GoToMyPC has been hacked, all customer passwords reset • Hacker News Board

Re: GoToMyPC has been hacked, all customer passwords reset

#91

Post by [deleted] » Sun, Jun 19, 2016, 2:59 PM UTC

0xmohit wrote: post #45

edent wrote: post #20

Earlier quoted context omitted.

A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…

> I use https://lastpass.com/ for generating passwords. ... Would prefer open source, but nothing else comes close. On a linux/unix system, one could use /dev/urandom: tr -dc '[[:alnum:][:punct:]]' would generate a 16 character long password . One could even put the following function in $HOME/.bash_profile or such genpw() { tr -dc '[[:alnum:][:punct:]]' Now invoking it by saying genpw would generate a pseudorandom s…

[deleted]

Re: GoToMyPC has been hacked, all customer passwords reset

#92

Post by robotmlg » Sun, Jun 19, 2016, 3:00 PM UTC

lukasm wrote: post #47

acmecorps wrote: post #31

Earlier quoted context omitted.

Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.

How do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?

Gmail doesn't need any config. Add whatever you want to your usual email after a + and it'll just work

Re: GoToMyPC has been hacked, all customer passwords reset

#93

Post by sandworm101 » Sun, Jun 19, 2016, 3:05 PM UTC

hackuser wrote: post #78

magoon wrote: post #49

This is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.

> This is not a good suggestion on their part, and has long been proven ineffective: Agreed; that is bad advice. I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g.,…

But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed.

(And yes, by putting it out there I realize it is now a bad password.)

Re: GoToMyPC has been hacked, all customer passwords reset

#94

Post by voltagex_ » Sun, Jun 19, 2016, 3:07 PM UTC

sandworm101 wrote: post #93

hackuser wrote: post #78

Earlier quoted context omitted.

> This is not a good suggestion on their part, and has long been proven ineffective: Agreed; that is bad advice. I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g.,…

But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

Re: GoToMyPC has been hacked, all customer passwords reset

#95

Post by vitno » Sun, Jun 19, 2016, 3:16 PM UTC

voltagex_ wrote: post #94

sandworm101 wrote: post #93

Earlier quoted context omitted.

But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

There are a lot more words in the dictionary than letters.

Re: GoToMyPC has been hacked, all customer passwords reset

#96

Post by DerfK » Sun, Jun 19, 2016, 3:17 PM UTC

voltagex_ wrote: post #94

sandworm101 wrote: post #93

Earlier quoted context omitted.

But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

The question is whether people are all going to pull words from a very small pool or form sentences to cut the search space (adjective noun adverb verb noun). A search space of 2000^5 (2000 most common words without punctuation) is still about 20 times larger than 80^8 (upper/lower/number/symbols)

Re: GoToMyPC has been hacked, all customer passwords reset

#97

Post by mcpherrinm » Sun, Jun 19, 2016, 3:27 PM UTC

_asummers wrote: post #89

hackuser wrote: post #82

Earlier quoted context omitted.

> It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Very few users can run their own web servers. We used to deploy GoToMyPC for users; it was reliable, performed well, platform independent (including mobile), and secure. I expect it still is. When the new OS or other new tech came out, GoToMyPC handled…

> optional one time pads Any good reason why this wouldn't be the default? Speed + key exchange transmissions, maybe?

One time pads are rarely useful: The key is as big as the data, so you need a secure channel to transmit the key. If you had that channel, why not just transmit the data over it?

Re: GoToMyPC has been hacked, all customer passwords reset

#98

Post by sandworm101 » Sun, Jun 19, 2016, 3:28 PM UTC

voltagex_ wrote: post #94

sandworm101 wrote: post #93

Earlier quoted context omitted.

But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

Five or six words is a huge amount of entropy. In reality there are other rules in my example than just using words. It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. And it of a random length, having taken its length from my selection of words rather than from any fixed policy. Few services accept random lengths but imho all should.

There is a great scene in DoctorWho where a door password is a series of concepts (spoken mentally) that one thinks about in a particular order. Fiction, but the person writing that scene knew a thing or two about password complexity.

Re: GoToMyPC has been hacked, all customer passwords reset

#99

Post by dellsystem » Sun, Jun 19, 2016, 3:32 PM UTC

voltagex_ wrote: post #94

sandworm101 wrote: post #93

Earlier quoted context omitted.

But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

The number of possible letters is much, much smaller than the number of possible dictionary words. The latter would take many orders of magnitude longer to brute force, which would make it unfeasible.

Re: GoToMyPC has been hacked, all customer passwords reset

#100

Post by bronson » Sun, Jun 19, 2016, 3:34 PM UTC

mistersquid wrote: post #90

chmars wrote: post #56

Earlier quoted context omitted.

I am switching away from unique mail addresses … I used a mix of catch-all and plus characters: The former reduces the efficiency of your spam filter, the later is not (fully) supported by many websites. AirBnB for example allowed me to set an mail address with a plus character, however, login did not work anymore, so I was locked out and had to create a new account … AirBnB support refused to change my mail address…

Add grep whitelist to your spam filter for some arbitrary extension, e.g. a tld such as '.com'. This way the address can be some-web-app.somecompany.com@yourdomain.tld, you can whitelist *.com@ (or higher up on the subdomain if necessary). Not sure if this would maintain the efficiency of your (or any) spam filter, but it does avoid the '+' character.

In my experience adding the domain of the recipient often leads to problems.

  Rep: "Can you verify your email address?"
  Me: "er, em-verizon@example.com"
  Rep: "Hey, I didn't know you worked for Verizon!"
  Me: "no..."

And now the call gets excruciatingly slow and unfriendly because the rep thinks I'm trying to hack something.

Also, more than one web forum has silently binned me until I removed the domain from my email address. Had one where I could post for a few days, then the admin deleted me and sent that email address a crazy anti-spam rant thinking I was a bot.

I still like using unique email addresses but I make sure they're obscure.