Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoToMyPC has been hacked, all customer passwords reset

status.gotomypc.com

Post reply on HN
Print view View original

71–80 of 171 posts

Re: GoToMyPC has been hacked, all customer passwords reset

#71

Post by scrollaway »

Yhippa wrote: post #63
chmars wrote: post #58

Earlier quoted context omitted.

There is still a major annoyance with Google Authenticator etc.: When you switch your device, you have to set up your 2FA credentials again …

This is why I now use SMS authentication.

Not only do you get the same issue with SMS authentication (have to set it up again when you get a new number), but on top of it SMS auth is not as readily available and has proprietary requirements (namely, you have to have a mobile number with text support, it has to be available at your current location, it may cost money, the auth service has to support whichever country code you're under, ...).

Also, as other people mentioned, it's technically possible to back up your initial seed.

SMS auth is a disgrace, when we have 2fa standards.

Re: GoToMyPC has been hacked, all customer passwords reset

#72

Post by lukasm »

jagermo wrote: post #13
wsr wrote: post #3

As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!

I'm using LastPass with a 2FA Yubikey token. In addition, I try use different E-Mail adresses whenever I sign up, a catchall makes sure they end up in the same inbox. This might not stop a sophisticated targeted attack, but it should throw off a lot of automated runs since the email they got is seemingly not used at another service. A litte obscurity to strengthen the rest of my security ;)

Do I need premium account to use Yubikey? What happens if you lost the Yubikey?

Re: GoToMyPC has been hacked, all customer passwords reset

#73

Post by mpnordland »

swiley wrote: post #30
Hondor wrote: post #26

It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.

I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out…

pagekite.net is another great option for ssh and http tunneling.

Re: GoToMyPC has been hacked, all customer passwords reset

#74

Post by K0nserv »

chmars wrote: post #57
K0nserv wrote: post #8

Earlier quoted context omitted.

I use the excellent 1Password, syncing over WiFi with my phone as the source of truth for my vault. 2FA enabled for everything that supports it and backup codes stored physically. Works great and password managers are one of the few times when something is both more convenient and more secure.

Isn't it risky to have your password and your 2FA tokens in the same app, i.e., 1Password in your case?

That's my opinion and that's why I have my 2FA tokens in a different app. Still on the same device which might not be the best.

Re: GoToMyPC has been hacked, all customer passwords reset

#75

Post by danellis »

kichuku wrote: post #51

What worries me is that this product is owned by Citrix. Our company uses other products by Citrix extensively like GoToMeeting, Citrix applications etc. And if those products get compromised, then it will be a huge enterprise level financial loss.

I used to work on the security team at Citrix. It's a very competent team that does proactive security auditing, threat modeling, pen testing and developer training as well as response.

However, the "Go To" products (until a year or two ago) were part of Citrix Online, which operated independently of the rest of Citrix.

So I don't see this as a reflection of the security of Citrix's core products.

Re: GoToMyPC has been hacked, all customer passwords reset

#76

Post by lukasm »

chmars wrote: post #55
tmat wrote: post #39

Earlier quoted context omitted.

Can't recommend Ngrok enough... saved my bacon and makes testing on devices so easy and painless.

Hasn't Ngrok the same security risks as GoToMyPC?

Nope. With Ngrok you don't type password on the website. No xss, csrf etc

Re: GoToMyPC has been hacked, all customer passwords reset

#77

Post by walrus01 »

Hondor wrote: post #26

It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.

In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router.

One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set up an SSH tunneled setup, and want something to "just work" through NAT.

My setup looks something like this, with public/private key SSH auth. Copied and pasted from my notes, hostnames and IP addresses redacted:

-------

I have a static /30 and forward port 445 on the external side of my home router, through the NAT to port 22 on the workstation PC in my rfc1918 IP space.

workstationhostname.domainname.org normally has vnc session listening on port 5901 localhost only, spawned with:

vnc4server -geometry 1920x1200 -localhost

This is for use with an SSH tunnel coming from hostname.ofmy.static.slash30.org:445 through NAT to workstationname.rfc1918.ip.address port 22

To access from the outside world, on the client, do the following:

    ssh -v -L 5901:localhost:5901 -N -f -l myusername -p 445 hostname.ofmy.static.slash30.org

    use client system's vnc client software to connect to 127.0.0.1:5901
To access from inside the LAN, on the client, do the following:

    ssh -v -L 5901:localhost:5901 -N -f -l myusername -p 22 workstationname.rfc1918.ip.address 

    use client system's vnc client software to connect to 127.0.0.1:5901

Re: GoToMyPC has been hacked, all customer passwords reset

#78

Post by hackuser »

magoon wrote: post #49

This is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.

> This is not a good suggestion on their part, and has long been proven ineffective:

Agreed; that is bad advice.

I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g., AmeriKa), patterns on your keyboard, etc.

In a more technical sense, that applies to tricks that can be defeated with an algorithm and affordable computing resources.

Re: GoToMyPC has been hacked, all customer passwords reset

#79

Post by ethbro »

matt_morgan wrote: post #66
magoon wrote: post #49

This is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.

Yeah, really. They also don't say another important thing, which is never use the same password in two different places. Maybe they think nobody will listen, but after seeing that other dumb advice, I don't have much faith.

I've never used it, but assume it's TeamViewer-esque?

From the quote on their front page, assuming their target audience is of the "mycat00" at the best variety.

Re: GoToMyPC has been hacked, all customer passwords reset

#80

Post by zeta0134 »

walrus01 wrote: post #77
Hondor wrote: post #26

It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.

In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router. One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set…

If you're on a Windows system this is even easier.

Go to System -> Remote Desktop Connections and check the box to enable incoming connections.

On your router, forward port 3389 to the machine you want to access.

On any client device running Windows (linux/mac can use FreeRDP, for which there are numerous wrappers) connect to your home's Public IP, and log in with your computer's usual username and password.

For the average home user this is all the setup that's needed, and it doesn't involve handing over your computer's security to a third-party company that is now a giant target for these sorts of attacks. :)

I think the big advantage that LogMeIn and GoToMyPC have in the casual realm though is their simplicity. In particular, they entirely dodge the need for the user to know anything technical at all, including port forwarding on the router, which is the bigger technical hurdle here. You just install their program and it does the rest for you. Port forwarding seems like child's play to you or me, but they have a huge market in folks who didn't even know you could log into your router and change settings. Or that even know what a router is, despite owning one.

Post reply on HN