Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please turn on two-factor authentication

mattcutts.com

Post reply on HN
Print view View original

231–240 of 262 posts

Re: Please turn on two-factor authentication

#231

Post by tammer »

mike-cardwell wrote: post #179
tammer wrote: post #140

Quick question for all you security experts: Which is more secure: LastPass with 2factor, or a gpg encrypted password safe on my home server accessed by a passphrase-locked rsa-encrypted key? I've been trying to decide for the past few weeks. Copying and pasting passwords isn't as annoying as I thought it would be, and it seems like keeping my pwsafe locally reduces the attack vector of the LastPass servers. Then aga…

LastPass is only one persistent XSS flaw away from having your password store completely compromised. I found a non-persistent one last year which exposed a lot of information about you, but not your password: https://grepular.com/LastPass_Vulnerability_Exposes_Account_... Specifically it exposed your email address, your password reminder, the list of sites you log into and the history of your logins, including which…

Thanks for the detailed info!

Combined with two-factor ssh auth[0] for using a public connection, looks my gpg file is the perfect solution.

[0] http://news.ycombinator.com/item?id=3029680

Re: Please turn on two-factor authentication

#232

Post by lee »

robomartin wrote: post #220

All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text. I've written about this before and so have countless of other techies. A non-techie has not a single clue, making them…

Curious, could you point to a blog post or article that explains how to do this?

Re: Please turn on two-factor authentication

#233

Post by abraham »

sigkill wrote: post #230
abraham wrote: post #209

Earlier quoted context omitted.

> Why is it stupid for Amazon to show the last 4 digits? I think npsimons was saying that it is stupid for Amazon to let you add a fake cc number and than take over an account using that same fake number. Not that they show the last 4 digits.

Ah well, then I stand corrected. So, now the question becomes, should you be allowed to add credit cards over the phone? Or does it become, how long should Amazon wait until they accept the new credit card as a valid ID? For the second question, I'd say Amazon should wait until the user "confirms" the credit card. That is to say, send the user an email stating "Hi! New credit card added to your account. Click here to…

They could do pre-authorizations on the card to make sure they are valid and match an address on file.

Re: Please turn on two-factor authentication

#234

Post by danweber »

robomartin wrote: post #220

All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text. I've written about this before and so have countless of other techies. A non-techie has not a single clue, making them…

I think most people are aware that the passwords saved in their browser are, well, saved in their browser, and if someone unkind gains access to the browser they gain access to all the sites with saved passwords.

Re: Please turn on two-factor authentication

#235

Post by danweber »

drstewart wrote: post #190
pooriaazimi wrote: post #152

Earlier quoted context omitted.

> Standard American mobile billing is to bill both parties That's the most bizarre thing I've heard in weeks. Honestly, I'm still laughing. BOTH for SMS and voice ?!! God, that's just crazy. No wonder you Americans hate telco companies so much. And I though 0.25 cents (only for outgoing SMSs) that we pay here is absurd.

You pay a different price for calling a landline vs a cellphone? I'm still laughing. That's just crazy.

Back when cell phones weren't ubiquitous, I once worked at a start-up where one of the really rich technical leads thought it was unfair that he got charged when people called him on his cell phone. I guess he thought that the peons who could only afford land lines were supposed to subsidize him. Which I could have forgiven as plain old selfishness, but he also constantly complained about how unfair society was to the poor.

That specific combination of attributes still bugs me.

Re: Please turn on two-factor authentication

#236

Post by danweber »

dendory wrote: post #182

I would add to that: Web developers, please implement two factor auth for your own apps as well. It takes minutes, literally, to add support for the Google Authenticator to your own app. I made a demo a while back inside of an hour. http://dendory.net/twofactors

That is very helpful. I'm going to be proposing this to work very soon thanks to you.

Re: Please turn on two-factor authentication

#237

Post by alfiejohn_ »

Johngibb wrote: post #229
xfax wrote: post #77

Earlier quoted context omitted.

Sure I could. Not denying that there are other ways to get access to the files I need, just that this has become a part of my workflow that two-factor auth disrupts.

I think having a second gmail address just for emailin yourself files for public computers might work for you. Keep your personal email safe, and forward what you need to the other address. It's a good compromise. Don't underestimate how vulnerable you are when your email gets hacked - virtually every service you use can be accessed by the forgotten password mechanism when your email is breached. I'm pretty lazy and…

The problem of having to type in your password on an unsecured machine still exists.

To access files in this situation, a better approach would have been to upload the file to a webserver. You can then safely download it from the library computer without anything being compromised.

Re: Please turn on two-factor authentication

#238

Post by sigkill »

abraham wrote: post #233
sigkill wrote: post #230

Earlier quoted context omitted.

Ah well, then I stand corrected. So, now the question becomes, should you be allowed to add credit cards over the phone? Or does it become, how long should Amazon wait until they accept the new credit card as a valid ID? For the second question, I'd say Amazon should wait until the user "confirms" the credit card. That is to say, send the user an email stating "Hi! New credit card added to your account. Click here to…

They could do pre-authorizations on the card to make sure they are valid and match an address on file.

That's a good point. But wouldn't prepaid cards defeat this? I'm not an American so I don't know how the address verification on prepaid cards work.

Re: Please turn on two-factor authentication

#239

Post by alfiejohn_ »

rryan wrote: post #213
alfiejohn_ wrote: post #26

Earlier quoted context omitted.

Maybe it's just me but I only trust computers I control. If you don't have root on a box, consider it pwn3d with keyloggers listening to every juicy password you type. Take that as your friend's laptop, a library computer or even your parent's Windows XP box... Trust no one, Mr. Mulder. /tinfoilhat

You trust computers you control? That's so cute. http://cm.bell-labs.com/who/ken/trust.html

True, but you can only go so far down the rabbit hole until you think you've done enough due diligence to remove as much risk as you feel comfortable with.

Re: Please turn on two-factor authentication

#240

Post by danweber »

oddthink wrote: post #102
nollidge wrote: post #78

Earlier quoted context omitted.

It's not at all standard on smartphones though. Almost all data plans include at least several hundred texts per month.

Not on AT&T, as far as I can tell. It's either $20/month for unlimited messaging, or $0.20 each. So, unless you're sending or receiving more than 100 messages a month, you're better off without a plan.

I've got a 200 message/month plan from AT&T for $5 a month. My only complaint is that I can't share messages across the two lines on the account so each gets billed $5. (Also, no data plan.)
Post reply on HN