Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spotify and Facebook: Is that phishing?

weluse.de

Post reply on HN
Print view View original

41–50 of 96 posts

Re: Spotify and Facebook: Is that phishing?

#41

Post by karl_gluck »

duijf wrote: post #9
luser001 wrote: post #2

Amazing. Also, this is yet another privacy threat that I dodged because I use the PwdHash extension ( https://www.pwdhash.com/ ). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.

To be honest, that looks like it has a some drawbacks when used with different domains that use the same authentication backend. Think Google's different domains (google.com, google.co.uk, google.nl, gmail.com etc.) The demo gives a different hashed password whenever the TLD differs. And seeing that Google by default redirects you to the homepage of whatever country you're in at the moment, you might end up getting b…

The problem of sharing passwords across domains is one of the things that prompted me to write the password-generating service Cryptasia [1].

In short, Cryptasia uses a Google Spreadsheet entirely owned & controlled by each user as a 3rd party data store. Each row contains the friendly name of the site, the login URL, the password generation key, a list of allowed characters, which characters are required, and the length of the password to create. By using the same generator key and character sets, one can have the same password for multiple websites. The password can also be changed for a website without having to change your master passphrase, since just changing the generator key (say, adding a "1" afterward) completely changes the created password.

I know it's not as easy to use as a browser extension, but when I visited Europe it was nice to be able to hop on any computer in one of the hotels and check my email.

I can throw this on Github if anyone's interested (the source-code is all in unobscured JS, too).

[1] crypt.asia or http://www.cryptasia.com

Re: Spotify and Facebook: Is that phishing?

#42

Post by jiggy2011 »

benmanns wrote: post #39
jiggy2011 wrote: post #25

Earlier quoted context omitted.

You can signup with an email address , but the option is hidden quite low in the signup page. Best way to avoid this sort of stuff is just to sign up to spotify with throwaway email. I have found that it's worth buying a domain name and just tying it to a VPS with SMTP installed (or using a third part service that offers unlimited addresses). That way you can just generate throwaway email addresses as you need them.

You can also use Mailinator[0] and their many other domains for throwaway email addresses. In fact, you can point your MX records to mail.mailinator.com for a custom domain without running a VPS.[1] [0] http://www.mailinator.com/ [1] http://mailinator.blogspot.com/2008/01/your-own-private-mail...

True, but those services are quite limited and not that secure in that anybody who knows the email address can login to your account.

Re: Spotify and Facebook: Is that phishing?

#43

Post by luser001 »

eli wrote: post #26
luser001 wrote: post #2

Amazing. Also, this is yet another privacy threat that I dodged because I use the PwdHash extension ( https://www.pwdhash.com/ ). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.

Doesn't seem like a good fit for the paranoid. If you screw up and your master password leaks, an attacker can access all of your accounts. I greatly prefer KeePass + Dropbox, which also lets you securely store usernames and notes. And the passwords are random and not derived from anything.

> Doesn't seem like a good fit for the paranoid.

Agreed. But OTOH it's a very lightweight solution, which is an advantage. And in any case, it's MUCH better than using the same unhashed password everywhere.

I'm claiming that using PwdHash is strictly better than not using it. YMMV.

Re: Spotify and Facebook: Is that phishing?

#44

Post by nemof »

drue wrote: post #20

I wanted to try spotify a while back but got stuck when it required a FB account. Sounds like it's no longer required, but I suppose I still don't trust them enough to try their service.

There really isn't anything janky going on here, it's a poor lack of communication on the part of the spotify program and lack of understanding on the part of the user.

As for Spotify, as a long time user I love it. Very much worth a try.

Re: Spotify and Facebook: Is that phishing?

#45

Post by luser001 »

duijf wrote: post #9
luser001 wrote: post #2

Amazing. Also, this is yet another privacy threat that I dodged because I use the PwdHash extension ( https://www.pwdhash.com/ ). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.

To be honest, that looks like it has a some drawbacks when used with different domains that use the same authentication backend. Think Google's different domains (google.com, google.co.uk, google.nl, gmail.com etc.) The demo gives a different hashed password whenever the TLD differs. And seeing that Google by default redirects you to the homepage of whatever country you're in at the moment, you might end up getting b…

> you might end up getting burned by the extension when travelling.

Good point. This could happen. I'm assuming by "burned" you mean "unable to login". If so, you can always type in your home country's domain into the webapp version and get the correct hashed password. I agree this isn't ideal. Just saying that there's a plan B.

Re: Spotify and Facebook: Is that phishing?

#47

Post by andrewroycarter »

ineedtosleep wrote: post #6

I'm ashamed that this doesn't surprise me much. This looks like a huge oversight on Facebook's part, but with the countless reports on Facebook failing with privacy here, there and everywhere, it's like I don't care anymore. The thing that numbs me even more is that client work, no matter how good of an argument one gives, will always have some form of third-party social login because it's oh-so-important and users w…

We kind of have a different problem. Clients all want it in the apps we make, but analytics show that very few users use those features. Which sucks because it takes forever to implement all that stuff -_-

Re: Spotify and Facebook: Is that phishing?

#48

Post by jonknee »

benmanns wrote: post #22

This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook. I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked. If logging in with the email did work, it would mean that Spotify aut…

Not just finding a user on Facebook with an email address, because they also log into the Facebook account and add their app to it. (Hence the re-activation email as well.) Very shady.

Re: Spotify and Facebook: Is that phishing?

#50

Post by axx »

I'm may be wrong here, but isn't it the case, that Facebooks re-activates your account, as soon as you login with Facebook Connect on a 3rd-Party site?

I really hate that, but what if you're using something like coughBangYourFriendscough Spotify, deactivate your Facebook account and can't use Spotify anymore? Maybe you're a paying customer to Spotify? How do you cancel your membership if you can't login anymore?

To me this seems like a Big Communication Problem™ between the User and the App/Facebook. The Facebook API needs a functionality that says "Using a deactivated account for Facebook Connect re-activates your old account automatically".

I totally disagree on methods like this, but i seems plausible in that way.

Post reply on HN