Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

211–220 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#211

Post by chmars »

odiroot wrote: post #202
chmars wrote: post #201

Earlier quoted context omitted.

Why do you use the term 'application-specific passwords' although these passwords are not application-specific at all? They are Google-generated passwords with a user label. And if you use 2-factor authentication, they are the weakest link in the chain since they provide full access to a google account except for access vectors with 2-factor authentication. In addition, every app can use such a password, not just the…

Application-specific is just a friendly name. Also this password doesn't give you full access to your Google account. You cannot log into Google web apps this way (AFAIR). Thus you won't be able to mess with account settings (passwords etc). Before you can change critical account settings Google asks you to provide your traditional password again. Your comment is a bit harsh if not FUD.

'Application-specific' is IMHO not just a friendly but a misleading name. They are simply not application-specific.

Using one of these so-called application-specific passwords, you can delete calendars, mails and contacts. That is critical enough for most users.

An additional concern is the usual 30-day authorization you give in order to avoid entering your 2-factor token again and again. Is there any way to de-authorize such a 30-day authorization?

Anyway, I don't rule out that my perspective might be too strict. For must users, the whole Google 2-step authentication system is probably a very important step towards improved security.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#212

Post by sigkill »

odiroot wrote: post #204
sigkill wrote: post #163

Earlier quoted context omitted.

I'm kind of wary of the ASP. It feels very backdoorish. And by the very nature of ASP, it is meant to be saved/stored on the computer system.

Then we should probably move towards (something like) OAuth in all our apps, be it web, desktop or mobile. This way a potential evildoer is left only with a very limited token. Even more, we can invalidate tokens based on time and device used.

Having OAuth or Two factor in Google Talk/Chrome or any application based login system shouldn't be THAT hard. Along with your password, there should be another text field stating "OTP" or some other friendly name.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#213

Post by chmars »

cheald wrote: post #206
reedlaw wrote: post #117

Earlier quoted context omitted.

That's exactly why I don't use 2-factor. It's only as secure as a single complex token. I use a password manager with complex passwords. I fail to see the added security of enabling 2-factor in this case.

2FA is equivalent to changing your password every 30 seconds. Yes, it's "only" as secure as that single token, but the entire point of doing 2FA on a separate hardware device is that even if you have every piece of malware installed on the machine you're logging in to, there is still an analog transfer of information from your phone(/keyfob/whatever) to your computer via your brain. It keeps your "password" in two pa…

That reminds me of discussion on desktop security where often root access is seen as they holy grail – while the potential for damage with simple user access gets ignored …

2-step authentication is great but the (wrongly) so-called application-specific passwords are definitely the weakest link in the chain. They do not allow for a full takeover of a Google Apps account but there is still a lot of damage possible.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#214

Post by SquareWheel »

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

I've tried turning it on multiple times by using an iPod Touch, but I can't figure it out. The support article says the device is supported but the actual page only asks me for a phone number. Either I'm being obtuse or the steps for non-phone users aren't very clear.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#215

Post by chmars »

Tichy wrote: post #197
gsa wrote: post #140

Earlier quoted context omitted.

I know that at first look it sounds like a Pidgin problem, but they do justify their situation quite well on their site: http://developer.pidgin.im/wiki/PlainTextPasswords

They have a point - if Google really allows other apps to access the account via Pidgin's password, perhaps they should fix that.

That is not possible with the current 2-factor authentication system. App-specific passwords are only called 'specific', they are not really app-specific, i.e. you can use them with any app you like if 2-factor authentication with a token has not been implemented yet.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#216

Post by NLips »

TwoBit wrote: post #166
brudgers wrote: post #119

Earlier quoted context omitted.

What I would say is that Amazon's security is in keeping with the recourse their customers have in regards to the transactions Amazon conducts - i.e. credit cards have fraud protection and disputed charges can be challenged and the money refunded when fraudulent charges are made. Amazon has balanced costs, risks and benefits for their stockholders. The wiping of the author's devices was purely due to the level of App…

Any user can take over my Amazon account in five minutes. That's a security flaw, period. Yes this is 80% Apple's fault, but Amazon doesn't have the right to give up my credit card digits. They are not public information as suggested earlier; they are only public if I choose to make it so (e.g. by my usage patterns).

They aren't giving up enough information for anyone to use the credit card (which is your card provider's and Amazon's concern). They are only giving up information which Apple foolishly accepts as top-secret. The final four digits are printed on pretty much every receipt I get, and even using a shredder won't often separate them. TBH, Apple's reliance on the credit card number at all (let alone the last four digits) is pretty silly.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#217

Post by chmars »

Useful advice via http://notes.kateva.org/2012/08/net-security-is-completely-b...:

'We need to give Schneier a few drinks and get him to talk about this again. Failing that:

Backup for Darwin's sake. Don't enable remote wipe of Mac OS X hardware. Just encrypt it. Use Google two-factor (two-step verification) if you are a geek and can stomach it. Fear the Cloud. Keep the data you value most close to you. Don't use iCloud. Don't trust Apple to get anything right that involves the Internet and/or Identity.

Not being Schneier my advice isn't worth much, but fwiw I suspect the "solution" is:

Get rid of the secret security question. Strictly limit password resets. If someone lost last access, charge them $50 to go to bank, post office or notary to establish their identity. Incorporate biometrics (thumb print and speech probably).'

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#218

Post by brudgers »

throwaway8675 wrote: post #127
brudgers wrote: post #119

Earlier quoted context omitted.

What I would say is that Amazon's security is in keeping with the recourse their customers have in regards to the transactions Amazon conducts - i.e. credit cards have fraud protection and disputed charges can be challenged and the money refunded when fraudulent charges are made. Amazon has balanced costs, risks and benefits for their stockholders. The wiping of the author's devices was purely due to the level of App…

You are absolutely right, the blame here really does fall on Apple. As the article mentions, the information they got from Amazon could have been obtained from a local pizza joint as well. Even so, this seems like a decent way to compromise amazon accounts. Even though the danger involved when that happens is pretty minimal for the reasons that you mention, it should nevertheless be something that concerns them. Even…

After some additional thought, I suspect that Amazon has an additional layer of security in the form of algorithms which flag suspicious account activity just as credit card companies do.

Based on the account, it appears that Apple does not - customer support call + password recovery + wipe iPhone + wipe iPad + wipe Macbook did not raise a flag.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#219

Post by ikonst »

jrockway wrote: post #71
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

I use pam_google_authenticator to login (via SSH) to my Linux server, and so can you.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#220

Post by ikonst »

bigiain wrote: post #188
SCdF wrote: post #72

Earlier quoted context omitted.

Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless? (insert your answer below)

What are you trying to protect against in this case? If your phone gets stolen and it's logged in to your google mail without a lockscreen pin/code, then yeah - the thief can read your mail, 2fa won't help. They can also run your Authenticator app and see the current 6 digit number, but that's not useful without the password as well. (I'm not sure how easy it is to extract the Google password from an Android or i pho…

If you have two-factor auth enabled, your Android phone stores a app-specific password -- even if extracted, it wouldn't be terribly useful (assuming you revoke it).
Post reply on HN