Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card • Hacker News Board

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#341

Post by syshum » Sat, Aug 21, 2021, 1:03 PM UTC

exporectomy wrote: post #217

grishka wrote: post #212

Earlier quoted context omitted.

> It also reflects the non-recoverable portion of the cost to most users And then people wonder why I'm never buying anything digital. That's the reason. Buying digital makes your continued access to the thing dependent on your account being not banned and the servers being up. In other words, even if you "own" it, you're still at the mercy of the seller. But if you bought something on a physical medium (or torrented…

Just think of it as like paying to see a movie. I bought a $10 app once, used it for what it was for, and now several phones later, I don't know or care what's happened to it. I got my value out of it and don't need to hoard every possession I "buy". Remember people who used to have a huge collection of video tapes or CDs? They hardly used them for anything except decoration of their living room. Hoarding old crap th…

So much wrong here

lets start with this

>The world's richest man had half his wealth taken like that

I assume you are talking Bezo's divorce, you might want to actually look into that if you believe that. he did not have half his wealth taken, far far far from it.

>Physical things can readily be taken away in divorces and debt recovery

That is not being "taken away" in the sense you are talking about in context, for debt recovery it is being "taken away" because you did not actually own it, the lender did, you do not own it until you have paid it off. I own my car, that means I have no debt on my car...

Divorce is not "taking away" it is splitting assets owned by multiple parties. Sure the process can been seen as unfair, however legally the assets is owned by both people, the courts then choose who the new owner of the asset is.

That is a far cry from what we are talking about in this context.

>Just think of it as like paying to see a movie.

But it is not, That would be like a Netflix Subscription, where I pay to access content, not pay to own the content. Ownership and Renting is different.

If they want to rent content there are methods to do that, however most people will not pay the prices they charge for a rental that is why they need to guise it as a "purchase" not a rental

>Remember people who used to have a huge collection of video tapes or CDs?

I used mine, then I ripped them (legally) to enjoy them on other technology... Sad you just used them for decoration. Probably should have spent money on something else you found enjoyable

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#342

Post by AkshitGarg » Sat, Aug 21, 2021, 1:11 PM UTC

valid_username wrote: post #155

madars wrote: post #82

Earlier quoted context omitted.

Then that's not TOTP https://datatracker.ietf.org/doc/html/rfc6238 but something different. Do you know how it is called and which products support it? I'd love to read up about it!

Bitwarden has TOTP support in paid plan. And it works with browser extension which recognises domains.

It certainly recognizes the domain, but thats more of a convenience feature than a security feature. Nothing is stopping you from putting your example.com code into legit-example.com manually. Sure the extension won't do it automatically, but if the user is convinced to put the password into the fake website, user could also put in the TOTP code

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#343

Post by AkshitGarg » Sat, Aug 21, 2021, 1:14 PM UTC

recursive wrote: post #15

madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

How is that possible? Codes from authenticator apps I've seen are 6-digit decimal codes. I don't know much about how it works. But I can't see how this is immune from mitm. I pretend to $SERVICE and ask you for your authenticator code. If you fall for it, you'd give me the code, which I can use to impersonate you for the next 30 seconds.

> impersonate you for the next 30 seconds.

AFAIK some websites allow you to use the previous TOTP code for convenience for some more seconds. That makes the total time to impersonate you to be 30 (or whatever was configured while issuing the TOTP secret) plus the grace period websites allow.

Edit: formatting

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#344

Post by jhugo » Sat, Aug 21, 2021, 1:39 PM UTC

sascha_sl wrote: post #312

jhugo wrote: post #310

Earlier quoted context omitted.

Which Google API do you mean? I use advanced protection and have developed various things with various Google APIs, I just use a service account with minimal privileges for each thing I'm developing, which is probably best practice anyway. Not sure about rclone but probably it would work fine with a service account too?

It blocks any unverified OAuth app, including the ones you create yourself.

It sounds like you're trying to use APIs with your personal account rather than using a service account though? Again, I use Advanced Protection and I've never encountered the problem you're describing.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#345

Post by djhworld » Sat, Aug 21, 2021, 1:41 PM UTC

jrockway wrote: post #106

tialaramex wrote: post #69

Earlier quoted context omitted.

WebAuthn (or its predecessor U2F but that's obsolete, so in green field deployments do WebAuthn) is the only practical non-phishable second factor for ordinary users on the web. You can do this two ways, one of which will make more sense for your web site: 1. PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico, the word to Google or type into your preferred hardware source is "FIDO" altho…

> PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico This is actually built into most computers now -- Windows Hello, and Apple has something similar. Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.) > I think some iPhones do facial recognition instead? Yup, they use whatever you use to…

It's built into Apple devices yeah (touch ID) but this is only supported in Chrome and Safari.

Firefox does NOT support Touch ID for webauthn

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#346

Post by someguydave » Sat, Aug 21, 2021, 2:01 PM UTC

int_19h wrote: post #245

someguydave wrote: post #146

Earlier quoted context omitted.

> What is the point of setting up a hardware or Google Authenticator-type 2FA solution when most companies will fallback to SMS? One possible point is that you could still log in somewhere that has internet but no cell service

We have a better way of handling that these days: https://en.wikipedia.org/wiki/Generic_Access_Network

That practically requires wifi. In some scenarios you might have wired internet only.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#347

Post by someguydave » Sat, Aug 21, 2021, 2:05 PM UTC

Marsymars wrote: post #221

cinntaile wrote: post #168

Earlier quoted context omitted.

A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real s…

> It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. I can think of options less extreme than keys gone = account gone that are still very secure.…

Just showing up in person by itself (with a stored photograph and maybe audio recording) is a pretty high barrier.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#348

Post by someguydave » Sat, Aug 21, 2021, 2:06 PM UTC

cinntaile wrote: post #168

someguydave wrote: post #144

Earlier quoted context omitted.

Still sounds like a significant barrier to most phishing attacks.

A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real s…

I presume in this scenario you would have multiple keys and multiple backup accounts, so fallback to a likewise secured account is reasonable.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#349

Post by mark_l_watson » Sat, Aug 21, 2021, 2:16 PM UTC

Just a question: could the author create a new Facebook account and never use it except to login with his Oculus? He would lose his game purchases, though. Once you use a Facebook account with Oculus, is the device not wipeable to factory status?

This guy’s story is why I try to split book and other media purchases between Amazon, Google, and Apple - so, if I lose any account I only lose about 1/3 of my purchases.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#350

Post by bawana » Sat, Aug 21, 2021, 2:50 PM UTC

did he ever say if he found out HOW his account specifically was compromised? There is a lot of discussion here about how SMS is a weak link. But I dont get it. The example of one respondent providedd is koiphish. This is just a MITM attack. Doesnt https protect against this? If a MITM DID worrk, does that mean someone forged/stole facebook's certificate?