How Apple and Amazon Security Flaws Led to My Epic Hacking • Hacker News Board

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#81

Post by tytso » Tue, Aug 07, 2012, 3:13 AM UTC

jrockway wrote: post #71

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

Lastpass also uses Google Authenticator. You can get server-side code so you can use Google Authenticator on your own server, or use it to offer two-factor authentication to a web service you are running. It's an open protocol, with an open source implementation. All you have to use it.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#82

Post by nilsbunger » Tue, Aug 07, 2012, 3:13 AM UTC

danielpal wrote: post #70

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?

Good point. But even two-factor auth wouldn't have saved him because the hacker got the customer support people to issue a temporary password. Apple (and others) need to implement better controls on how you reestablish identity once you've lost access.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#83

Post by Matt_Cutts » Tue, Aug 07, 2012, 3:14 AM UTC

jrockway wrote: post #71

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

Good question. I have seen http://drupal.org/project/ga_login for Drupal, for example. Likewise, here's a write-up about using a YubiKey with Gmail's two-factor authentication: http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey...

I believe Google Authenticator is based on open standards and open source, so people could standardize on it if they wanted too.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#84

Post by stuff4ben » Tue, Aug 07, 2012, 3:14 AM UTC

it boils down to "who do you trust?" Ultimately you have to take some responsibility in ensuring the safety of your data and be cognizant of the weaknesses of each link. I backup my data onto an external HD. In the event of fire or that HD being lost or stolen, I have online backups of everything but video. I also have an older external HD backup stored at my parents house 2 hours away. I trust myself to an extent and the cloud to an extent, but never either absolutely. My life is not Google or iCloud or Dropbox or Drobo.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#85

Post by kmm » Tue, Aug 07, 2012, 3:15 AM UTC

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

There's something that bugged me about two-factor the moment I activated it. The application specific passwords are stored in plain-text. How does Google know that it's actually e.g. Chrome accessing my mail with a given application-specific password?

If a hacker gets a hold of an old backup of mine, which includes a Pidgin configuration file I forgot to delete, which holds a plaintext password, can he get into my account with that?

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#86

Post by tytso » Tue, Aug 07, 2012, 3:16 AM UTC

drgath wrote: post #75

adgar wrote: post #24

Earlier quoted context omitted.

Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation. Edit: forgot to mention, also open-source.

On Google's "Enter your code" screen, if you click the "Don't have your phone?" link, you get a pop-up that gives you the following options: * Use a backup code. Learn more * Send to your backup phone number ending in ## * I cannot access any of my phones Learn more I presume option #2 is the one cubicle67 is referring to. So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...

> So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...

Only if they also know your password. That's why it's called "two factor authentication". Simply compromising your password is not enough. They also have to capture your phone.

Now, if you're stupid enough to write your password on the back of your phone.... you deserve everything that's coming to you.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#87

Post by rdl » Tue, Aug 07, 2012, 3:16 AM UTC

adgar wrote: post #74

rdl wrote: post #59

Earlier quoted context omitted.

The problem with Authenticator is that it is usually paired to a personal computer, on a personal phone (or a phone used for everything; the BYOD trend is a lot bigger with phones than computers). If your work accounts use Authenticator, even on relatively secure machines, compromising your personal laptop becomes enough to compromise the phone and thus work accounts, even if the personal laptop isn't used for those…

This is the most detached-from-reality crypto comment I've come across. Google Authenticator works. I really hate to break it to you - but it's actively working right now to protect millions of real users and saving enormous enterprises real money . It seems like you refuse to accept any of that because if someone roots my laptop and proxies my phone's display over the internet then Google's 2-factor might as well be…

I use Google Authenticator for my gmail/google account, but it's not an adequate replacement for hardware tokens, for the reasons I outlined above.

Wordpress, Lastpass, and a few other sites seem to support Google Authenticator as well, but it has very little adoption in the enterprise (compared to physical tokens, x509 certs, and passwords).

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#88

Post by Matt_Cutts » Tue, Aug 07, 2012, 3:17 AM UTC

SCdF wrote: post #72

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless? (insert your answer below)

I think the answer is that you can print out one-time codes on paper and put them into your wallet.

I would also recommend putting an unlock pattern on your phone to protect in case your phone is stolen.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#89

Post by fpgeek » Tue, Aug 07, 2012, 3:20 AM UTC

evanmoran wrote: post #48

rdl wrote: post #43

Earlier quoted context omitted.

You don't have as many computers as I do, or as long a password as I do, I suspect. Having to type a random long passphrase with special characters on the weird keyboards of multiple devices every month was a pain. Even worse, for devices I infrequently use, I ended up basically having to do this every single time I wanted to use the device.

http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines

While I appreciate the concept, I don't think Dropbox is the company to trust for this kind of thing: http://arstechnica.com/security/2012/07/dropbox-confirms-it-...

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#90

Post by rogerchucker » Tue, Aug 07, 2012, 3:20 AM UTC

Most important lesson as far as reducing vulnerability to social engineering is concerned: whatever service we subscribe to - we should always find out about their account retrieval process.

In other words, we should always ask "what is the password retrieval process for the new account you just opened?" This sounds like a big task and one where not all scenarios can be covered. But I think this is a good first step - as long as we are still dealing with passwords, federated identity, half-masked credit card #'s and security questions.

I think this exercise would help us be careful about our choice of passwords, answers, email ids.

What would be the most obvious downsides to this approach?