Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OVH Security Incident

status.ovh.net

Post reply on HN
Print view View original

1–10 of 55 posts

Re: OVH Security Incident

#4

Post by p4bl0 »

computer wrote: post #2

The level of transparency in this report is great. Especially compared to things like the Linode incidents.

OVH is always very good with transparency with its client. That's part of why I use them for my server, and my ADSL2+ (soon to be VDSL2) at home: when there is a problem, I know what it is and they report their progress solving it in live. Also their customer support is great and doesn't take you for a foul, if they feel you can take technical details, they will gave them to you and really discuss with you about the solution.

Re: OVH Security Incident

#6

Post by mikeash »

Robin_Message wrote: post #3

If I was a customers, I'd be asking if "based on SHA-512" means some kind of iterated algorithm, or if have they lost my password?

That jumped out at me as well. People need to understand that even cryptographic hashes cannot be considered irreversible for short inputs, and that you need to use something specifically designed as a password hash to do it properly.

Re: OVH Security Incident

#7

Post by epsylon »

hbbio wrote: post #5
Robin_Message wrote: post #3

If I was a customers, I'd be asking if "based on SHA-512" means some kind of iterated algorithm, or if have they lost my password?

Maybe SHA-512, salted?

Yep, in the french version of the message they specify that it's salted.

http://travaux.ovh.net/?do=details&id=8998

Re: OVH Security Incident

#8

Post by thirsteh »

mikeash wrote: post #6
Robin_Message wrote: post #3

If I was a customers, I'd be asking if "based on SHA-512" means some kind of iterated algorithm, or if have they lost my password?

That jumped out at me as well. People need to understand that even cryptographic hashes cannot be considered irreversible for short inputs, and that you need to use something specifically designed as a password hash to do it properly.

http://throwingfire.com/storing-passwords-securely/#notpassw...

http://codahale.com/how-to-safely-store-a-password/

Re: OVH Security Incident

#9

Post by aroch »

p4bl0 wrote: post #4
computer wrote: post #2

The level of transparency in this report is great. Especially compared to things like the Linode incidents.

OVH is always very good with transparency with its client. That's part of why I use them for my server, and my ADSL2+ (soon to be VDSL2) at home: when there is a problem, I know what it is and they report their progress solving it in live. Also their customer support is great and doesn't take you for a foul, if they feel you can take technical details, they will gave them to you and really discuss with you about the…

Your interactions are pretty much opposite of mine. OVH is constantly doing stupid things to their network (like updating all their BGP reflectors at the same time last week and then falling out of BGP because of it). What they have in transparency and they lose in being a bunch of asshats to deal with. They've taken a week to replace a blown PSU (caused by their own inability to wire a rack); they've dumped my servers because their own internal billing checks weren't aligned with my actual billing details; ffs they essentially root all their servers with their default install image.

I won't even go into their blatant breaches of contract...They toss a ToS at you, but you can only read it when signed into your manager and you can only sign into your manager if you accept the ToS. They won't email you the new ToS either, you have to accept it without being able to read it.

Post reply on HN