Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

191–200 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#191

Post by alastair »

dnaquin wrote: post #147
jrockway wrote: post #71

Earlier quoted context omitted.

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

Facebook. See https://www.facebook.com/settings?tab=security&section=a...

FB doesn't use Google Authenticator.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#192

Post by bruceboughton »

bigiain wrote: post #182
sigkill wrote: post #163

Earlier quoted context omitted.

I'm kind of wary of the ASP. It feels very backdoorish. And by the very nature of ASP, it is meant to be saved/stored on the computer system.

Me too. It seems to me that since ASP allows me POP/IMAP access to a gmail account, it probably gives me enough access to run the "send a password reset" attack. I can't use that to 0wn the two-factor protected google account, but I can easily use it to 0wn the AppleID/Anazon/eBay/PayPal account using the gmail account for the recovery address… Off the top of my head, I don't even know if it's possible to ensure my i…

Gmail supports restricting POP/IMAP access to specific labels. Couldn't you set up filters to move password reset emails/all emails from services you care about out to non-POP/IMAP folders, skipping the inbox.

A kludge, sure, but a possibility.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#193

Post by xmpir »

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

convinced - i will set it up in a minute :)

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#194

Post by alastair »

inflatablenerd wrote: post #104
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

"Myth: I've heard two factor authentication doesn't work in IMAP and POP" I've found this to be true - to a certain extent. I had two factor authentication turned on and found it to be a nightmare in OSX Mail. Failures to retrieve mail, asking for my password constantly, etc. I was resetting the application passwords every two days. I tried to research a fix, but in the end it became less of a hassle just to turn it…

Make sure you're using an application-specific password for any application that doesn't support two factor authentication - eg, Mail.app on Lion.

Thats what they're for.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#195

Post by dchest »

rdl wrote: post #69
zalew wrote: post #53

Earlier quoted context omitted.

so if someone wants access to all your passwords, he just needs to compromise your dropbox.

dropbox plus either passphrase brute force (or guessing), or one of (keylogger, compelled disclosure, shoulder surfing, ...) + dropbox. I consider the 1Password file sensitive enough that it shouldn't be online, especially not with dropbox. I'd prefer if there were physical protection for it somehow, too (like a smartcard or FIPS module, which wouldn't allow bulk-export normally, and which might impose other rules on…

Now sure if PasswordSafe allows using key file, as sbov mentioned above for Keepass, but if it's properly implemented, and you didn't put the key file into Dropbox, it would be pretty much impossible to brute force.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#196

Post by mike-cardwell »

"Moreover, if your computers aren’t already cloud-connected devices, they will be soon."

I disagree. You can and will (for the foreseeable future) be able to choose a computer/configuration that doesn't allow some remote third party to run arbitrary code on it or wipe it.

His devices were all wiped because he let a third party have that level of access.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#197

Post by Tichy »

gsa wrote: post #140
Tichy wrote: post #135

Earlier quoted context omitted.

Sounds as if Pidgin is the problem here.

I know that at first look it sounds like a Pidgin problem, but they do justify their situation quite well on their site: http://developer.pidgin.im/wiki/PlainTextPasswords

They have a point - if Google really allows other apps to access the account via Pidgin's password, perhaps they should fix that.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#199

Post by dendory »

Everyone focuses on Gmail 2-factor, but that should be added as an option for any online service. It's trivial for any web developer to use the Google Authenticator to offer 2-factor auth for your own service in just a few minutes. I made a demo a while back in less than an hour, all open source. http://dendory.net/twofactors
Post reply on HN