GoToMyPC has been hacked, all customer passwords reset • Hacker News Board

Re: GoToMyPC has been hacked, all customer passwords reset

#61

Post by lukasm » Sun, Jun 19, 2016, 1:20 PM UTC

wsr wrote: post #3

As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!

What is your threat model? If this is the just the described hacking I propose -> https://www.troyhunt.com/going-dark-online-privacy-and-anony... https://vox.space/blog/89/being-privacy-aware-in-2016

Get anonymous identity and VPN.

Using KeePassX/LastPass/1Password is a bit problematic. They become a single point of failure. Someone can get my master password (https://github.com/cxxr/lostpass) or can pwn LastPass. To improved that my passwords becomes + +

I divided accounts into tiers:

Tier0: The most important account: Macbook, Gmail, Github Tier1: Still important, but not as much as Tier0: Youtube Tier2: I don't really care. Tier3: Testing accounts for local dev server: Single simple password like qwerty1234.

I just need to remember 5 passwords(Gmail, Macbook, Github, LastPass, helper password). I think this strategy gives a nice balance between connivance and security.

Re: GoToMyPC has been hacked, all customer passwords reset

#62

Post by 0xmohit » Sun, Jun 19, 2016, 1:28 PM UTC

EasyTiger_ wrote: post #59

0xmohit wrote: post #45

Earlier quoted context omitted.

> I use https://lastpass.com/ for generating passwords. ... Would prefer open source, but nothing else comes close. On a linux/unix system, one could use /dev/urandom: tr -dc '[[:alnum:][:punct:]]' would generate a 16 character long password . One could even put the following function in $HOME/.bash_profile or such genpw() { tr -dc '[[:alnum:][:punct:]]' Now invoking it by saying genpw would generate a pseudorandom s…

Are you implying this comes close to the convenience of LastPass?

Sorry, haven't used LastPass myself. But as far as generating a random password goes, this would be pretty effective.

Re: GoToMyPC has been hacked, all customer passwords reset

#63

Post by Yhippa » Sun, Jun 19, 2016, 1:34 PM UTC

chmars wrote: post #58

scrollaway wrote: post #6

Earlier quoted context omitted.

Use a password manager. One strong password per site. https://www.keepassx.org/ Also, use 2FA wherever available. Google Authenticator is good enough. Store your backup codes somewhere safe (your keepass db, for example. Although that goes a bit counter to the point of 2FA, if someone cracks your keepass db, you're pretty screwed regardless).

There is still a major annoyance with Google Authenticator etc.: When you switch your device, you have to set up your 2FA credentials again …

This is why I now use SMS authentication.

Re: GoToMyPC has been hacked, all customer passwords reset

#64

Post by chmars » Sun, Jun 19, 2016, 1:36 PM UTC

Yhippa wrote: post #63

chmars wrote: post #58

Earlier quoted context omitted.

There is still a major annoyance with Google Authenticator etc.: When you switch your device, you have to set up your 2FA credentials again …

This is why I now use SMS authentication.

I do sometimes too … although it is less secure … and if you are abroad, it can be expensive due to roaming charges … or you are not online at all …

Re: GoToMyPC has been hacked, all customer passwords reset

#65

Post by SNvD7vEJ » Sun, Jun 19, 2016, 1:41 PM UTC

magoon wrote: post #49

This is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.

Noticed that too.

If this is what their "security team" recommends, they might need to upgrade the team.

Re: GoToMyPC has been hacked, all customer passwords reset

#66

Post by matt_morgan » Sun, Jun 19, 2016, 1:42 PM UTC

magoon wrote: post #49

This is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.

Yeah, really. They also don't say another important thing, which is never use the same password in two different places. Maybe they think nobody will listen, but after seeing that other dumb advice, I don't have much faith.

Re: GoToMyPC has been hacked, all customer passwords reset

#67

Post by hellomrpeter » Sun, Jun 19, 2016, 1:43 PM UTC

rmdoss wrote: post #48

They don't really say it has been hacked, just that being a target of an advanced password attack. It might mean attackers are using password lists from previous leaks (linkedin), so they decided to force a pass reset to everyone. Or maybe they got hacked. Who knows, not very clear.

True, but wouldn't this apply to any web-service in existence?

Re: GoToMyPC has been hacked, all customer passwords reset

#68

Post by nikolay » Sun, Jun 19, 2016, 1:55 PM UTC

jrockway wrote: post #7

nikolay wrote: post #2

Lame excuses ("a very sophisticated password attack") with no details so that we can estimate the risk.

What risk is there to estimate? Assume that the attackers have the clear text of your password, and know that it's your password.

For example, if the attacker has hijacked the login form, and I haven't logged in years, then I'm not at risk. Details like this can help us make intelligent decisions. It's one thing if they stored in passwords in clear text, another - if they used MD5, and a third thing - if they used SHA1, bcrypt, etc.

We have to know! Piecemealing this shows they are clueless!

Re: GoToMyPC has been hacked, all customer passwords reset

#69

Post by eddyg » Sun, Jun 19, 2016, 1:56 PM UTC

chmars wrote: post #57

K0nserv wrote: post #8

Earlier quoted context omitted.

I use the excellent 1Password, syncing over WiFi with my phone as the source of truth for my vault. 2FA enabled for everything that supports it and backup codes stored physically. Works great and password managers are one of the few times when something is both more convenient and more secure.

Isn't it risky to have your password and your 2FA tokens in the same app, i.e., 1Password in your case?

AgileBits addresses this in a blog post: https://blog.agilebits.com/2015/01/26/totp-for-1password-use...

Re: GoToMyPC has been hacked, all customer passwords reset

#70

Post by eddyg » Sun, Jun 19, 2016, 2:01 PM UTC

chmars wrote: post #58

scrollaway wrote: post #6

Earlier quoted context omitted.

Use a password manager. One strong password per site. https://www.keepassx.org/ Also, use 2FA wherever available. Google Authenticator is good enough. Store your backup codes somewhere safe (your keepass db, for example. Although that goes a bit counter to the point of 2FA, if someone cracks your keepass db, you're pretty screwed regardless).

There is still a major annoyance with Google Authenticator etc.: When you switch your device, you have to set up your 2FA credentials again …

This is not a problem with 1Password, which syncs TOTP keys as part of your secure keychain, making it easy to use multiple devices, or even just your desktop.