Internet Archive breached again through stolen access tokens

Post by codezero » Sun, Oct 20, 2024, 6:51 PM UTC

semicolon_storm wrote: post #11

badlibrarian wrote: post #10

Restating my love for Internet Archive and my plea to put a grownup in charge of the thing. Washington Post: The organization has “industry standard” security systems, Kahle said, but he added that, until this year, the group had largely stayed out of the crosshairs of cybercriminals. Kahle said he’d opted not to prioritize additional investments in cybersecurity out of the Internet Archive’s limited budget of around…

In security, industry standard seems to be about the same as military grade: the cheapest possible option that still checks all the boxes for SOC.

Post by wkat4242 » Sun, Oct 20, 2024, 6:53 PM UTC

fngjdflmdflg wrote: post #53

ghostly_s wrote: post #43

Earlier quoted context omitted.

IA is in bad need of a leadership change. The content of the archive is immensely valuable (largely thanks to volunteers) but the decisions and priorities of the org have been far off base for years.

Do you have any examples?

Post by [deleted] » Sun, Oct 20, 2024, 6:57 PM UTC

TheFreim wrote: post #4

> "It's dispiriting to see that even after being made aware of the breach weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets," reads an email from the threat actor. This is quite embarrassing. One of the first things you do when breached at this level is to rotate your keys. I seriously hope that they make some systemic changes, it seems that…

Post by [deleted] » Sun, Oct 20, 2024, 6:58 PM UTC

badlibrarian wrote: post #10

Restating my love for Internet Archive and my plea to put a grownup in charge of the thing. Washington Post: The organization has “industry standard” security systems, Kahle said, but he added that, until this year, the group had largely stayed out of the crosshairs of cybercriminals. Kahle said he’d opted not to prioritize additional investments in cybersecurity out of the Internet Archive’s limited budget of around…

Post by pvg » Sun, Oct 20, 2024, 6:59 PM UTC

alexey-salmin wrote: post #54

A genuine question to commenters asking to "put a grownup in charge of the thing" and saying that "Kahle shouldn't be running things": he built the thing, why exactly he can't run it the way he sees fit?