Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

221–230 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#221

Post by Marsymars »

cinntaile wrote: post #168
someguydave wrote: post #144

Earlier quoted context omitted.

Still sounds like a significant barrier to most phishing attacks.

A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real s…

> It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone.

I can think of options less extreme than keys gone = account gone that are still very secure.

e.g. To enable "Extra Advanced Protection" you have to visit Google HQ in your region, where your DNA is sampled. If you ever need to recover your account, you have to visit Google HQ again for another DNA sample, after which you're provided with account access, in person.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#222

Post by drivebycomment »

josephcsible wrote: post #45
cinntaile wrote: post #9

Earlier quoted context omitted.

Google is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them your account is gone. No social engineering possible. https://landing.google.com/advancedprotection/

> if you lose them your account is gone IMO, this is way too extreme for almost everybody. There needs to be some sort of happy medium so that a person who's lost everything they own (e.g., house fire) can get their account back somehow still. Two ideas I had: 1. When you set up your account, provide your legal name, date of birth, and a photo. If you need to reset 2FA, go somewhere in person with a government-issued…

Advanced Protection does have the account recovery. https://landing.google.com/advancedprotection/faq/ It is just very slow as it's a human process. There's very little reason you shouldn't use Advanced Protection, if your account is important enough.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#224

Post by betwixthewires »

moolcool wrote: post #188
quickthrower2 wrote: post #187

Earlier quoted context omitted.

Why are we buying this account-linked physical shit. Just pretend the headsets are not a viable product to purchase if they can be remotely bricked by a company you have no leverage over. Get a competitor product or go without.

Do you use a smartphone?

My smartphone cannot be remotely turned into an overpriced wheel chock by someone in a call center.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#225

Post by betwixthewires »

aussieguy1234 wrote: post #175
zmmmmm wrote: post #135

I really think for the Oculus side of this, they should be on the hook for refunding a significant portion of the cost of the user's Oculus library when they ban the account. This would put the cost of a ban to Facebook for real users in the order of hundreds of dollars which is more than enough to have a support person do a realistic evaluation of the situation. It also reflects the non-recoverable portion of the co…

This is not a bad idea as long as Facebook is on the hook for the refunds, not the app developers.

Why?

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#226

Post by Macha »

greggyb wrote: post #103
josephcsible wrote: post #93

Earlier quoted context omitted.

My concern with that is that if something happened to the off-site token (e.g., ESD damage, or even just random failure over time), I may not realize until I needed it.

If you would like to take advantage of such an option, you are also opting in to taking on an operational burden. That burden is exactly maintaining a set of backup keys and testing them on a regular basis.

And that's why "everyone should just use yubikeys" is never going to happen.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#227

Post by BbzzbB »

potatolicious wrote: post #53
unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

> And Facebook refuses so much as to pick up the phone to discuss it. It's part of the business model - each FB user generates so little revenue for the company that you can't afford to offer anything resembling "real" support channels. The company is massively profitable by sheer scale - by making a small amount of money per year off of a vast number of users. This applies to Google as well - or really any ad-based…

~$30/user (on 3.5B users), not exactly small if you ask me. If you do a DCF on a $30/y coupon, even assuming it doesn't grow, you'll find that Facebook's (family of products) individual users are quite valuable.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#228

Post by stjohnswarts »

unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

Facebook likes to cut down on costs by using an AI excuse to say "hey we help customers" but they don't really. If they hired enough humans to handle all the complaints/reports they get then their profit would plummet off the edge of a cliff. If this is the future of AI customer service give me those underpaid offshore services any day. At least the being laughing at me on the other end is still a human.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#229

Post by [deleted] »

dredmorbius wrote: post #202
tibbon wrote: post #108

For those who have worked at Facebook - why in the world are their policies like this? Why is customer support so... unfriendly and unhelpful? No escalations possible? No way to reach anyone?

3 billion active users. If 0.1% have account issues in a year, that's 8,200 support tickets per day. If each of those takes 20 minutes to resolve, then you'd need 115 support techs ... for three shifts, or about 350 total. Oh, and covering several languages. I'm guessing my 0.1% issue rate is low by a factor of 10--100. Resolution time may also be generous. Increase all other values correspondingly.

[deleted]

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#230

Post by quadrifoliate »

mattkrause wrote: post #220
quelltext wrote: post #203

Earlier quoted context omitted.

I always wondered, doesn't that require the clocks to be synchronized? Like, what happens if I set my phone to a different time? What if the server has lost connectivity to an NTP service and its clock is a few minutes off?

In practice, it's not the exact timestamp, down to the millisecond--there's a window of 30 seconds or so for each code. On top of that, some services will also accept one of the last (or next) few valid codes too. So it needs to be roughly synchronized, but not impractically so. Some systems have some extra magic that allow the server to adjust for each device's clock skew; this was particularly important for hardwar…

In addition to this, it's worth mentioning that the two sides can go out of sync, and if so, there are ways to fix that.

The TOTP implementation for AWS logins is particularly prone to doing this for some reason, and you have to enter simultaneous TOTP codes to resync.

Post reply on HN