Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber investigating breach of its computer systems

nytimes.com

Post reply on HN
Print view View original

171–180 of 327 posts

Re: Uber investigating breach of its computer systems

#171

Post by 3np »

j1elo wrote: post #148
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

Just plug your recovery key in a backup server on a network you have physical access to and expose ssh port as a tor hidden service (optionally with onion client auth if you're paranoid)? Either way as long as you have backup keys that don't involve biometrics you can set up your own infra for that as you see fit.

But yeah, the face whatevers really must not be the only option.

Re: Uber investigating breach of its computer systems

#172

Post by milkshakes »

cyral wrote: post #108
monocasa wrote: post #105

Earlier quoted context omitted.

For the most part, none of that matters client side. The web client side is mainly just a passthrough to your backend that'll do the actual processing of those binary blobs other than for example code.

I see, if all that is server side then it makes a lot more sense as I assume backend libraries will get created to handle this for various languages. Bookmarking it to check it out later when I have time to read it all, hopefully it isn't as daunting as it looks.

https://simplewebauthn.dev/docs/

Re: Uber investigating breach of its computer systems

#173

Post by madeofpalk »

traceroute66 wrote: post #159
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> So if your workplace is letting you authenticate with SMS codes There's an old saying in photography, "the best camera is the one you have with you". IMHO its very much the same thing with 2FA. Any 2FA is better than no 2FA. Sure some 2FA options are more secure than others, but by the same token, there's also a scary number of websites out there that have zero 2FA options. Others make it inordinately difficult to…

That's like saying MD5 is fine for hashing passwords, because it's better than plaintext.

Re: Uber investigating breach of its computer systems

#174

Post by berdario »

j1elo wrote: post #148
sullivanmatt wrote: post #7

I think it's worth repeating: at this point, MFA that is not based on Webauthn ( https://webauthn.guide/#about-webauthn ) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we'll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus ca…

> you need to start banging on pots and pans up your reporting chain to get your security team Not sure how Webauthn works, but as long as it can be stored in the cloud, I'm fine. Industry is going towards this scheme of physical 2FAs that assume some living conditions appropriate for whoever designs things, without alternatives for people who don't fit that ideal way of doing things. Physical stuff gets lost or stol…

> ...or whatever, and need the damn TOTP code to telework _right now_.

Do you? Really?

"Your lack of planning is not my emergency"

Unless you're the founder+owner, I'd expect that tech support at your company wouldn't expedite your access request just because you feel entitled to it.

Will a million dollar sales call fail and/or have to be rescheduled because you didn't have 2FA access? You should accept the responsibility, apologise with whoever it is that you let down and move on.

Of course, companies should give us all the tools we need to succeed. Not cheap out on their budget and then shift the blame on us. This means also giving you multiple devices and tokens, to ensure that you have redundancy (if a device fails you have a backup, if you lose a token you have a backup).

Even then, it can happen that right after a trip you might've realized that you left home and/or misplaced your security token. The professional thing to do is to communicate it to the company right away (so they can arrange to verify your identity and/or to ship something to you) once you discover it when you land. Not ignore the problem until you'd be back at work and in urgent need to attend some work meeting.

Travelling across the world, 6 time zones away is not something that you can do with every job. If your company allows it, that's a perk, but you should also treat it with the due care that requires.

Missing a day of work is small stuff compared to the risk that the whole company runs by allowing their employees auth to be phished. If you have to skip a day (or more!) of work on extremely short notice, it might be an unpleasant conversation with your manager, but it's a conversation that you should have nonetheless. (btw, do you have the phone number of your manager on your personal phone? if you lose your work devices, it's important to still have a way to reach out to them).

Security tokens are cheap, just make sure that you have N+1 (one for each device you need, plus one)

Re: Uber investigating breach of its computer systems

#175

Post by acdha »

judge2020 wrote: post #82
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

To add, Chrome currently supports webauthn using your phone via BLE. When you try to enroll/sign in, if you click 'add an android device', that QR code will also work in the iOS camera app and allow you to use icloud to store & log in with that security key. The only real requirement here is a browser support and a desktop with bluetooth, something not super common on gaming / custom built PCs until a few years ago.

Apple did something similar: you can login using your phone’s WebAuthn credentials if you’re in BLE range. The main problem is that it’s Safari-only but the passkey spec should allow Firefox to implement it.

Re: Uber investigating breach of its computer systems

#176

Post by acdha »

dx034 wrote: post #140
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

Recently my phone broke and it took a day to get a new one. I was so glad to have my 2fa codes somewhere else as well. I'd never want to rely solely on one device for access to everything. Apples plan is that I need to own several Apple devices for that, this is a non-starter for me.

Your backup plan currently can be hardware devices (a $20 Yubikey works great) or printed codes. When vendors other than Apple ship passkeys, that should extend to include other devices.

Re: Uber investigating breach of its computer systems

#177

Post by acdha »

zinekeller wrote: post #139
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

> That last part is important because AWS has a huge barrier: the number of MFA devices you get is one, which means you either need insecure things like synced TOTP seeds or you have to be comfortable never losing your Yubikey. I have been asking our TAM to prioritize fixing that for years so backups can be a real thing. Actually, can we mark AWS as insecure? Seriously, it was a bother at the time it was rolled out b…

No – the problem here is really the reverse: they limit the number of devices which can gate access to your account, on the theory that you'll handle a breach by contacting them. That's theoretically more secure but slower.

(Non-root MFA can be reset by another admin or root so this is most of a concern for the root account)

Re: Uber investigating breach of its computer systems

#178

Post by uselpa »

technion wrote: post #89
beardedwizard wrote: post #44

(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed her…

An underlying issue is that Microsoft Active Directory does not support MFA of any kind at all. That's why third party PAM vendors exist, but they don't really change the fact that you the most widely deployed authentication service in business is effectively run by password hashes. That's the whole reason we so commonly see the "mimikatz scraped a hash from RAM and it was all over" write up in incidents. Smartcards…

Worse: un-salted hashes.

Re: Uber investigating breach of its computer systems

#179

Post by traceroute66 »

madeofpalk wrote: post #173
traceroute66 wrote: post #159

Earlier quoted context omitted.

> So if your workplace is letting you authenticate with SMS codes There's an old saying in photography, "the best camera is the one you have with you". IMHO its very much the same thing with 2FA. Any 2FA is better than no 2FA. Sure some 2FA options are more secure than others, but by the same token, there's also a scary number of websites out there that have zero 2FA options. Others make it inordinately difficult to…

That's like saying MD5 is fine for hashing passwords, because it's better than plaintext.

> That's like saying MD5 is fine for hashing passwords, because it's better than plaintext.

No, I'm saying we need to come down to planet earth and recognise we live in the real world. Hence SMS or TOTP is preferable to nothing at all.

Its a bit like the hardcore open-source types who can't see the wood from the trees and cannot fathom why anyone would possibly want to use anything else other than Linux and fully open-source alternatives to Microsoft Office or Photoshop. Sometimes you have to compromise.

Re: Uber investigating breach of its computer systems

#180

Post by acdha »

staticassertion wrote: post #92
acdha wrote: post #66

Earlier quoted context omitted.

> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device. Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still ha…

Regarding AWS, it's truly insane that they only support 1 device (breaking from the FIDO2 recommendation) but you can also put AWS behind SSO, and then have 2FA on the SSO.

This predates FIDO2 by at least a decade. SSO works great for everything except the root account, where you really do just need to lock it up tightly and make sure you know how to authenticate to support in a disaster.
Post reply on HN