Hacker News Reader

Comment by citricsquid | Hacker News Reader

My Visa card that I used with Linode was stolen and used on an Amazon order I didn't authorise last week, my bank successfully blocked the charge. Someone else reported their Visa had also been compromised in the thread 2 days ago, looks like that confirms the suspicions: https://news.ycombinator.com/item?id=5542015

Poor show Linode. (edit: worth noting I use the card with other things too, I have no confirmation it was leaked through Linode other than the compromise happening at the same time these supposed leaks happened).

View on HN

I have two accounts with them, one for my day job and one through my LLC. Right now neither card is showing unusual charges.

My day job had some Google Apps account compromises last month, and this is making me paranoid that the database that contained hashed/salted passwords for our Intranet hosted on Linode was the culprit. The time frame doesn't seem to line up, but we didn't see any evidence of phishing or compromised desktops being involved.

(Don't want to spread fear - I haven't been able to find any evidence our Linodes were compromised either.)

I'm normally huge a Linode evangelist, but I'm severely disappointed with the lack of transparency on this. I'm debating right now whether to rebuild all our nodes from scratch as I'm not sure they can be trusted.

I had a CC problem, and I use it for a very restricted number of online services. Luckily the fraudulent attempt was blocked by the CC company. Linode was not at the top of my list of suspects (there was another company that seemed to be storing passwords in cleartext), but now I'm wondering. This was a couple of months ago though... I wonder if that's the right time frame?

Switched to https://www.digitalocean.com/ last week. Excellent service and pricing.

Yeah, a week sounds like plenty of time to assess a hosting provider.

Oh, and the years of Linode assessment were adequate?

Every site can be hacked. It's just a matter of time. You just have to properly react: call your CC provider, check for any charges on your bill, and move on.

I do not think anyone here is actually worried about their funds; as mentioned below, any reputable provider will have such charges promptly reversed. The problem is instead with their response to the situation.

Linode has addressed the breach, but assured customers nothing of value had been compromised. This infers two thoughts. One: they knew of the breach and lied, thereby unveiling a unforthcoming and dishonest nature. Or two: they did not properly investigative the severity of the issue, thereby suggesting incompetence. Both equally reprehensible.

Mm, not equally. I'd rather have incompetence over malice.

Until they're hacked, too...

Unlike Linode, they accept PayPal.

I'm far more concerned about the integrity of my servers than about my CC, which has good fraud protection.

Or until they let other customers see all the data on VMs that you've shut down. Oh wait, that already happened: http://www.wired.com/wiredenterprise/2013/04/digitalocean/

DigitalOcean is new and they fixed the problem the same day the article was written:

https://www.digitalocean.com/blog_posts/resolved-lvm-data-is...

If I had a choice between a VPS provider who either:

- Only has large issues (eg. leaks credit card data) and goes weeks without reporting them to customers, or

- Has lots of small issues (eg. forgetting to clean the free space of LVM volumes) but fixes them the same day,

I'd much prefer the latter.

EDIT: My bad, apparently the problem was reported on March 27 and wasn't fixed until April 2.

There is no evidence to suggest that Linode leaked credit card data.

Personally I took precautionary measures and just called my bank to replace my credit card, which I think is the sane approach, as when it comes to hacking you have to assume the worst.

However, your statement on "has lots of small issues but fixes them the same day" is just stupidly childish. Linode's issues are bigger just because they are a bigger target.

Wait a second.. you consider a provider giving data from your VMs to another random customer a SMALL issue?

Maybe you don't have anything of importance on your VMs, but plenty of people do. That data could contain credit card data, passwords, etc, etc, etc. It is very much a large issue.

Sure. My thoughts don't apply to everyone here, and I certainly can't claim to be unbiased since I like DO so much.

According to DigitalOcean, they stated that this impacts 3% of all machines, only the largest and most expensive servers. None of the smaller plans were leaking data.

I don't know how many credit card numbers were leaked from linode, but I'd guess more than 3%.

Second, if security is important to you, you can use 'dd' to clear the machine yourself before shutting it off. (In fact, good data destruction policies mandate the use of 'shred' et al anyway). On Linode, affected users don't even have a workaround (like this) to avoid information compromise.

Fuck it, I'm gonna recruit 7 friends and we'll set up our own VM cluster.

was not convinced by the website, looks nice but prices are kind of very cheap ?

also a twitter feed for the customers page ?

Great, now I am feeling paranoid although I don't see any unauthorized charges on my card. Does anyone know if debit cards are legally protected the same way as credit cards with 0% liability.

Debit cards have less protection.

Wouldn't hurt just to ask your bank to re-authorise it anyway? It will change the three digits on the back.

They don't, protections are exactly the same.

They really aren't.

I know someone who got their debit card cloned. While the bank eventually repaid him, that did nothing to repay him the additional fees he owned his normal debtors (e.g. rent, utilities, etc).

With a credit card you aren't losing "actual" money. You are losing the bank's borrowed money which the bank pays back. With a debit card you're losing cash which you won't be able to replace yourself and which the bank might take days to weeks to replace.

Even if you NEED to borrow while your credit card is out of commission you can either use the overdraft facility on your debit card or other quick sources of credit. Hard to get quick cash without going to a pawn shop.

they typically have the same protections, the only difference is that while credit cards only check that the charge can be made during the authorization period, debit cards lock up the bank's funds immediately which may cause your checking account to be temporarily unusable even if all the charges are successfully disputed.

a good practice that bankers constantly tell me is to have a separate credit card for online purchases for the fact alone that it is one step removed from your checking account.

I'm pretty sure that depends on who issued your card.

Visa has a zero liability program for debit card - http://usa.visa.com/personal/security/visa_security_program/...

These are the FTC's rules [1], I'm not sure if Visa or Mastercard can make them 'better' (give you a larger window). They have an interesting tidbit below their chart -

>If someone makes unauthorized transactions with your debit card number, but your card is not lost, you are not liable for those transactions if you report them within 60 days of your statement being sent to you.

Isn't it free to get a new card? That'd be the easier way than worrying.

[1] http://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cre...

Generally these days they are, but the problem is the money is removed is from your account by the time the charge appears, (at least a period of time), whereas on a credit card you have 30 days to review charges. This could cause overdrafts, etc. depending on timing and amount. Those too can generally be reversed, but the whole thing becomes more of a headache. I never use debit cards for any kind of recurring charges, and I avoid using them online in general.

The same is possible with a credit card - you can have your card maxed, get nailed with overage charges, declined transactions, etc. It's still a headache, but when I've had it happen to me I think I had the money restored within a few minutes of making the call.

You should talk to your bank as it depends on the network your bank uses. Most of the time it's something like a 48 hour window to challenge charges but it's far less at some banks.

No, it's covered by the FDIC. Banks can offer better protections but at least 48 hours within discovery is mandatory. http://www.fdic.gov/consumers/consumer/news/cnfall09/debit_v...

From your link:

> [With a debit card,] "Until the bank provides provisional credit, you could temporarily be out of pocket for the amount in dispute," said Richard Foley, an FDIC attorney who specializes in consumer issues. "This would not typically happen with a credit card because consumers can withhold payment of the amount in dispute."

> Also, as discussed on the next page, consumers have better federal protections when they purchase faulty goods with credit cards.

They are. Protections are exactly the same (in the US at least.) You have protection from the moment that you learn of the problem, not when it happens.

Not that having your account drained doesn't suck, but your worst case scenario there isn't terrible unless you fail to check stuff and be responsible.

I would cancel that card right now. IMHO You should never ever ever ever use a debit card anywhere else other than the ATM. Credit cards give you way more financial protection.

Unless said ATM has been compromised :s

Nothing on my UK Mastercard.

FWIW, no charges on my card used with Linode at this point.

Reply on news.ycombinator.com