Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Stole My Website

medium.com

Post reply on HN
Print view View original

61–70 of 144 posts

Re: Hackers Stole My Website

#61

Post by tedunangst »

toothbrush wrote: post #47
tobyjsullivan wrote: post #28

It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.). So the #1 step to reducing your risk of an attack like this would be setting up 2FA on your email account. The industry standard is password resets via email. If an attacker has access to your email, they have access to every online account you own. Stealing email passwords is easy. So easy. No matter ho…

Yeah so about that 2FA. I have a local email client, which uses IMAP and hence cannot do 2FA. What now? I've always thought this is rather a gaping hole. Of course i use app-specific passwords which presumably won't allow access to webmail or changing the account password, but still, if someone got my app password for IMAP, they could still siphon out password reset emails for all my other services. What do the rest…

If you simply don't use webmail, you're about 99% less likely to accidentally type your password into a website that happens to look like your webmail login page (which doesn't exist).

Re: Hackers Stole My Website

#62

Post by stevekemp »

brianmartinek wrote: post #8
ploggingdev wrote: post #6

> 1. Have a really, really good password, and change it often. Even better, use a password manager. > 2. If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking. Not necessary, use an up to date computer with Win…

I really wish domain registers offered a Google Authenticator option for 2FA. All of the ones I have seen that offer 2FA are SMS based.

Amazon does ..

Re: Hackers Stole My Website

#63

Post by sly010 »

tobyjsullivan wrote: post #54
toothbrush wrote: post #47

Earlier quoted context omitted.

Yeah so about that 2FA. I have a local email client, which uses IMAP and hence cannot do 2FA. What now? I've always thought this is rather a gaping hole. Of course i use app-specific passwords which presumably won't allow access to webmail or changing the account password, but still, if someone got my app password for IMAP, they could still siphon out password reset emails for all my other services. What do the rest…

Depends on your underlying email service provider. If it is gmail, for example, then they provide one-time use passwords for exactly his purpose. What this means is if you enable 2FA for your gmail account, you can generate a one-time password to authorize any client which does not support a 2FA auth flow. This password is then destroyed by both parties. If you run your own email server, I think you are at low risk o…

> This password is then destroyed by both parties.

I don't quite understand this. Won't the email client need the need the password every time to auth with IMAP?

Re: Hackers Stole My Website

#64

Post by x0x0 »

tobyjsullivan wrote: post #28

It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.). So the #1 step to reducing your risk of an attack like this would be setting up 2FA on your email account. The industry standard is password resets via email. If an attacker has access to your email, they have access to every online account you own. Stealing email passwords is easy. So easy. No matter ho…

Except 2fa doesn't work in practice unless you're an expert.

See eg gmail: you can't set up 2fa without supplying a cell (you will be allowed to remove it later, but how many know to do this?) Your phone number is trivially stealable -- see eg youtube video of people just stealing phone numbers with a crying baby and a sob story. https://youtu.be/F78UdORll-Q?t=133

Also, lots and lots of places have trivial routes around 2fa because people losing their password and/or 2fa is an order of magnitude more common than theft.

Re: Hackers Stole My Website

#65

Post by Ajedi32 »

blowski wrote: post #9
_eht wrote: post #4

>3. Turn off your computer and personal devices when they’re not in use. This article reads like an AOL scare from 1995 directed at my grandma.

And yet many people who were born in 1995 are still using crappy passwords, downloading crappy files from crappy sites with no protection. This stuff may be obvious to us, but it seems we're in a minority.

I think the point is that "Turn off your computer and personal devices when they’re not in use." is not an effective security measure. (What are you worried about? Malware? Malware can steal your account just as easily when you _are_ using your computer as when you aren't.)

Some of the other advice in that section is also rather questionable. (E.g. "Your password should not contain “real” words".)

Re: Hackers Stole My Website

#66

Post by et-al »

tdb7893 wrote: post #33
et-al wrote: post #14

Earlier quoted context omitted.

EDIT: If you're going to downvote me, did you even read the article? Also, go look at the submitter's history: https://news.ycombinator.com/submitted?id=vezycash - - - But should it be on the front page of Hacker News? Why did vezycash take the effort to share this when it has little value for the HN audience? The author nevers explain how their domain was stolen, nor do they tell us if the "sting" operation (asking…

I think the mere fact that they leveraged her email to steal her domain is interesting. You generally don't think of a domain as something people steal

Leveraging an email to steal anything is nothing new. If this is arguably a revelation, I should start asking this as an interview question. Also, the author never explicitly mentions to secure your email address.

In the 2000s, domain hijackings were very common (as tedunangst mentioned):

http://www.metafilter.com/3789/Adobecom-gets-hijacked http://archive.wired.com/politics/law/news/2000/04/35674?cur...

Later on, it became short Twitter accounts:

https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...

https://www.wired.com/2016/06/deray-twitter-hack-2-factor-is...

If your metric is how informative an article is, the above two links about Twitter accounts being hijacked are much more educational than original blogpost.

Re: Hackers Stole My Website

#67

Post by et-al »

bittercynic wrote: post #31
et-al wrote: post #14

Earlier quoted context omitted.

EDIT: If you're going to downvote me, did you even read the article? Also, go look at the submitter's history: https://news.ycombinator.com/submitted?id=vezycash - - - But should it be on the front page of Hacker News? Why did vezycash take the effort to share this when it has little value for the HN audience? The author nevers explain how their domain was stolen, nor do they tell us if the "sting" operation (asking…

I think it is valuable to be reminded of the depth of ignorance of even "tech savvy" people.

The author is a lifestyle blogger, not a tech savvy person.

Re: Hackers Stole My Website

#68

Post by defined »

codegeek wrote: post #29
el_benhameen wrote: post #22

Earlier quoted context omitted.

Is there an industry favorite password manager these days? Every time I read something like this I re-commit to getting a manager, but then I can never decide on a product. I just want something that's secure and preferably non subscription-based.

I like keepassx. It just works and no need for any online account. You use a good master key/password and rest of the passwords, don't even remember.

+1 for keepassx. I use it on all platforms (well, keepass droid too). All passwords are randomly generated except the one for the keepassx db (and that also needs the key file).

Re: Hackers Stole My Website

#69

Post by meej »

brianmartinek wrote: post #8
ploggingdev wrote: post #6

> 1. Have a really, really good password, and change it often. Even better, use a password manager. > 2. If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking. Not necessary, use an up to date computer with Win…

I really wish domain registers offered a Google Authenticator option for 2FA. All of the ones I have seen that offer 2FA are SMS based.

Hover supports 2FA with authenticator apps.

Re: Hackers Stole My Website

#70

Post by skylark »

x0x0 wrote: post #64
tobyjsullivan wrote: post #28

It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.). So the #1 step to reducing your risk of an attack like this would be setting up 2FA on your email account. The industry standard is password resets via email. If an attacker has access to your email, they have access to every online account you own. Stealing email passwords is easy. So easy. No matter ho…

Except 2fa doesn't work in practice unless you're an expert. See eg gmail: you can't set up 2fa without supplying a cell (you will be allowed to remove it later, but how many know to do this?) Your phone number is trivially stealable -- see eg youtube video of people just stealing phone numbers with a crying baby and a sob story. https://youtu.be/F78UdORll-Q?t=133 Also, lots and lots of places have trivial routes aro…

Google actually lets you use a physical key to protect your account.

https://support.google.com/accounts/answer/6103534?hl=en&ref...

Post reply on HN