Verifications.io Leaks Personal Records of 2B Users
cybarrior.com
cybarrior.com
You should never assume anyone is going to use your product in a secure fashion, and make it so that they have to at least make _some_ effort towards security.
Other than that, writing new features is fun, and you can get so many developers (that don't think about security) for the same amount of money as a good security professional, or a developer with even half an ounce of security sense, commands.
Security is always inconvenient, takes extra effort, and is invisible. So many companies and managers deprioritise it over more visible feature work, forgetting that security in and of itself IS a feature.
Security in depth is just not a thing a lot of people think about right now.
I think the only concern is where the software listens by default. If it's TCP 0.0.0.0/[::] then someone's eventually going to make a mistake.
In my opinion network ACLs are a pretty important part of a modern defense in depth, though you are absolutely right in that these measures are far from a panacea and usually only slow down horizontal movement.
Tunnelling Redis protocol over mutual TLS or something like that sounds like a good idea, but I don't think I've seen anyone doing that :(
Frankly, I would love it if there were a simple, open standard for authentication so every database didn't have to redo it. Maybe mutual TLS is that answer, though traditionally getting the infrastructure for that correct has been difficult.
There is: https://en.wikipedia.org/wiki/Simple_Authentication_and_Secu...
And as you said, nobody bothers to tunnel with TLS. Your lucky if they even use a password.
- Has practically nothing other than Redis on it.
- Has Redis running with minimal permissions and capabilities.
- Has no ability to make outgoing connections.
Which I'd say is vital security practice for anything running in production.
Few people will bother with TLS and you can see that based on the fact that I don't think cloud providers generally support it, but I personally did do this with stunnel at a time. Apparently Redis now recommends spiped, which looks good to me.
Someone in a semi-technical role started one up, dumped a bunch of data on it, and it got left publicly accessible.
The problem is for people to be aware of the leaks, they need to be thinking about security at all, and I'd wager in most cases of mongo-based leaks, that wasn't even a consideration of the people who set them up.
The headline seems wrong.
This adds nothing new to the conversation and consists mostly of quotes from another article.
I was expecting an actual follow-up, and this is not it.
"Please don't complain that a submission is inappropriate. If a story is spam or off-topic, flag it. Don't feed egregious comments by replying; flag them instead. If you flag something, please don't also comment that you did."