How Apple and Amazon Security Flaws Led to My Epic Hacking • Hacker News Board

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#231

Post by peejaybee » Tue, Aug 07, 2012, 1:06 PM UTC

jrockway wrote: post #71

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

Lastpass for one supports Google Authenticator. I am not sure about any other services.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#232

Post by tnorthcutt » Tue, Aug 07, 2012, 1:10 PM UTC

jvdongen wrote: post #138

tnorthcutt wrote: post #113

Earlier quoted context omitted.

Are you asking if a hacker could use the application-specific password to access your email account? I'm pretty sure the application-specific passwords are only good for the service using them (e.g. the first service to use a newly generated password is the only one allowed to ever use it), but that would be trivial to test for yourself.

That can't work - how would they identify the service using them? Ip address is useless for this purpose and other identifiers ar either not available or very easily spoofed and thus equally useless. If somebody gets hold of the application specific password, he'llbe able to use said application.

You're right, I'm not sure how I thought that could work.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#233

Post by lallysingh » Tue, Aug 07, 2012, 1:17 PM UTC

Kerrick wrote: post #150

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

I was wary to set up 2FA until I learned that you can set it up even without a cellphone or your own computer. You can have the second factor be a voice call, so it can call a landline or dumbphone without an SMS plan. Plus, if you ever lose your phone or cancel your number, you can set up backup phone numbers. I set up my fiancee's phone number as a backup number in case I ever lose my phone.

See above for Matt Cutt's answer: you can also use a yubikey (a tiny USB device that pretends to be a keyboard, and enters the code when you press a tiny button on top).

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#234

Post by maxerickson » Tue, Aug 07, 2012, 1:46 PM UTC

mike_esspe wrote: post #94

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

What if i lost my phone and didn't print backup codes? Will i lose my google account forever?

If you regain control of the phone number before someone finds the phone and uses it to seize control of the Google account, you wouldn't lose anything more than the phone.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#235

Post by cbs » Tue, Aug 07, 2012, 2:03 PM UTC

shalmanese wrote: post #205

I think a lot of people are missing the forest from the trees in this discussion. The real interesting question is not how he got hacked, it's why it doesn't happen more often? None of the tricks listed in the article are particularly time sensitive, the fundamental patterns behind this hack go back at least several years and they relate to fundamental design interactions between complex systems that are difficult to…

>it's why it doesn't happen more often?

It does. It happens all the time. Most victims don't have the luxury of writing a wired article about it and are stuck picking up the pieces on their own.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#236

Post by cbs » Tue, Aug 07, 2012, 2:11 PM UTC

nl wrote: post #57

Last time HN discussed this story, I said "turn on 2-factor authentication for your Google account". Unsurprisingly, I got the exact reaction I'm seeing here when it has been suggested: lots of questions about how it works, people who think their situation is unique so it won't work for them, and people complaining than SMS is insecure. 1) Don't ask anymore questions. Try it out, if you hate it turn it off. 2) Your s…

>Don't ask any more questions - just try it out!

Not even these question:

Aren't we as tech people completely and utterly failing the world at large when the best possible response to this story is to turn on 2 factor auth on one of the many accounts a person has?

Is a very slight reduction to the attack surface really the best we can do?

Seriously?

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#237

Post by peejaybee » Tue, Aug 07, 2012, 2:41 PM UTC

kunil wrote: post #189

Can someone explain reasoning behind the implementation of those "remote wipes"? If Apple pulls a trigger, everything on my laptop erased when it is next online? I can't see any practical application for that.

It's to keep sensitive information from falling into the wrong hands.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#238

Post by AlwaysWatching » Tue, Aug 07, 2012, 2:53 PM UTC

sriramk wrote: post #200

The scary bit (well, one of many) is how easy it is to get access to someone's Amazon account by just knowing their email address and billing address. That lets you buy anything, see their entire order history and probably gives you access to all of AWS.

If they try to add a new address, Amazon will ask for the payment method to be re-entered.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#239

Post by romaniv » Tue, Aug 07, 2012, 3:06 PM UTC

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Sounds like a lot of effort, or at least a lot of things to consider. I wonder how many people were completely locked out of their accounts because they enabled 2-factor auth and didn't do all the right things.

The root problem in this story is that things are just too damn interconnected these days. And we're encourage to interconnect them even further (using cellphones to authenticate email, in this case).

Edit: I think that my reply is not harsh enough. After reading the comments more closely, I see that this a typical IT response to IT failure. 1. Ignore the root cause. (Interconnectedness.) 2. Blame the user. (Implicitly, for not enabling two-factor auth.) 3. Suggest a workaround and dismiss any concerns real-life scenarios. (E.g. loosing your wallet and cellphone in an emergency. Emergencies like that happen more often that you'd think.) 4. Feel smug.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#240

Post by entropy_ » Tue, Aug 07, 2012, 4:23 PM UTC

bigiain wrote: post #188

SCdF wrote: post #72

Earlier quoted context omitted.

Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless? (insert your answer below)

What are you trying to protect against in this case? If your phone gets stolen and it's logged in to your google mail without a lockscreen pin/code, then yeah - the thief can read your mail, 2fa won't help. They can also run your Authenticator app and see the current 6 digit number, but that's not useful without the password as well. (I'm not sure how easy it is to extract the Google password from an Android or i pho…

If the phone is rooted(as is the case with mine) then an attacker could change the list of trusted Certificate Authorities on the phone and then perform a MITM attack to get any passwords being passed over the air.

However, I think google services use XMPP if I'm not mistaken. In which case the password is never actually transmitted over the air. XMPP uses Digest access authentication[1]. Short version: the server would first send a challenge to the client. The client hashes the challenge with a hash of the password and returns the result. The server performs the same operation and compares. So even with a MITM you'd get nothing. Furthermore, the client itself would never need to store the password either.

[1] http://en.wikipedia.org/wiki/Digest_access_authentication