Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

121–130 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#121

Post by Matt_Cutts »

harshreality wrote: post #107
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

http://code.google.com/p/google-authenticator/issues/detail?... The inflexible account ordering in Authenticator is bugging me, since I recently added a 5th account (not 5 google accounts) and my phone only shows 4 at a time. I don't know if you have any influence over the people maintaining the app, but it looks trivial to fix, given the comments.

That's good feedback--I'll pass it on.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#122

Post by rsingel »

mike_esspe wrote: post #94
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

What if i lost my phone and didn't print backup codes? Will i lose my google account forever?

There are other backup measures, including a trusted friend's phone as backup. But being totally locked out is a feature, not a bug.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#123

Post by maegget »

drgath wrote: post #75
adgar wrote: post #24

Earlier quoted context omitted.

Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation. Edit: forgot to mention, also open-source.

On Google's "Enter your code" screen, if you click the "Don't have your phone?" link, you get a pop-up that gives you the following options: * Use a backup code. Learn more * Send to your backup phone number ending in ## * I cannot access any of my phones Learn more I presume option #2 is the one cubicle67 is referring to. So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...

> I presume option #2 is the one cubicle67 is referring to.

I'm pretty sure the backup phone number is someone else's phone, not yours. I use my wife's phone number.

If you lose your phone (and thus access to the Google Authenticator app), you can send a code to the backup phone (for example, my wife's phone) allowing you to login.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#124

Post by maegget »

rblackwater wrote: post #111
drgath wrote: post #75

Earlier quoted context omitted.

On Google's "Enter your code" screen, if you click the "Don't have your phone?" link, you get a pop-up that gives you the following options: * Use a backup code. Learn more * Send to your backup phone number ending in ## * I cannot access any of my phones Learn more I presume option #2 is the one cubicle67 is referring to. So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...

Then why are you not using POP or IMAP with a separate password? What are they going to do with the auth code when they don't have your original password? I'm not trying to defend their stupid choice of offering option #2, but rather trying to offer a solution to your current problem.

I find option #2 to be very useful, not stupid.

If my phone becomes unavailable (eg lost/ stolen/ dropped in a toilet) then I need a backup option to login. The backup options Google provides are: * Use a backup code * Use a backup phone number * None of the above, I still need help!

1. The backup codes are suggested to be printed and stored in a wallet; however you can put them anywhere you like.

2. The backup phone number can be somebody else's number. Your best friend, your partner, whatever.

3. If you still can't get a backup code, the third option is to go through Google's support team and recovery process. Selecting this option results in an advisory message stating the process could take from 3 to 5 days.

These options appear to be very sensible to me.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#125

Post by andrewpi »

jrockway wrote: post #71
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

The bitcoin exchange MtGox supports securing your account with the Google Authenticator app.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#126

Post by SCdF »

I wonder, do any of these company send defensive communications when people try to unlock things like this?

Yes, I made that phrase up. So here's what I mean:

- "Amazon then allows you to input a new credit card." - "Next you call back, and tell Amazon that you’ve lost access to your account.", email, phone, Tipi. And a waiting period.

- When you call Apple's tech support, again: email, phone, Tipi.

Maybe I'm missing the obvious flaw in this plan, but since customer support (humans) seems to be one of the main weak links, it would make sense for presume that's where people will attack, and to then attempt to reach out with all communication mediums possible to make sure you're talking to the real deal.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#127

Post by throwaway8675 »

brudgers wrote: post #119
throwaway8675 wrote: post #114

Earlier quoted context omitted.

> First you call Amazon and tell them you are the account holder, and want to add a credit card number to the account. All you need is the name on the account, an associated e-mail address, and the billing address. Amazon then allows you to input a new credit card. (Wired used a bogus credit card number from a website that generates fake card numbers that conform with the industry’s published self-check algorithm.) T…

What I would say is that Amazon's security is in keeping with the recourse their customers have in regards to the transactions Amazon conducts - i.e. credit cards have fraud protection and disputed charges can be challenged and the money refunded when fraudulent charges are made. Amazon has balanced costs, risks and benefits for their stockholders. The wiping of the author's devices was purely due to the level of App…

You are absolutely right, the blame here really does fall on Apple. As the article mentions, the information they got from Amazon could have been obtained from a local pizza joint as well.

Even so, this seems like a decent way to compromise amazon accounts. Even though the danger involved when that happens is pretty minimal for the reasons that you mention, it should nevertheless be something that concerns them. Even just things like revealing purchase history is an issue, though of course unlikely to be a lifewrecker like the Apple situation. I can't imagine this process will work with them in a few days. All I meant to say is that they have something to fix, not that they share significant blame.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#128

Post by rdl »

a1k0n wrote: post #118
rdl wrote: post #46

Earlier quoted context omitted.

Given your iCloud account and/or root on the PC paired to your iPhone, I think it would be possible to compromise your Google Authenticator app. At the limit, jailbreak the connected phone, but I think it could be done more simply (all you need to do is run the Authenticator app and see the screen within 60 seconds, which should be possible from a connected, paired Mac). On Android, way way easier, due to lack of sec…

> On Android, way way easier, due to lack of secure device storage. FYI: you can encrypt the boot flash drive in ICS and Jellybean; you need to type a passphrase to unlock/boot the phone.

Right, but the weakness vs. iOS and Blackberry is that it's all software encryption. You can get an encrypted image and then search the relatively short feasible password length (people use shorter passcodes, and often numeric, on mobile devices, vs. desktops or online, due to the limitations of the input device, and the need to unlock the device fairly frequently).

On iOS and Blackberry, you're authenticating to a security chip which has a device-specific key (long, random). On an iPad 2 or iPhone 4S or later, you can't make attempts without being physically on the phone, and this is limited to no more than 8 per second on the fastest iPad 3 CPU. This makes a 4 digit passcode on iPhone 4S (with wipe after 10 tries) potentially more secure than an 8 character random alphanumeric on Android. Online (well, device-online) vs. offline attack. I'm not sure about the latest Blackberry OS security chip status, but a few years ago it was similar, so I hope it hasn't gotten worse.

(There are ways, even on the latest devices, to prevent the device wipe on 10 tries, but no known public ways to do attacks without doing them on the device itself, or physically tampering with the device (which isn't impossible, but requires physical access and chip-level attacks. If your passcode is long enough, you'd have time to detect your loss and presumably invalidate any credentials stored on the iPhone)

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#129

Post by majelix »

nilsbunger wrote: post #82
danielpal wrote: post #70

Earlier quoted context omitted.

Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?

Good point. But even two-factor auth wouldn't have saved him because the hacker got the customer support people to issue a temporary password. Apple (and others) need to implement better controls on how you reestablish identity once you've lost access.

Que the "Apple locked me out of my OWN DATA!" screed in 3, 2, ...

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#130

Post by macspoofing »

>If I had some other account aside from an Apple e-mail address, or had used two-factor authentication for Gmail, everything would have stopped here.

Are you sure? Do you trust the minimum wage customer service reps of your phone company to not be susceptible to social engineering?

Post reply on HN