After hack, Gawker CTO outlines security changes

After hack, Gawker CTO outlines security changes

Gawker will move to two-factor authentication, disposable accounts and use of SSL

Article comments

Gawker Media's CTO has outlined a series of security changes designed to shore up the company's IT operations following an attack last week that compromised up to 1.4 million accounts.

The company was unprepared to respond to an attack in which user data and passwords were posted to peer-to-peer file-sharing networks, wrote Tom Plunkett in an e-mail memo to Gawker staff on Friday. The e-mail was reposted on Jim Romenesko's blog on the Poynter journalism site. A group called Gnosis claimed responsibility for the hack, which exploited a flaw in the source code of Gawker's Web servers.


"Our development efforts have been focused on new product while committing relatively little time to reviewing past work," Plunkett wrote. "This is often a fatal mistake in software development and was central to this vulnerability."

As a result, Gawker has done a security audit of the sites affected, which include Lifehacker, Gizmodo, Gawker, Jezebel, io9, Jalopnik, Kotaku, Deadspin and Fleshbot.

Gawker is now mandating the use of SSL (Secure Sockets Layer) encryption for employees with company accounts using Google Apps. Also, if those employees have access to sensitive legal, financial or account data, two-factor authentication must be used, Plunkett wrote.

Gawker also will not allow employees to discuss sensitive information on chat applications, including AOL's Instant Messenger and Campfire.

For users of its websites, Plunkett wrote that Gawker wants to move away from storing information such as e-mail and passwords and use systems such as OAuth.

OAuth is an authentication protocol that allows people to use the same login information for multiple services and share data through an API (application programming interfaces). OAuth provides a token that grants access to different applications, which do not see users' original login credentials. It is being used now by Google, Twitter and Facebook, among other services.

Gawker will also allow people to create a "disposable" account with its sites in order to leave comments. Gawker will not store e-mail addresses or passwords for those accounts. The accounts can be used as long as the person remembers a key code, Plunkett wrote.

Since the breach, Gawker has been in the process of notifying those who are affected and reminding them to change their passwords, especially if they used the same password for other Web services. Twitter saw a raft of spam soon after the Gawker breach, which illustrated that some people used the same password on both services.

The US Federal Bureau of Investigation is looking into the Gawker breach.

Share:

Comments

  • Howard Klien I think a service where you can be authenticated by your phone and just telesign into your account is much more secure than these weak passwords There are several providers that are starting to offer an API call for authentication including some of the social sites
Send to a friend

Email this article to a friend or colleague:


PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.


We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

ComputerworldUK Knowledge Vault

ComputerworldUK
Share
x
Open
* *