Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

161–170 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#161

Post by Someone »

cookiecaper wrote: post #145

The fact is that Apple and Amazon have far more confused customers than targets for social engineering attacks. They are always going to have an "I forgot everything about myself and my account, please let me in!" option. All cloud service providers are going to have this. With this in mind, it may not be wise to remotely link your MacBook such that it can be wiped by Apple Central Command. Do people seriously do tha…

"Encryption and backup. [...] If people did these things correctly, hacks would rarely matter [...] This is a field that is ripe for system-level disruption"

Encryption and backups set in stone. An attacker may not be able to read your encrypted backups, but if he can delete them, you still won't be happy.

I think the only feasible solution is that of online, write-only backups. They need to be online so that devices can backup themselves when they deem that necessary; you cannot trust users to do any manual backup task. They need to be write-only because, otherwise, with online backups, an attacker could wipe all your backups. Semi-write only, in the form of "deleting backups older than a year" or "delay any deletes by a month" (to give the user time to report his phone to be stolen) or "delete only after three-factor authentication" probably is acceptable.

"perhaps because the business models of companies are now so dependent on reading our information and selling it back to interested parties"

I think it is because online backup looks too pricey. People keep comparing the price of online storage to that of hard disks. For example Dropbox is about $1 per GB of storage per year. You can buy a SSD disk or a laptop for less than $1 per GB of storage. As this example shows, current solutions also do not protect well against attacks.

I am not sure that the options of having your own cloud, or of making a cloud with others (peer-to-peer backups) will make sense to Joe consumer. Users may not want yet another device at home, likely will not have the upload bandwidth (yet), and are a risk factor with respect to operations on such a device. A home device probably would have to be a custom device, not a PC. Users cannot be trusted to operate it in ways that keeps their data secure, so you must make it impossible for them to operate it.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#162

Post by riffraff »

gsa wrote: post #140
Tichy wrote: post #135

Earlier quoted context omitted.

Sounds as if Pidgin is the problem here.

I know that at first look it sounds like a Pidgin problem, but they do justify their situation quite well on their site: http://developer.pidgin.im/wiki/PlainTextPasswords

this is crazy, doesn't every current linux distro already have a keychain-like-thingy which is protected by the user password? Adium (which is also based on libpurple) uses it on the mac, which means there is no plaintext password lying around.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#163

Post by sigkill »

reedlaw wrote: post #156
reedlaw wrote: post #117

Earlier quoted context omitted.

That's exactly why I don't use 2-factor. It's only as secure as a single complex token. I use a password manager with complex passwords. I fail to see the added security of enabling 2-factor in this case.

Since I've been downvoted without a response, let me elaborate on my concerns. I haven't seen the threat of application specific passwords (ASP) addressed properly. If an ASP is sniffed or somehow extracted from a device it seems like it's practically equivalent to a single-factor authentication password. I couldn't determine from Google's docs if an ASP will allow you to change a master password or not. Or if it cou…

I'm kind of wary of the ASP. It feels very backdoorish. And by the very nature of ASP, it is meant to be saved/stored on the computer system.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#164

Post by DigitalJack »

inflatablenerd wrote: post #104
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

"Myth: I've heard two factor authentication doesn't work in IMAP and POP" I've found this to be true - to a certain extent. I had two factor authentication turned on and found it to be a nightmare in OSX Mail. Failures to retrieve mail, asking for my password constantly, etc. I was resetting the application passwords every two days. I tried to research a fix, but in the end it became less of a hassle just to turn it…

I remember having to generate the 2 or 3 times, but it did eventually work for me, on several gmail accounts. That is with both Lion and Mountain Lion.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#165

Post by draven »

LVB wrote: post #148
nl wrote: post #57

Last time HN discussed this story, I said "turn on 2-factor authentication for your Google account". Unsurprisingly, I got the exact reaction I'm seeing here when it has been suggested: lots of questions about how it works, people who think their situation is unique so it won't work for them, and people complaining than SMS is insecure. 1) Don't ask anymore questions. Try it out, if you hate it turn it off. 2) Your s…

Definitely print the codes! As a newbie I didn't, and as luck (or a 1/30 chance) would have it, I forgot my phone at home the same day my 30-day login window expired at work. Not a huge deal but a bit of a PITA, and there really was no way to log in until after I got home (which is obviously the point). Now I have some codes squirreled away in a couple key locations.

Same here, I changed my phone provider and the details on how to activate my new subscription were sent to my gmail account. When I connected to my GMail account the session had timed out. This was some kind of cyclic dependency: I needed my phone to get the details on how to make the phone working. I felt incredibly stupid. So... print the codes!

(I managed to get the information by visiting GMail from my Linux box where the login didn't expire, but still)

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#166

Post by TwoBit »

brudgers wrote: post #119
throwaway8675 wrote: post #114

Earlier quoted context omitted.

> First you call Amazon and tell them you are the account holder, and want to add a credit card number to the account. All you need is the name on the account, an associated e-mail address, and the billing address. Amazon then allows you to input a new credit card. (Wired used a bogus credit card number from a website that generates fake card numbers that conform with the industry’s published self-check algorithm.) T…

What I would say is that Amazon's security is in keeping with the recourse their customers have in regards to the transactions Amazon conducts - i.e. credit cards have fraud protection and disputed charges can be challenged and the money refunded when fraudulent charges are made. Amazon has balanced costs, risks and benefits for their stockholders. The wiping of the author's devices was purely due to the level of App…

Any user can take over my Amazon account in five minutes. That's a security flaw, period.

Yes this is 80% Apple's fault, but Amazon doesn't have the right to give up my credit card digits. They are not public information as suggested earlier; they are only public if I choose to make it so (e.g. by my usage patterns).

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#167

Post by gsa »

riffraff wrote: post #162
gsa wrote: post #140

Earlier quoted context omitted.

I know that at first look it sounds like a Pidgin problem, but they do justify their situation quite well on their site: http://developer.pidgin.im/wiki/PlainTextPasswords

this is crazy, doesn't every current linux distro already have a keychain-like-thingy which is protected by the user password? Adium (which is also based on libpurple) uses it on the mac, which means there is no plaintext password lying around.

There is - GNOME has Keyring, KDE has Wallet. But apps need to support it or have a plugin system for that. Pidgin has plugins for GNOME and Windows: http://developer.pidgin.im/wiki/ThirdPartyPlugins#Securityan...

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#168

Post by TwoBit »

mick_dundee wrote: post #132

Two-factor authentication is important for online security (and not just email accounts), but there are other lessons to be learned from Mat Honan's misfortune. I'm probably more extreme in my practices than most people, but I'm OK with the inconviences. - You can't rely on companies providing online services to have your best interests as their best interests. - Take security seriously because if you don't you won't…

Can somebody explain to me how it is that two-factor authentication would have prevented the hacker from seeing the author's recovery email address? Why would Google allow anybody to see your recovery email address without a password, and why would two-factor authentication prevent it. The author never explained this.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#169

Post by acqq »

Matt_Cutts wrote: post #92
danielpal wrote: post #70

Earlier quoted context omitted.

Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?

Two-factor Google authentication would have had two benefits. First, the Gmail and Twitter accounts wouldn't have been hacked. Secondly, the Wired article made this claim: "Because I didn’t have Google’s two-factor authentication turned on, when Phobia entered my Gmail address, he could view the alternate e-mail I had set up for account recovery. Google partially obscures that information, starring out many character…

"Hackers would have had a much harder time"? No: mhonan@gmail.com mhonan@me.com

Gmail was not really needed to guess the name at @me.com.

Moreover, in his case, it seems he would be better off not having the secondary e-mail address for recovery at Google. It turned out to be anti-security measure.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#170

Post by lazyjones »

mechanical_fish wrote: post #6
brown9-2 wrote: post #2

It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account. This is scary.

I have actual work to do, work that I have been putting off too long, so let's try crowdsourcing this question on HN: What should one try to do to protect against this? Hypothetical actions to take: Make sure that an email address that's doing double-duty as a login identifier for a given service is unique to the service and appears nowhere on the web or in outgoing mail. Take particular care to have a "recovery" ema…

An obvious thing to improve is for Amazon to stop handing out customers' accounts to identity thieves who apparently just need to call with name, billing address and e-mail to add a new credit card number, then call again with name, billing address and the new credit card number to gain access to the account. I'm sorry Amazon, but name, billing address and e-mail shouldn't be sufficient to hand over my account to a stranger.
Post reply on HN