Hacker News Reader

Comment by ZeroCoin | Hacker News Reader

If you're wondering, I stumbled upon that text file while reading the official company response to the recent hack here: http://blog.linode.com/2013/04/16/security-incident-update/

I was interested in setting up a Linode account but I think it's best to wait for some more information at this point. Thoughts?

View on HN

> 06:00 < AlexC_> ryann: So, are you saying CC details have also been compromised?

> 06:00 < ryann> Yep

> 06:00 < AlexC_> ryann: And you plan on releasing these?

> 06:00 < ryann> They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory

Jesus Christ. I agree, there is something very wrong with how Linode is treating this situation. Cperciva's comment a couple of days back about the doubletalk in the official statement seems especially precinct, and the new claim about both the private and public keys for the credit card info being stored in the same place... appallingly incompetent if true.

The CEO has already stated that the private key had passphrase encryption, which is strong, and only stored in their heads. You have to take their word on that, but I don't see any proof of CCs being decrypted.

i cannot imagine that a remembered passphrase would take too long to brute-force on a few multi-GPU setups. unless they did something meaningful like making it a long sentence rather than some short-but-complex-for-humans 15 char string. http://xkcd.com/936/

Specifically what they said is it isn't stored digitally. So maybe they have it written down on a piece of paper.

Based on what we've seen before I wouldn't give Linode the benefit of the doubt.

The password is most likely cracked by now.

It's a passphrase, not a password.

  07:52 < HTP> the CCrypter class of the linode application 
  context was accessable from outside the wwwroot using 
  undocumented ColdFusion methods. i was fully able to 
  decrypt the ccs using the in-memory privkey that they 
  supplied the password for.

From the 2nd pastebin'd IRC log, http://pastebin.com/7WXRDyAg

Note that he states all information was deleted. They had claimed earlier that CC info would be released on May 1st.

note: temp account because I accidentally set noprocrast delay to 1 week. Whoops!

Cperciva's comment a couple of days back

Uh... which comment was this?

I signed up for Joyent yesterday, and was quite impressed with the performance. It's probably on par with Linode.

The price is reasonable: $21/month for a 512 MB instance, and free 20,000 GB bandwidth!

In addition, they offer freaking 2-factor authentication! That says a lot when the only ones I know of offering such are AWS and SoftLayer.

You created an account to post this on a thread about a competitor to Joyent? Funny.

Why? Is it not appropriate? I assumed I could offer hosting alternatives since my post's parent author was asking for "thoughts".

I don't work for Joyent, and I just signed up for them 2 days ago. Apologies if my post seemed like blatant advertising.

Reply on news.ycombinator.com