Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skype vulnerability allowing hijacking of an account if you know just the email

pixus-ru.blogspot.ru

Post reply on HN
Print view View original

91–100 of 124 posts

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#91

Post by gingerlime »

bruceboughton wrote: post #89
gingerlime wrote: post #88

Earlier quoted context omitted.

The problem I was trying to solve is of many people who use the same password and email everywhere, and who won't use a password manager or feel it's too complicated to install or use etc. The email addresses are not as sensitive as passwords. Sure. If someone gets hold of all of them AND your master password you're in trouble. But same goes to getting your password manager file and the password for it. The differenc…

Your scheme is no easier to implement than having a different password for each website. You have effectively moved part of the password out of the password and into the email address.

It is only easier in the sense of not having to install or use a password manager, and that the email addresses themselves are not as sensitive as the password.

As with everything security related, there is a trade-off. I'm not saying it's more secure, but it can be more convenient in certain circumstances and for certain people.

A password-manager is more secure (if the master password is and the manager software is safe). A unique email address + unique password with a password manager even more so. two-factor authentication even more... and so on...

It's just a question of options/priorities. This is still a valid option in my opinion which might work well for some people who don't want / can't use a password manager, but can handle a list of random email addresses...

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#93

Post by celebdor »

mtgx wrote: post #29

You can't even delete your Skype account if you want to. You can only change some of the information: https://support.skype.com/en/faq/FA142/can-i-delete-my-skype...

If you contact support you can set the account as deleted. So that screenname becomes unavailable (or at least that is what they told me when I did it).

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#94

Post by greyboy »

davidwparker wrote: post #61

I'm genuinely curious- what's keeping people on Skype? There are better alternatives out there now (Google+ Hangouts, for example). Will this push any of you Skype users over?

We use Skype to call friends' mobile numbers in African countries, Ukraine, etc. Does Google+ allow that? (Note: not a Google+ user)

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#95

Post by dchest »

dchest wrote: post #39

In August I received an email from Skype thanking me for registering an account. But I already had an account, I didn't register this one. After comparing the new account name with part of my email, I came to the conclusion that someone mistyped their email address, and registered an account on my address. I contacted their live support, here's the conversation: George A: Hello! Welcome to Skype Live Support! My name…

For reporters: what I wrote about is a different issue from today's vulnerability! However, if Skype verified emails, as I suggested, today's hack wouldn't be possible. (At least, today, I don't know whether guys discovered vulnerability earlier than I wrote to Skype support).

http://www.h-online.com/security/news/item/Skype-investigati... claims that I discovered today's vulnerability, but I didn't. I discovered, by accident, that Skype doesn't verify email addresses (in fact, they still don't, even after fixing vulnerability); I don't even think that I'm the first person to do it.

Edit: I also didn't write the linked blog post, it was someone else.

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#96

Post by timf »

Skype reports this has been resolved: http://heartbeat.skype.com/2012/11/security_issue.html

    [UPDATE:14/11/2012@15:28GMT] 
    Early this morning we were notified of user concerns surrounding the security
    of the password reset feature on our website. This issue affected some users
    where multiple Skype accounts were registered to the same email address. We
    suspended the password reset feature temporarily this morning as a precaution
    and have made updates to the password reset process today so that it is now
    working properly. We are reaching out to a small number of users who may
    have been impacted to assist as necessary. Skype is committed to providing a
    safe and secure communications experience to our users and we apologize
    for the inconvenience.

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#98

Post by timf »

timf wrote: post #55

Microsoft reports they have disabled password resets during the investigation: http://heartbeat.skype.com/2012/11/security_issue.html

That text was replaced, here is the old text:

    We have had reports of a new security vulnerability issue. As a precautionary
    step we have temporarily disabled password reset as we continue to investigate
    the issue further. We apologize for the inconvenience but user experience and
    safety is our first priority

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#99

Post by meritt »

timf wrote: post #96

Skype reports this has been resolved: http://heartbeat.skype.com/2012/11/security_issue.html [UPDATE:14/11/2012@15:28GMT] Early this morning we were notified of user concerns surrounding the security of the password reset feature on our website. This issue affected some users where multiple Skype accounts were registered to the same email address. We suspended the password reset feature temporarily this morning as a…

Good to hear they fixed it but it was responsibly disclosed a month ago and Skype did nothing whatsoever. We really need a better way to hold a company accountable for appropriately reacting to proven security threats without requiring a public disclosure.

Re: Skype vulnerability allowing hijacking of an account if you know just the email

#100

Post by lambda »

jere wrote: post #97

By the way, Skype's registration page has inexplicable password rules. aaaaa1 - strength: medium aaaaa12345 - strength: poor =aStu!et$aQ@212345 - strength: poor

Yeah, at my last job, someone implemented a password strength checking feature that would actually reject stronger passwords. It required:

1. At least 3 out of the 4 categories uppercase, lowercase, digit, special character

2. No character could be repeated more than two times

3. No sequence of 3 or more increasing or decreasing letters or numbers could be present (and not even consecutive: "ta/Tbs#cz" would be rejected because it contains "abc").

4. No English words or names could be present.

5. It must be at least 8 characters

There may have been other restrictions too, I don't recall the exact details.

This meant that perfectly reasonable passphrases (like "correct horse battery staple") would be rejected. Even if you tried to come up with a good password that met the rule, you might fail by accident because "89cRbcThe*)" has the word "The" in it. You would generally have to come up with a password, then whittle it down slowly until you passed all of the rules, usually making it weaker in the process.

Post reply on HN