I just got the email from haveibeenpwned. F Trello.

  • Tarquinn2049@lemmy.world
    link
    fedilink
    English
    arrow-up
    57
    arrow-down
    19
    ·
    edit-2
    9 months ago

    This is not something a company did.

    The group of people took a list of user names and passwords from a different breach and tried them on trello to see if people used the same password and wrote down which ones did.

    Nothing a company can possibly do to stop this, only users can.

    Even if the company required 2 factor authentication to fully log in, getting this far would still confirm each account/password combo was correct, which is all the “hackers” did.

    • fine_sandy_bottom@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      45
      ·
      9 months ago

      That’s not what happened.

      Attackers queried n email addresses against trello, who responded with names and user names for accounts that existed.

      No one asked trello to publish their names, so that’s a breach.

    • joshhsoj1902@lemmy.ca
      link
      fedilink
      English
      arrow-up
      23
      arrow-down
      2
      ·
      9 months ago

      This isn’t completely true, but it is the current standard.

      A website can detect and block many user/password attempts from the same IP and block IPs that are suspicious.

      Websites can detect elivated login fails across many IPs are react accordingly (It may be reasonable to block all logins for a time if they detect an attack like this)

      I’m sure there are other strategies, I don’t know how often they are actually employed, but I wish companies would start taking this sort of attack more seriously (even if it’s not at all hacking)

      • glitch1985@lemmy.world
        link
        fedilink
        English
        arrow-up
        12
        arrow-down
        2
        ·
        9 months ago

        CGNAT would throw a wrench in that when you have thousands of users using mobile data and they appear to be coming from the same ip.

        • Saik0@lemmy.saik0.com
          link
          fedilink
          English
          arrow-up
          4
          ·
          9 months ago

          You look for trends, not raw numbers. If an ip increase 500%in 10 minutes… throttle it a bit… insert wait times. If it’s trust worthy then allow new value to become normal… otherwise keep the ip throttled.

        • frezik@midwest.social
          link
          fedilink
          English
          arrow-up
          4
          ·
          edit-2
          9 months ago

          Nooooo, people keep telling me IPv6 will be insecure because of no longer having NAT.

          Mostly people who don’t know what a subnet is, but people.

      • sfgifz@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        2
        ·
        edit-2
        9 months ago

        It may be reasonable to block all logins for a time if they detect an attack like this

        That would be a P1 incident and probably violate SLAs depending on the duration.

        • Saik0@lemmy.saik0.com
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          9 months ago

          Inserting a literally meaningless delay like 5 seconds is sufficient to make your service virtually impenetrable to mass bruteforce/stuffing attacks. Credential stuffing become untenable when your trying to stuff 1million creds with a 5 second cooldown. Most normal users who would hit it would just think their wifi or cell service hicupped.