How Apple and Amazon Security Flaws Led to My Epic Hacking • Hacker News Board

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#201

Post by chmars » Tue, Aug 07, 2012, 9:43 AM UTC

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Why do you use the term 'application-specific passwords' although these passwords are not application-specific at all?

They are Google-generated passwords with a user label. And if you use 2-factor authentication, they are the weakest link in the chain since they provide full access to a google account except for access vectors with 2-factor authentication. In addition, every app can use such a password, not just the app you created the password for …

2-factor authentication is great and certainly recommendable but you should not fool users by using the false term 'application-specific passwords'. In addition, more complex Google-generated password would be appreciated.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#202

Post by odiroot » Tue, Aug 07, 2012, 9:53 AM UTC

chmars wrote: post #201

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Why do you use the term 'application-specific passwords' although these passwords are not application-specific at all? They are Google-generated passwords with a user label. And if you use 2-factor authentication, they are the weakest link in the chain since they provide full access to a google account except for access vectors with 2-factor authentication. In addition, every app can use such a password, not just the…

Application-specific is just a friendly name.

Also this password doesn't give you full access to your Google account. You cannot log into Google web apps this way (AFAIR). Thus you won't be able to mess with account settings (passwords etc). Before you can change critical account settings Google asks you to provide your traditional password again.

Your comment is a bit harsh if not FUD.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#203

Post by cheald » Tue, Aug 07, 2012, 9:59 AM UTC

daigoba66 wrote: post #42

cheald wrote: post #15

Earlier quoted context omitted.

If you ever reach the point that your account is so hard to recover that it requires human customer service intervention, the recovery process needs to be tedious and thorough. "Okay, I'll need a notarized copy of a photo ID and once we have that, we'll give you a call to the number we have on file to confirm the change." It's not perfect, but it would require an extremely dedicated and targeted attack to bypass, as…

I agree, if you get locked out and need to regain access it should as hard as possible to get back in. On the flip side, we perhaps need to come up with something better than usernames and password for authentication. There are plenty of services where I simply cannot remember my password and/or username. I'm getting better about writing them down inside a password protected master file. But for many of those service…

The problem is simply that if things are easy enough to remember, they're easy enough to crack or brute force. If they're too hard to remember, people will forget them and have to recover them.

I use LastPass and just generate a new random password for every new account. If I ever forget my LastPass password, I am boned (since it's the encryption key for my data!), but I don't worry about forgetting passwords anymore, and I don't worry about RandomSite getting hacked and my password being leaked. It's not perfect, but it's good enough.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#204

Post by odiroot » Tue, Aug 07, 2012, 9:59 AM UTC

sigkill wrote: post #163

reedlaw wrote: post #156

Earlier quoted context omitted.

Since I've been downvoted without a response, let me elaborate on my concerns. I haven't seen the threat of application specific passwords (ASP) addressed properly. If an ASP is sniffed or somehow extracted from a device it seems like it's practically equivalent to a single-factor authentication password. I couldn't determine from Google's docs if an ASP will allow you to change a master password or not. Or if it cou…

I'm kind of wary of the ASP. It feels very backdoorish. And by the very nature of ASP, it is meant to be saved/stored on the computer system.

Then we should probably move towards (something like) OAuth in all our apps, be it web, desktop or mobile. This way a potential evildoer is left only with a very limited token. Even more, we can invalidate tokens based on time and device used.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#205

Post by shalmanese » Tue, Aug 07, 2012, 10:01 AM UTC

I think a lot of people are missing the forest from the trees in this discussion. The real interesting question is not how he got hacked, it's why it doesn't happen more often? None of the tricks listed in the article are particularly time sensitive, the fundamental patterns behind this hack go back at least several years and they relate to fundamental design interactions between complex systems that are difficult to impossible to change. So given all this, why him? why now?

The answer doesn't have anything to do with how he should have set up 8 factor authentication or how he should have had a Swahili-numeric password. The answer is that his hacker had extremely atypical motivations and that's the reason his life got destroyed.

The goal of this hacker was to pwn this guy's short, valuable twitter account. It's unlikely there's really any other hacker in the world who has that goal which is why such attacks are so rare. For most hackers, there's some sort of rational ROI calculation and if the ROI is negative, the hack isn't worth doing.

Nerds often have a hard time seeing that security is a holistic system. It's often comprised of many flawed layers that are layered in depth to provide a statistically secure system. In real life, security comes from being able to push down the ROI through institutional mechanisms rather than personal ones. Credit cards are designed to be stolen and recovered from, investigations are able to target key players in the field and tough penalties means that the negative effects outweigh the positive gains.

All this has lead to a black market rate of merely $2 - $3 per stolen credit card, meaning that there's not much motivation to hack in the first place.

Nerds naturally have a libertarian bent which makes them more inclined to believe encryption and technology is the solution to the problem when, in reality, it's a beefed up police state and American hegemonic decisions that can span the globe.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#206

Post by cheald » Tue, Aug 07, 2012, 10:03 AM UTC

reedlaw wrote: post #117

kmm wrote: post #85

Earlier quoted context omitted.

There's something that bugged me about two-factor the moment I activated it. The application specific passwords are stored in plain-text. How does Google know that it's actually e.g. Chrome accessing my mail with a given application-specific password? If a hacker gets a hold of an old backup of mine, which includes a Pidgin configuration file I forgot to delete, which holds a plaintext password, can he get into my ac…

That's exactly why I don't use 2-factor. It's only as secure as a single complex token. I use a password manager with complex passwords. I fail to see the added security of enabling 2-factor in this case.

2FA is equivalent to changing your password every 30 seconds. Yes, it's "only" as secure as that single token, but the entire point of doing 2FA on a separate hardware device is that even if you have every piece of malware installed on the machine you're logging in to, there is still an analog transfer of information from your phone(/keyfob/whatever) to your computer via your brain. It keeps your "password" in two parts, one of which lives in your head/password manager/muscle memory, and the other of which lives on your phone.

ASPs are certainly less secure than 2FA, but they only permit services access, rather than account administration access.

2FA is slightly more hassle for the knowledge that you are effectively protected against a wide range of attacks. It's very worth it.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#207

Post by cheald » Tue, Aug 07, 2012, 10:08 AM UTC

frio wrote: post #146

pseudonym wrote: post #133

Earlier quoted context omitted.

You're perfectly welcome to use the same password multiple times-- it's as secure as you yourself make it. When Google generates an App password, it displays it once-- and then trashes it. On that same page is a list of the identifiers you've given all of your apps, and the last time that identifier's password was used to log into your account. At any point, you can trash a generated password, and anything using that…

Kind of. This is the reason 2-factor makes me uncomfortable too: instead of having 1 username/1 password, it's actually 1 username/lots of passwords. And the passwords generated are all lowercase alphabetic characters (I assume to make them easier for users who don't/can't copy-paste). It'd make me a lot more comfortable if I could lock each password down to a specific Google service (for instance: generate an OTP fo…

ASPs are 16 characters. That's 26^16 - 26^15 = 4.19315 * 10^22 (41.9 sextillion!) cominbations. If you aren't confident in the size of that keyspace, I'm not sure what to tell you.

The point about permitting a password to be used for only certain services is absolutely a valid one, though.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#208

Post by jschuur » Tue, Aug 07, 2012, 10:20 AM UTC

jrockway wrote: post #71

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

There's a Google Authenticator WordPress plugin: http://wordpress.org/extend/plugins/google-authenticator/

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#209

Post by mike-cardwell » Tue, Aug 07, 2012, 10:29 AM UTC

sschueller wrote: post #185

How can he not press charges against 'Phobia' and any of his stupid script kiddy friends? Maybe the police is too stupid to do anything and the FBI has too much other shit do to but isn't there any legal way to get these bastards?

He probably doesn't want to risk further attacks. If he did want to get the police involved, I bet the attacker wouldn't be too difficult to find with all the services they logged into and phone calls they made. I mean, they could have used Tor for all of their Internet activity, but I bet they still used their home land line to make the phone calls.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#210

Post by karlb » Tue, Aug 07, 2012, 10:36 AM UTC

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Matt, your list of objections and counter-objections is great – too good to be hidden away in a Hacker News comment thread and on your blog. It belongs somewhere within the sign-up flow itself:

http://support.google.com/accounts/bin/topic.py?hl=en&to...