Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

371–380 of 807 posts

Re: Ask HN: Gmail account security

#371

Post by kyboren »

sascha_sl wrote: post #168
miles wrote: post #73

Earlier quoted context omitted.

Fastmail looks great, but having "Get the email features you need, without giving up your privacy" and "Your data is always private" at the top of their homepage while knowing full well that is far from the case[0,1] seems disingenuous. [0] FastMail loses customers, faces calls to move over anti-encryption laws https://www.itnews.com.au/news/fastmail-loses-customers-face... [1] Goodbye FastMail https://www.ctrl.blog/…

You are never safe from these shenanigans, not in Switzerland and not in Germany. If you absolutely must have email out of the hands of low to mid grade government entities you need to implement the technical solutions yourself. If you want more, just forget it, if they want your mail they'll just get it at your endpoint anyway. (also, "most email is unencrypted in transit" is a very out of date take, I've checked al…

> If you absolutely must have email out of the hands of low to mid grade government entities you need to implement the technical solutions yourself.

Very off-topic, but this is exactly the most important and consistently underappreciated angle to the Hillary Clinton email server scandal. She deliberately designed her team's communications infrastructure to be maximally resistant to legal process.

I don't want to make this political, it just bugs me that media coverage--regardless of political slant--always seems focused on irrelevant details and ignores what (arguably) makes it an actual scandal.

Re: Ask HN: Gmail account security

#372

Post by 1vuio0pswjnm7 »

parhamn wrote: post #187
bpye wrote: post #176

Earlier quoted context omitted.

Wow, that's awful. I wonder who's idea it was? Is it doing anything more than checking user agent (trivial to spoof), because if not that seems entirely hostile.

It's not just the user-agent, it is definitely doing non-trivial fingerprinting (both linked projects also had UA mitigations before). We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them.

"We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them."

First thing I do when creating a new Gmail account, using a "supported" browser, is to save the required parameters of the cookie in a text file then convert the file to a simple shell script, powered by netcat and TLS proxy. This only takes me takes seconds. Then I close the supported browser without logging out. The word "sketchy" seems applicable because unlike, e.g., a bank website, companies like Google and Facebook will let users stay "logged in" for some ridiculously long period like one year. Yikes.

Two ways to disable the script are 1. log out of that session (://mail.google.com/mail/logout?ec=ABCDEF, ://accounts.google.com/Logout?service=mail&continue=https://mail.google.com/mail/, ://mail.google.com/accounts/ClearOSID) or 2. change the password.

This tiny script can be transferred to any computer and used to check and send mail from the command line. No browser, Javascript or password required.

Netcat, the browser of the future! :)

Re: Ask HN: Gmail account security

#374

Post by Semaphor »

taxyz23 wrote: post #334
goodlinks wrote: post #259

Earlier quoted context omitted.

To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transactio…

U2f key ? Works for me.

I always wonder, are there banks using U2F/Fido(2)/Webauthn or whatever it’s called now? I’m reasonably certain not in Germany, but is there one in another country?

Re: Ask HN: Gmail account security

#375

Post by ttty »

armchairhacker wrote: post #79

This is because most people use Gmail for basically all their online accounts: if you don't directly login to the site via Gmail, you can use your account to change your password. Imagine the damage which can be done if a malicious user breaks into someone's Gmail, if not your own, then the average person who uses the same password everywhere and trusts Gmail with everything. Not defending the practice at all. It sho…

No post body was provided.

Re: Ask HN: Gmail account security

#377

Post by Semaphor »

nextos wrote: post #277
jounker wrote: post #248

Earlier quoted context omitted.

Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.

That's interesting. What 2FA system do they use exactly? AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.

N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?

Re: Ask HN: Gmail account security

#378

Post by Semaphor »

cassepipe wrote: post #111
xvector wrote: post #107

Earlier quoted context omitted.

The amount of trust that providers put in phone numbers is absolutely insane.

Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)

I was thinking that, when I tried to enable 2FA on Twitch. Allegedly, they support TOTP. But only after verifying your phone number. And they even check that it’s a mobile number (I tried using a VoIP number that can receive SMS).

Re: Ask HN: Gmail account security

#379

Post by Spooky23 »

fleddr wrote: post #174
zenexer wrote: post #77

Earlier quoted context omitted.

I have 2FA and a recovery email on my Gmail account, yet I have run into this issue. If Google thinks something is suspicious, it will decline your 2FA codes and recovery attempts—it will just tell you that you entered the wrong code. Only after you finally get back in do you find an email in your inbox explaining that the correct code was entered, but Google blocked it because it was suspicious. This happens to me f…

If we reason from good faith and consider that this is intentional and not a bug, have you considered that Google did not implement "blocking suspicious 2FA" just to mess with you? That perhaps this deals with a very real threat? Google has no incentive to make it difficult for you to log in, it's the exact opposite.

It’s definitely a point that should be made. Typical TOTP tokens are weak MFA in takeover scenarios. Especially considering that people have a bad habit of syncing them between devices.

What a lot of the grumpy posters here probably aren’t mentioning is that many ate probably doing high risk signal stuff like running through public VPNs. Google and Microsoft know a lot about what you are doing and what scammers do. They score risk accordingly.

Re: Ask HN: Gmail account security

#380

Post by kadoban »

drzaiusapelord wrote: post #370
kadoban wrote: post #351

Earlier quoted context omitted.

> Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone." The first part of that shouldn't be true. I've used mine to receive all kinds of SMS and it always works fine _except_ for the services that just won't accept the number. Only run across maybe one or two of those, over some years. For SMS from real peopl…

What happens is some organizations run a verifying to see if its a VOIP number, and if it is, considers it invalid for SMS based 2FA, and other authentication, presumably to stop hackers. Some big names use these lists, most notably Zelle to transfer money. Discord as well. Why Google also seems to block incoming SMS from Microsoft Authentication and others is beyond me. Maybe MS isn't sending because it doesn't cons…

That's really weird. Ya the VOIP thing I've experienced. I don't think I've ever found a company that actually tried to send sms my way and it failed though. Maybe just luck, I don't happen to use any of those companies you mentioned.

Anyway, yeah that's lame. I'm personally abandoning ship from Google Voice myself anyway, but for other reasons.

Post reply on HN