81–90 of 148 posts
Ouch! Also, PayPal really needs to stop using SMS for 2fa. I expect more from a payment processor that is linked to my bank account.
Agreed, NIST stopped recommending SMS 2FA a few months back ( https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo... ) I really wish they had Google authenticator or Yubikey support.
I have a "Symantec VIP" co-branded Yubikey that I've used with PayPal for years along with an authenticator app on my phone as a fallback.
This is scarily simple. Profit indeed for a black hat. Coupled with a recent post about Gmail on how phone carriers are the weakest link, I just don't feel safe with anything but a dongle based 2fa these days.
Unless the master key is compromised allowing anyone to generate authenticator codes, as I seem to recall happened a few years ago with a major provider.
Earlier quoted context omitted.
Great point. "correct horse battery staple" wouldn't be vulnerable to such an attack.
But it must be said that GPU evolution, and that password cracking software developers are naturally going to go where the passwords are, that this type of simple password design does NOT work anymore.
Earlier quoted context omitted.
But it must be said that GPU evolution, and that password cracking software developers are naturally going to go where the passwords are, that this type of simple password design does NOT work anymore.
They are suggesting it for a security answer, especially one you give over the phone to tech support, NOT a password.
Earlier quoted context omitted.
Yes, having something readable (and "believable") is more useful and secure than having to rely on saying a random string Just put "Plymouth Creek High" (Not to mention the possibility that some "security genius" will ban special characters on those answers)
Generally what I do is put something tangentially related to the question. For example, "What's the name of your high school?" would be answered with something like "Khan Academy" (the name of a site that helped me) or "Mr. Jefferson" (A teacher, or best friend)
The simplicity of this exploit demonstrates something profound. The most dangerous things in life are not hidden deep in the weeds. Rather, they stare us in the face in the most obvious spots. It isn't the unknown that presents the biggest threat. It is the known that we never gave a second look.
The cardinal rule of security is: you never, ever, trust anything the client sends . This bypass is a perfect example. Although author doesn't mention which interception proxy he used, I'm 99% sure it was Burp. Replaying modified content is trivial.
This is surreal. Does PayPal outsource their web development to an anonymous script kiddie on 4chan?
Am I the only one who found it odd that the author had internet access, but there was no phone signal? Maybe it's because I'm Kenyan, where phone penetration is much higher than internet penetration, and where internet access over GSM has the biggest share of the internet access pie chart.
Earlier quoted context omitted.
Great point. "correct horse battery staple" wouldn't be vulnerable to such an attack.
But it must be said that GPU evolution, and that password cracking software developers are naturally going to go where the passwords are, that this type of simple password design does NOT work anymore.