Hacker News Reader

Comment by nilved | Hacker News Reader

This will do absolutely nothing if Linode themselves are hacked, which is what happened the past two (100% of the) times.

View on HN

The only to prevent it, is to implement the two-facotr authentication on protocol-level instead of application-level. This brings you to smartcard-authentication, or VPN solutions (using smartcard or RSA tokens)

But if they would implement that, everybody will start screaming that they have to pay for a smartcard or rsa-token...

Be honest here, how many of you would actually want to pay for that?

yeah, thought so...

Ok, so they get hacked and passwords are stolen and those are cracked. Guess what? They're useless. With 2FA, the attackers still won't be able to get in.

No, if you hack the portal, you can get whatever info it mediates; the attackers don't need to then use the passwords and 2fa tokens to log in to get it, they just bypass authentication entirely.

It's totally reasonable to believe linode is enough of a clusterfuck internally, based on past performance that this kind of thing is plausible. Yes, this protects you from one kind of attack if an attacker only gets limited access to linode's systems.

The other issue is it doesn't protect you from password reuse. If a user is dumb and uses his global password for his linode password, and linode is hacked again, and the password is recovered, the attacker uses that userid/password/email/etc. to attack other accounts of that user at other services.

The problem wasn't in passwords being stolen. CC information was allegedly leaked.

Allegedly? They admitted it was.

They admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.

Linode confirmed that the private encryption key was stored on the same machine. They've been parroting lines about the password on the private key being too strong to crack.

It was also made clear that the encryption key was protected by a passphrase which was not stored on the machine.

"which was not stored on the machine", like they should be commended ( Reminds me of exams where you received some credit for including your name... ).

I am sorry, them confirming this fact, and even if I recall adding a smiley in the tweet they did it, just cemented that they do not understand their business.

They clearly wish to give the impression that they are "secure". They need more lock icons...they are almost as effective as the racing stickers on my car!

The real problem here is that PCI certification is an absolute joke.

There should be several classes of certification, from "I want to sell a few pet rocks" to "I'm Apple with 150,000,000 credit cards on file". Right now there's basically two.

This isn't proof of anything, but a few days after this incident the CC I use for Linode got a fraudulent charge, the first such in years. I cancelled the card, so no big deal, but this makes me strongly suspect that the attacker ended up with actual card numbers, regardless of the passphrase.

IRC logs showed the passphrase was extracted from the ColdFusion app's memory.

Reply on news.ycombinator.com