Apify Security Incident

Bleeping Computer's coverage is maybe a bit more detailed Apify rotates API tokens, prompts 2FA resets after breach (https://www.bleepingcomputer.com/news/security/apify-rotates...)

▲

tptacek an hour ago | parent | prev | next [-]

Duplicate, also editorialized title.

https://news.ycombinator.com/item?id=50469719

▲

lowkey_ an hour ago | parent [-]

I don't mind seeing a duplicate here because this looks like a serious incident that may have been downvoted by Apify employees. I personally didn't see it til now despite checking HN very often.

If you check the thread you linked, Apify isn't being transparent about what data was in the leak. Someone posted it from an email they received and allegedly got downvoted, and then a response from an Apify employee.

	▲	tptacek an hour ago \| parent [-]
		(The title is fixed now, and I don't so much care about how much exposure the story gets on the front page as I do that we not lose track of the previous thread. I live in a blissful state of not even knowing what an Apify is.).

▲

radial_symmetry an hour ago | parent | prev [-]

"- API tokens are now stored only as hashes, which limits the impact of any similar incident."

WTF were they not already?

▲

bombcar 33 minutes ago | parent | next [-]

The number of systems that will show me the API token more than once makes me realize that many haven't figured out it is just a long password and should be treated exactly as such.

	▲	0127 31 minutes ago \| parent [-]
		Except maybe using faster hashing, depending on usage

▲

LunaSea 43 minutes ago | parent | prev [-]

And you're absolutely right to push back on that.