81–90 of 138 posts
Is this reset mechanism conceptually flawed? Even with one attempt before invalidating the code, you have a 1:999,999 shot of stealing someone's account by lotto. Not bad odds for an automated process. It's like every account on Instagram has an alternative six digit password.
Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…
Also for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use. Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies o…
The user will need to use a different way to authenticate if they can't enter the correct code in 5 tries
Why do they not lock the account after n number of tries say 5? The user will need to use a different way to authenticate if they can't enter the correct code in 5 tries
[Obvisouly, there are ways just easy to screw up]
Earlier quoted context omitted.
> Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? This could makes it very easy to perform a DOS attack against a user. You could constantly send failed attempts and make it impossible for the user to type in the real code before you invalidate it.
Add a captcha then.
Earlier quoted context omitted.
You probably get access to at least one of them, not definitely
There is a 36.7%(or ~1/e) chance that you don't get any of them.
Earlier quoted context omitted.
He didn't really explain it, but I think what was going on is the rate limiting is done per account, and the race condition was a way to circumvent that. He has to make all the requests very quickly because the first thing all the requests are doing is determining if new requests for this account should be ignored. All the requests are received around the same time, they all make this check and decide they are valid…
I think you are dead on, yeah it’s the quick rate of large numbers of requests that avoid the per-account rate limiting. Curious how they resolved this— run all authentication requests for a given user serially and in a consolidated fashion at some point. Exclusive lock the relevant db record before checking the code and recording the failure?
Earlier quoted context omitted.
I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself
you should be aware that Authy can by default be taken over with just your sim card. I believe with the right settings you can disable this behaviour
I quite recently learnt about “Residential proxies”, for a scraping idea I had. Seems like that can be useful for attacks like this. It’s surprisingly cheap to get access to services which fan out your requests over millions of normal residential IPs, making them (I assume) hard to block. Of course their use can be highly objectionable, as well as how they got the proxies installed in homes of people in the first pla…
This has to be provided by a botnet or some other malware, right? They claim 30M residential IP addresses.. How would this be done otherwise? There's no info on the site about "signing up" to be a proxy, just about using them..