Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

101–110 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#101

Post by rsync »

breakingcups wrote: post #71
rsync wrote: post #66

In other news, I built and deployed a "2FA Mule" last weekend. It's a stock android phone with no google account and no apps installed except for "SMS Forwarder"[1]. It is configured to forward all SMS to an email address via encrypted SMTP. This means that I can receive these 2FA codes anywhere I have Internet access - such as an airplane or newly arrived in a foreign country where my SIM card does not work. The "2F…

So the email address is not 2FA secured?

It's my own mail server. I just tail the mail spool ...

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#102

Post by [deleted] »

madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

[deleted]

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#103

Post by greggyb »

josephcsible wrote: post #93
jaywalk wrote: post #73

Earlier quoted context omitted.

If you choose to opt-in to Advanced Protection, you can keep a backup hardware token somewhere outside of your house.

My concern with that is that if something happened to the off-site token (e.g., ESD damage, or even just random failure over time), I may not realize until I needed it.

If you would like to take advantage of such an option, you are also opting in to taking on an operational burden. That burden is exactly maintaining a set of backup keys and testing them on a regular basis.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#104

Post by cwkoss »

Facebook's walled garden around oculus is really disappointing. Updates frequently broke mods, and the last time I tried to get it working again my Quest got bricked. Need to try factory resetting or something to see if I can get it working again, but it's left such a bad taste in my mouth I'm considering just selling it instead and buying a better VR system.

The only people I've heard have positive experiences with the Quest either:

- haven't had it for very long, or

- use Virtual Desktop or sideloading to break out of the walled garden. And are willing to frequently repair the issues that arise after frequent breaking updates.

I predict that gap in the fence will closed off and non-Oculus Store games will no longer work within the next two years and Quests will be junk. Please consider other options if you're thinking about buying oculus.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#105

Post by dheera »

cortesoft wrote: post #90
dheera wrote: post #84

Earlier quoted context omitted.

Nice. I do something similar but forward it to Slack. I also have it auto-answer 2FA calls and automatically hit the # key. Yeah, call it not real 2FA, but it's really companies that choose to not use U2F are at fault.

U2F is great, but these companies want to be able to provide 2FA for people who won’t/can’t have a dedicated hardware device for 2FA.

Yeah but (a) by not supporting U2F they suck (b) I don't want them to use 2FA as a magic excuse to get my phone number

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#106

Post by jrockway »

tialaramex wrote: post #69
baxtr wrote: post #48

Earlier quoted context omitted.

Could you describe the types that are non-phishable?

WebAuthn (or its predecessor U2F but that's obsolete, so in green field deployments do WebAuthn) is the only practical non-phishable second factor for ordinary users on the web. You can do this two ways, one of which will make more sense for your web site: 1. PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico, the word to Google or type into your preferred hardware source is "FIDO" altho…

> PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico

This is actually built into most computers now -- Windows Hello, and Apple has something similar. Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.)

> I think some iPhones do facial recognition instead?

Yup, they use whatever you use to unlock your phone. So if it's a FaceID phone, you can use FaceID to log in. You can also hold up your NFC Yubikey to the back of the phone and use that, even if you registered the key over USB on a PC! It's really, really good.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#107

Post by aj3 »

tialaramex wrote: post #69
baxtr wrote: post #48

Earlier quoted context omitted.

Could you describe the types that are non-phishable?

WebAuthn (or its predecessor U2F but that's obsolete, so in green field deployments do WebAuthn) is the only practical non-phishable second factor for ordinary users on the web. You can do this two ways, one of which will make more sense for your web site: 1. PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico, the word to Google or type into your preferred hardware source is "FIDO" altho…

And of course client side certificates. It's a pity they are rarely available as an option on public websites.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#109

Post by ballenf »

kbenson wrote: post #81
cs2733 wrote: post #36

Earlier quoted context omitted.

Companies like Facebook are as big as Nation States. Any positives that come out of this for the author are just a Facebook PR move. If they did care about users, their support system wouldn't be so anti-user.

It's trite at this point that someone will respond that the users aren't the customers, they're the product, but it's trite because it's often correct, and deserves to be said, so I guess I'll be the one to say it this time. The sad thing is that this person actually is a customer because they bought a product and pay for things on it, but Facebook still doesn't realize that, or more likely these customers are such a…

> this person actually is a customer

That's the reason the "you're not the customer" line is just a distraction.

It totally misses the point that Facebook doesn't have customers any more than any other first world power has. Facebook has treaties with governments and follow laws when it's less costly than breaking them.

FTC actions are like one country taking another to the WTO -- not something to ignore, but not really threatening either.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#110

Post by optymizer »

tomhallett wrote: post #95

I had someone contact me on Facebook marketplace, we agreed upon a time/price and then they asked for my phone number (which I sadly gave them). Then they said "I'm going to text you a code, so I can verify you are legit". The text I got was from Google Voice's 2FA.....

How would someone use that code to hack into my GV account? Wouldn't they also need to know my password or have access to my e-mail account to login or to reset your password?
Post reply on HN