He'd be a pretty good target if you were looking for someone to mug. Steal his cell phone, collect $10k.
Break into my email: get $10,000. Here is my username and password.
21–30 of 61 posts
Re: Break into my email: get $10,000. Here is my username and password.
#22"Here’s the thing, in order to get into a StrongWebmail account, the account owner must receive a verification call on their phone. This means that even if your password is stolen, the thief can’t access your email because they don’t have access to your telephone." Great. Users will love receiving calls at all hours as script kiddies in Russia try to log in to their accounts. "Break into my email: get $10,000. Here i…
The initial page log in with the filled in username/password is also a lame setup.
There is no data sent to the sever when you enter a test authentication code, it just automatically says "Invalid code"...
Re: Break into my email: get $10,000. Here is my username and password.
#23I worked on something similar in the 90s. One of the problems that we found was that people dislike having to answer their phone late at night. (Or making phone calls, for that matter.) The biggest security risk we found wasn't the second form of authentication; it was making sure it was just as hard to add other phone numbers. Then there were instances of disconnected phones, dead cell phones, etc to deal with. If t…
They seem to support texting: http://www.strongwebmail.com/images/howitworks_main_choosePh...
Re: Break into my email: get $10,000. Here is my username and password.
#24users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required." 1) Compromise targets computer using some known exploit 2) Retrieve cookie 3) Profit
ha. that was my idea.
Re: Break into my email: get $10,000. Here is my username and password.
#25Ten THOUSAND dollars. That's literally, like, an entire FRACTION of what an application penetration test costs! They must really be serious! [ quick edit: I really hate talking about numbers here, because if you have some bootstrapped YC-style company and you're worried about security, I'd love to think you could reach out to us and not have us try to get into you for tens of thousands of dollars --- but for an actua…
I agree, but here everyone can do it.
EDIT: it seems that the login/password thing it's fake so probably nobody can do it (or he was receiving too much calls)
Re: Break into my email: get $10,000. Here is my username and password.
#26He'd be a pretty good target if you were looking for someone to mug. Steal his cell phone, collect $10k.
And he posted his office address at the end of the blog post!
Re: Break into my email: get $10,000. Here is my username and password.
#27This is simply a re-application of device fingerprinting and voice verification that many banks are using to secure online banking.
There are many things that can go wrong here, based on my previous experience dealing with these systems, but most require client-side subversion, whether it is malware, cross-site scripting, or cross-site request forgery. (For example, finding a CSRF vuln that allows you to update the phone number to your own and compelling your victim to visit the link through a variety of techniques.)
Re: Break into my email: get $10,000. Here is my username and password.
#28nice to see that ads are making their way into HN.
Re: Break into my email: get $10,000. Here is my username and password.
#29So what Strongmail is essentially saying is that if you want to break into anyone using strongmail, break in at their home or work :-)
Re: Break into my email: get $10,000. Here is my username and password.
#30$5 for 100mb
$7 for 1gb
$9 for 10gb
Anyone else thinking someone that needs that much security is going to have a lot of mail?