Slashdot Mirror
Memo Details Gawker Security Strategy
Trailrunner7 writes "After a hack of systems belonging to online publishing giant Gawker Media that yielded more than one million passwords, the online media company's chief technology officer has announced new defense strategies aimed at placating their users and preventing further humiliating data breaches. Thomas Plunkett issued a company-wide memo on Friday that lays out the new security measures and suggests the company overlooked security concerns in the rush to develop new features."
I read it, but nowhere it mentions not being douchebags. Not gonna work.
Why were the original passwords even stored in the clear like that?
That's just stupid... And something we've known NOT to do for decades.
Norton 2011.
We can all sleep soundly now.
I've been dying to know whether the no-name CTO of some joke of a blog franchise has had any thoughts since his incompetence was made public.
I, for one, will be eagerly perusing his recommendations to see if there's anything I've missed.
...Don't talk about the Gawker Media Strategy...
To put a witty saying into 120 characters, jst rmv ll th vwls.
What a waste of resources and energy. Leaked my ass. Release is the correct word. I wonder how many other press releases are going to marked as "leaked" now to provide instant cred. I'm sick of the lip service. basically their only plan is to stop aggregating personal data so the next time this happens they wont have bad press. And it will happen again despite all their new "precautions". Asinine steps that will last a few months until some wig with a huge ego starts shouting entitlement and that they have a special need.
Their whole strategy so far has been to blame the users: "Its not Gawkers fault your passwords are so weak."
...no one has heard of!
Seriously, was Gawker on anyone /.ers' radar before this news broke? Or am I the only one who never leaves the cave?
You don't say!
Our development efforts have been focused on new product while committing relatively little time to reviewing past work.
Software engineers, stop me if you've heard this one: "Don't worry about bugs or security holes! Just keep shoveling features in and ship! Audits? Code reviews?? Don't have time--gotta ship ship ship!"
Does the memo include the obvious, "store a hash rather than the actual password"?
In recent weeks, intruders were able to gain access to our web servers by exploiting a vulnerability in our source code, allowing them to gain access to user data and passwords.
They are still blaming bugs in code. Pretending to be mistakes made by low level programming flunkies. The problem was using an unsalted hash that allowed them to do a simple dictionary attack. Further even the top guys were using very simple passwords. Used the same password for multiple accounts. Continued to leave other accounts and usernames unlocked even after knowing one account using that password has been compromised.
No. The real problem was that the managers and the top dogs drawing top salaries were clueless idiots. Pretending that it was some kind of stupid bug left in code by some low level programmer shows how disconnected these bozos are from reality.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
"The tech team should have been better prepared, committed more time to perform thorough audits, and grown our team’s technical expertise to meet our specific business needs."
We have the exact same problem with an internet-connected application where I work - plaintext passwords. All of the developers have pointed out that it's a problem to business, but they think it's a feature because it allows them to read passwords back to customers who've lost them, or send them a welcome e-mail with their password. No matter how much we whinge and bitch that it's wrong and you can send users new passwords with hashed or encrypted password systems they won't budge and refuse to spend dev time or money fixing it.
"Business Needs" means adding more features, not fixing broken implementations.
Of all of the authentication schemes out there, OpenID is by far one of the lousiest pieces of shit around. I say this as a programmer and system administrator who has dealt with many such systems in my career.
A few months ago, while developing some software, I ran into an unusual scenario. I wanted to merely ask a question at StackOverflow, but ran into their shitty OpenID-based authentication. My existing Yahoo! and Google addresses wouldn't work. I don't use LiveJournal, Facebook, or the other lesser-known providers they support.
After wasting a few minutes on something that should have taken less than 10 seconds, I decided just to ask my question on a mailing list instead. After all, it didn't waste my time with OpenID nonsense.
Is part of the strategy to force users to change their password every month so they can write it down or reuse it and make it just secure enough to pass validation? This kind of crap is happening at work and forces me to use crappy passwords! Thanks security consultants!
I'm a wanker.... and loving it!
"and suggests the company overlooked security concerns in the rush to develop new features"
In other words they are no different than Windows.
Like many youngsters thrust into high positions, this guy doens't get it. He has a number of issues, the first is that he hasn't stopped using Google Apps for corporate data. Idiot.
Why don't all the employee interfaces into their systems require a VPN? A REAL VPN - IPSec-based. Idiot.
Mandatory use of a password manager should have been in this post. There's no reason to have short passwords anymore.
No mention of updating the DES encryption to something newer - you know, not 20 yrs old.
OAuth? Seriously? I'm not interested in sharing my access with "those" corporations. Let me use OpenID and authenticate to my personal server.
Anyway, he has the corporate culture to fight AND the teenage-like mentality that many of the editors/contributors display.
Security isn't an easy thing to do, especially with that code base. With all that javascript, I'd be afraid, very afraid that too many interfaces are public. Do they even use reverse proxies with filters? They can make good progress in a year, but I wouldn't expect the security-as-part-of-daily-work to be there for 3-5 years. In the meantime, everything they do needs to have a 2 pg "is this security" checklist.
secure data within their network. Every solution he proposed uses and outside resource. Move away from storing all data? Use outside authentication? One time accounts? (this one really got me)
Are they that bad at the basics of security? Someone please tell me this is not the norm.
from the memo:
Disposable accounts are similar to the service a pre-paid phone offers to drug dealers (a disposable, untraceable communication device).
I wonder how did he come across this service? I mean, even if you think doing drugs is ok it's a questionable example to use in a corporate memo.
I never heard of Gawker, but I received email from them telling me that my account was compromised. I just went to their site, entered my email and asked for a password reset. I got a reply with a username I don't recognize. When I logged in with the id and password, I got an error message that said I had never "verified" my account.
I'd say they have some serious problems that go beyond the password hack.
The premise of the site seems pretty sketchy.
They really screwed the pooch. I'll never go to their sites again, this is basic info-sec that should have been simple and unobtrusive. They failed.
gigantino.tv - Heavy but weighs nothing.
i deleted my account.
Wealth is the gift that keeps on giving.
It turns out that Gawker has a "Chief Technology Officer". However, if you read this article from Forbes, it makes you wonder what this guy actually did, other than show up and collect a paycheck.
Umm... Maybe you've been scammed? Or maybe woosh for me.
Here is a copy of the memo that was sent out highlighting the new security protocols:
To: All Employees
New Security Protocols
1) Do not write down your passwords on post-it notes and then attach them to your monitor.
Thank you for your cooperation.
I may be wrong, but it appears that when you try to delete your account, they don't actually get rid of the information, they just make it inaccessible to you. I guess they'd prefer not to offend all the advertisers they whored your personal information out to.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Why is it so hard to just md5 the password into the DB, then do a md5 compare at login, I thought this was a fucking standard. Its db security 101 for gods sake.