How user friendly is guacamole? Anyone have any experience setting it up for non techies?
GoToMyPC has been hacked, all customer passwords reset
11–20 of 171 posts
Re: GoToMyPC has been hacked, all customer passwords reset
#12Lame excuses ("a very sophisticated password attack") with no details so that we can estimate the risk.
What risk is there to estimate? Assume that the attackers have the clear text of your password, and know that it's your password.
What you're saying is more drastic then what they wrote here. If you used the same password somewhere else, then you're going to have change all those passwords.
Re: GoToMyPC has been hacked, all customer passwords reset
#13As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I'm using LastPass with a 2FA Yubikey token.
In addition, I try use different E-Mail adresses whenever I sign up, a catchall makes sure they end up in the same inbox. This might not stop a sophisticated targeted attack, but it should throw off a lot of automated runs since the email they got is seemingly not used at another service. A litte obscurity to strengthen the rest of my security ;)
Re: GoToMyPC has been hacked, all customer passwords reset
#14As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I use a password safe file (https://pwsafe.org/) which I then store randomly generated passwords per site and have a strong password on the safe itself.
I like this as a solution as it's not dependent on any third parties like cloud services, its pretty portable and I have a unique password per site, so I'm not really that bothered when the inevitable breaches happen.
Downside to this approach is that I have to have a device which has the password safe to hand to use it (there are clients for Windows/Linux/Mac/iOS/Android), I'm responsible for managing the file and if I lose the file + passphrase I'm stuffed :)
Re: GoToMyPC has been hacked, all customer passwords reset
#15As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
Random password, FastMail email alias, fake but plausible name and date or birth, all dumped in to 1Password.
Would love to find a credit card which allowed me to offer up fake billing details - obviously the CC provider would need to know who I was, but there's no reason who I'm paying needs to.
Re: GoToMyPC has been hacked, all customer passwords reset
#16As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I simply use keepassx with the database being synced between all my devices (Linux, Windows, Android) via Syncthing. I also have a scrambled printout in my bank safe (30€/year) that I update every couple of months.
Re: GoToMyPC has been hacked, all customer passwords reset
#17As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
KeePassX and Syncthing over WiFi. No browser add-ons. I decided to give it a try after the LastPass acquisition to see how feasible it was, and haven't looked back really. It helps that I'm mostly on Android mobile devices. KeePass2Android is what I use on the phone.
Re: GoToMyPC has been hacked, all customer passwords reset
#18Earlier quoted context omitted.
What risk is there to estimate? Assume that the attackers have the clear text of your password, and know that it's your password.
What you're saying is more drastic then what they wrote here. If you used the same password somewhere else, then you're going to have change all those passwords.
Of course you do. That's why you don't reuse passwords.
Why would you trust your other accounts to their internal investigation + PR interpretation anyway?
Re: GoToMyPC has been hacked, all customer passwords reset
#19Aren't these remote access solutions primarily on demand and therefore coupled to a one-time password generated each time it's started? Isn't Chrome's remote access otp only? Maybe it's time to ask friends/family to use that instead. I mean, if I want permanent remote access, then I'd set up a reasonably secure VPN solution that also required client side certificates, without the use of a trusted intermediary/proxy.…
Yes and no.
Teamviewer, for example, has a few use-scenarios, one of which is the unattended access, which is what appeared to be compromised. Essentially there was an always-on agent process running on the target machine that you could access with a Teamviewer account you set up; said account could manage any number of PCs that had always-on unattended access.
Teamviewer also has a "Quick Support" option, in which the application spawns a computer ID number and a theoretically one-time use password. The complexity of the password could be set within the application. Their QuickSupport tool, meant for a one-off support session, generates a unique session ID (in the past they had a static computer ID and a semi-unique password generated per client) which can be given to a support rep with the full version of Teamviewer to access.
I have not yet followed up on the Teamviewer issue so I cannot say exactly what was compromised there, though last I remember Teamviewer was insistent their service had not been compromised, but that the unauthorized access was the result of reused passwords.
GoToMyPC appears to be the former, an agent you install with the intent of unattended access on a whim. While server access is certainly one use scenario, access to non-server PCs for whatever reason is also a major part of these. Barring a breach of the software accounts or incompetently designed security for the remote access tools, it's probably okay for most people. Unfortunately, it seems like a breach is exactly what happened here with GoToMyPC, though as has been noted in the discussion already, the details are extremely sparse.
Re: GoToMyPC has been hacked, all customer passwords reset
#20As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
A unique password, 2FA, AND a unique email address.
I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions.
For 2FA I use either SMS or Authy https://www.authy.com/ Take a look at https://www.turnon2fa.com/ to see which sites support 2FA.
It does make logging in to some frequently used sites a bit of a pain (looking at you PayPal!) but I think it is worth it.
On to unique email addresses. I do this for two reasons.
1. Allows me to easily see where an email has come from & filter if necessary. I can tell if your company has leaked / lost / sold my address.
2. If I have reused a password, a database leak doesn't compromise other sites. An attacker doesn't know the login details for LinkedIn based on my GoToMyPC email.
I tend to use something like lnkdn@ mydomain / gtmypc@ ... / twttr@ ... - but if your mail provider lets you use a catch-all, it can be anything you like.
One word of warning - it really confuses people when you give the email over the phone! I usually say "I'm creating a unique email address for you so that the message doesn't go into spam. Ok? sound of me hitting random keys It's yourcompany@ ...."