

I worked at a company that logged every single SQL query and made a rule set based on that. May not of been the most efficient but it worked great. There was basically a whitelist of sorts and if the query structure wasn’t in there then action taken. Also worked by knowing what queries came in what order when doing certain things.

What tooling did you use to audit queries?

Re: Security Update

#84

Post by ggg2 »

shpx wrote: post #43
StavrosK wrote: post #17

Earlier quoted context omitted.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

can't tell if you are joking or not.

I highly suggest you read chrome's privacy policy on that password sync feature. Hint: when enabled on android the wifi password is unencrypted (or reversible, which is close to the same thing. they claim it must be so to work with wear)

Re: Security Update

#85

Post by Falkon1313 »

mehrdadn wrote: post #22
rhamzeh wrote: post #19

Earlier quoted context omitted.

* KeePass2Android Offline :)

Why offline? (And how do you sync?)

For me, I sync by plugging my phone into the USB port and copying the .kdbx file over. I've never needed anything fancier, let alone had a reason to send my password database out over the internet.

Re: Security Update

#86

Post by pvg »

kerng wrote: post #66
shpx wrote: post #43

Earlier quoted context omitted.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

The attack surface of a browser makes it a perfect target - I would not advise storing any critical passwords with the browser or in close reach to the browser.

You're going to be entering these passwords into a browser most of the time so if a compromised browser is your problem, no password manager is really going to help you.

Re: Security Update

#87

Post by ggg2 »

AnimalMuppet wrote: post #82
maccam912 wrote: post #79

Earlier quoted context omitted.

Someone make a service that I can submit my email and you'll generate tons of fake passwords for me, then "accidentally" leak them all. When my email and password make their way into the big password lists I want to dilute the real one with thousands of fake ones. If it became the norm that password lists are suddenly full of junk the demand for them would proboably evaporate.

Interesting, but the result will be that they're going to blast all of those passwords at the login of whatever service you're trying to protect by this trick. That could DOS the service. It also could result in them locking your account, if they're awake at all.

if someone get enough passwords to DoS the service or force you to do a password reset, that's actually a pretty good safety fallback.

Re: Security Update

#88

Post by pvg »

hellcow wrote: post #55
shpx wrote: post #43

Earlier quoted context omitted.

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

Last I checked, Chrome on desktop stores all your passwords in plaintext on disk. Unless something's changed... I wouldn't use that. Firefox at least offers you the ability to set a master password to encrypt all the rest.

It doesn't anymore, unless last time you checked was quite a while ago. But it probably wasn't such a dreadful thing even when they were doing it.

Re: Security Update

#89

Post by rglullis »

closeparen wrote: post #76
kuzimoto wrote: post #3

Earlier quoted context omitted.

I've made it a point to start self hosting anything that's particularly sensitive that I don't want third parties to have access to. KeePass and SyncThing probably have my most important information, and it's all owned by me.

StackOverflow is a forum, not a password manager or a file storage service. If people only participate in forums they self-host, each will have a community of one.

The IndieWeb people would like to have a word with you...

Re: Security Update

#90

Post by lscotte »

StavrosK wrote: post #17
kuzimoto wrote: post #3

Earlier quoted context omitted.

I've made it a point to start self hosting anything that's particularly sensitive that I don't want third parties to have access to. KeePass and SyncThing probably have my most important information, and it's all owned by me.

Plus, both are great software. KeePass2Android is the best Android password manager, bar none.

I used to be a fan of keepass as well, but I moved to bitwarden maybe 18 months or so ago. For $10 a year for the paid version I get MFA and some other features. I find it a much more seamless experience than keepass/etc, as it works as a browser extension or a discrete app (the Android app uses accessibility features so it detects other Android apps asking for authentication as well as Android browsers such as Firefox). Anyway, just another thing to try if you are looking...
Post reply on HN