Personal and social information of 1.2B people discovered in data leak

Re:Personal and social information of 1.2B people discovered... by dtech on Friday November 22, 2019 @03:44PM (#21609867)

That's still really insecure, because it means that as soon as someone manages to gain any access to that network or any of the services on that network has a security issue your database is wide open.

That means that if someone manages to get access to the. I'd say public internet with proper (encrypted) password auth is more secure than that.

[ Parent | on HN ]

Re:Personal and social information of 1.2B people discovered... by lmilcin on Friday November 22, 2019 @09:00PM (#21611919)

If attacker has access to app server it is already game over. App server typically already has access to all of the data.

The pods are akin to localhost networking where there is only one externally available application with multiple networked components.

[ Parent | on HN ]

Re:Personal and social information of 1.2B people discovered... by rbanffy on Saturday November 23, 2019 @08:47AM (#21614071)

That's true, but there are usually multiple ways to compromise protected networks. You still need to protect the database against attacks that don't go through the app server.

[ Parent | on HN ]

Re:Personal and social information of 1.2B people discovered... by m00x on Friday November 22, 2019 @06:57PM (#21611364)

If an attacker gets a hold of your app server, they will be able to get the connection details for that DB, including the username/password.

Having a password adds a small layer of protection to databases that the affected app wasn't meant to connect to.

It adds some protection in that case, but the user should use best judgement if it's worth doing.

[ Parent | on HN ]