Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

61–70 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#61

Post by brigade »

durin42 wrote: post #38
alttag wrote: post #35

Earlier quoted context omitted.

On the contrary, for a great many sites (low impact) I'm happy that they finally figured out to use my email address as a username. As a usability feature, it's much nicer than having to guess at whether my standard usernames are taken.

There are many problems with this. Among them that I have some iTunes purchases associated with an email account that hasn't existed in /years/. There's no way to rename an Apple account. This same problem exists on most sites that use email as username - if your email address of choice ever changes, you're SOL on having a single identity anymore.

You can change your primary email address, renaming the account, at http://appleid.apple.com

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#62

Post by [deleted] »

adgar wrote: post #24
cubicle67 wrote: post #16

Earlier quoted context omitted.

the weakness with 2-factor auth is that almost all of us with a smartphone use that phone for email. And that phone is the same one google sends the sms to...

Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation. Edit: forgot to mention, also open-source.

[deleted]

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#63

Post by saalweachter »

wallywax wrote: post #52
columbo wrote: post #29

Earlier quoted context omitted.

The most surprising thing I see out of this isn't the need for more robust authentication but for services that aren't so damn quick to do whatever you want. Website: "Hey Bill, glad to see you today, what do you want to do" Bill: "Delete _everything_ I've ever done on every system I have" Website: "Of course! Let's get this started... beep boop bip and done!" What about this: 1 - Kill request sent 2 - 48 hours is se…

I can just imagine the HN article when someone tries to delete his Facebook account because he disagrees with some new feature, and they won't do it for 48 hours. I've been on the receiving end of "DELETE MY ACCOUNT!!!1!!1" requests, and I know those people wouldn't respond well to "wait two days or pay up."

Can you delete your Facebook account instantly? When I deleted mine, it went into limbo for like two weeks before being permanently deleted. (I don't remember if there was no option for instant-delete, or if I just didn't care to.)

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#64

Post by halostatue »

zalew wrote: post #53
evanmoran wrote: post #48

Earlier quoted context omitted.

http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines

so if someone wants access to all your passwords, he just needs to compromise your dropbox.

If it works at all like 1Password…no. Not if you have even a half-decent master password.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#65

Post by rdl »

jasomill wrote: post #56
rdl wrote: post #47

Earlier quoted context omitted.

Standard procedure when setting up MDM for a company is to disable iCloud. All remote wipe/etc. done by your own servers, not by Apple. Apple is really bad at running online services. It's a shame that they short-sightedly decided to go to war with Facebook and Google (who are good at services and bad at hardware) rather than playing more nicely together.

More importantly, standard procedure is also to keep multiple backup copies of important data. Because no matter who manages the infrastructure, the only reason the kill switch exists in a corporate environment is because there are scenarios where you plan to use it. Not to mention the very finite lifespan of all forms of modern mass storage, the relative ease of accidental deletion in most file systems, and so on. F…

Oh, sure, but I still thnk striking down with great vengeance and furious anger upon those who remote-wiped your devices would be justified, even with backups. If nothing else, it costs time to restore from backup, but if you were on a trip or something and had no convenient high-speed access to backups, it would be quite unpleasant. Especially if you had, say, iPad iPhone MBA, and assumed at least one of them would be likely to survive the trip, and thus had no other local backups with you.

But yes, backups -- and not just online backups, but also offline backups.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#67

Post by mkenyon »

zalew wrote: post #53
evanmoran wrote: post #48

Earlier quoted context omitted.

http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines

so if someone wants access to all your passwords, he just needs to compromise your dropbox.

Something that has happened in the past on more than one occasion.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#68

Post by gatordan »

I don't have a blog and I don't know the proper convention for those "Show/Ask HN" posts so I suppose a comment here is the next best thing because my question is related.

After reading the "Yes, I was Hacked. Hard." post I updated several of my passwords and found that Netflix enforces a 10 character limit on their passwords. Does anyone have an idea why or how this could be the case? I would find it very ironic if they did this to save a few bits per user in their database considering they're a media streaming company.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#69

Post by rdl »

zalew wrote: post #53
evanmoran wrote: post #48

Earlier quoted context omitted.

http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines

so if someone wants access to all your passwords, he just needs to compromise your dropbox.

dropbox plus either passphrase brute force (or guessing), or one of (keylogger, compelled disclosure, shoulder surfing, ...) + dropbox.

I consider the 1Password file sensitive enough that it shouldn't be online, especially not with dropbox. I'd prefer if there were physical protection for it somehow, too (like a smartcard or FIPS module, which wouldn't allow bulk-export normally, and which might impose other rules on use like 5 passwords per hour when outside my home network, etc.) Same way you handle high-security private keys.

(Ultimately I'm not going to be happy until I have a trusted tablet of some kind, but building that either requires being Apple or waiting for WP8 hardware to come out and investing about $5mm in some serious security upgrades. Maybe worthwhile, though, since it solves the general problem of trusting client devices.)

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#70

Post by danielpal »

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?
Post reply on HN