Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two million Facebook, Gmail and Twitter passwords stolen

money.cnn.com

Post reply on HN
Print view View original

101–107 of 107 posts

Re: Two million Facebook, Gmail and Twitter passwords stolen

#101

Post by cheald »

codeka wrote: post #8

2 Factor Authentication, 2 Factor Authentication, 2 Factor Authentication! I've had 2 factor authentication enabled on my gmail account for over a year now, and once you get past the initial setup phase, it's really not that inconvenient. I have even been able to train my parents to use 2 factor auth, I just need to get them using a password manager now...

I got my dad to start using 2FA by using a CUDA password cracker to brute-force his password in about 30 seconds.

Nothing quite like a hands-on demo.

Re: Two million Facebook, Gmail and Twitter passwords stolen

#102

Post by XorNot »

Zecc wrote: post #100
XorNot wrote: post #96

Earlier quoted context omitted.

I don't care for two-factor authentication because I use a password manager. What I'd like is the option to use a one-time-password when I'm sitting at a computer I don't trust.

So if I understand this, this is how it would work. At any time you'd have two passwords: one regular, which you use every day; and one for one-time-use only, which you keep around in case of need. When sitting at an untrusted computer, you use your one-time-use password. This proves your identity, but also immediately expires your one-time-use password. Next time you want to generate a usable one-time-password you'l…

More like the OTP token would be on my smartphone or some other device, so I can generate passwords as needed that are guaranteed to be unique.

But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.

Re: Two million Facebook, Gmail and Twitter passwords stolen

#103

Post by JangoSteve »

Houshalter wrote: post #90
JangoSteve wrote: post #87

Earlier quoted context omitted.

Ah great question. It does, but it usually stays logged in on your computer, since it runs locally. So you rarely if ever need to type your password for Lastpass, meaning the keylogger would have had to be running on your computer when you installed and set up Lastpass. On a related note, it can also be set up with 2 factor auth.

Presumably the password is stored to a file or in memory (of course that could be arbitrarily difficult to figure out how to decode, but it can't be encrypted since that would require another password.)

Why do you assume it'd be stored in plain text rather than hashed? Also, what does compromising someone's local filesystem have to do with the functionality of a keylogger?

Re: Two million Facebook, Gmail and Twitter passwords stolen

#104

Post by Houshalter »

JangoSteve wrote: post #103
Houshalter wrote: post #90

Earlier quoted context omitted.

Presumably the password is stored to a file or in memory (of course that could be arbitrarily difficult to figure out how to decode, but it can't be encrypted since that would require another password.)

Why do you assume it'd be stored in plain text rather than hashed? Also, what does compromising someone's local filesystem have to do with the functionality of a keylogger?

Even if it's hashed, then the hash can still be used to reconstruct the lastpass passwords. And I'm just assuming that you can't trust your filesystem if your machine has been compromised by malware. You're right the keylogger probably isn't that complicated. It depends on what level of paranoia you have and how widely lastpass becomes adopted (thus more incentive to hack it.) More likely the keylogger will just get the first time you enter your password into lastpass and then steal it that way.

The point is lastpass is designed to protect you from weak passwords and password reuse. It doesn't do anything to protect against attacks on your actual computer.

Re: Two million Facebook, Gmail and Twitter passwords stolen

#105

Post by JangoSteve »

Houshalter wrote: post #104
JangoSteve wrote: post #103

Earlier quoted context omitted.

Why do you assume it'd be stored in plain text rather than hashed? Also, what does compromising someone's local filesystem have to do with the functionality of a keylogger?

Even if it's hashed, then the hash can still be used to reconstruct the lastpass passwords. And I'm just assuming that you can't trust your filesystem if your machine has been compromised by malware. You're right the keylogger probably isn't that complicated. It depends on what level of paranoia you have and how widely lastpass becomes adopted (thus more incentive to hack it.) More likely the keylogger will just get…

Oh, I misunderstood you; I thought you were referring to the master password of LastPass as being plain-text or reversibly encrypted. You mean that the passwords stored by LastPass must be reversibly encrypted on disk. Yes, that's true. Password managers do open the door for such an attack, but they tend to be much less vulnerable to attacks in general than reusing the same passwords. Of course, it's really up to each person to decide what risks are acceptable in the trade-off between convenience and security.

I think the main point was that a password manager would have been much less susceptible to the keylogger attack which lead to this particular incident.

Re: Two million Facebook, Gmail and Twitter passwords stolen

#106

Post by Zecc »

XorNot wrote: post #102
Zecc wrote: post #100

Earlier quoted context omitted.

So if I understand this, this is how it would work. At any time you'd have two passwords: one regular, which you use every day; and one for one-time-use only, which you keep around in case of need. When sitting at an untrusted computer, you use your one-time-use password. This proves your identity, but also immediately expires your one-time-use password. Next time you want to generate a usable one-time-password you'l…

More like the OTP token would be on my smartphone or some other device, so I can generate passwords as needed that are guaranteed to be unique. But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.

Ah sure, as long as both the client and the server are in agreement of what the next token should be then everything is fine. I didn't think this through.

Re: Two million Facebook, Gmail and Twitter passwords stolen

#107

Post by xycombinator »

Guest9821 wrote: post #86
mafro wrote: post #80

Earlier quoted context omitted.

Another lesson people need to learn is to keep their security information up to date! Google (and others) periodically prompt you to do this. I suppose it gets treated much like regularly changing your password though.. Saying that, I'm sorry to hear you got locked out! How inconvenient.

I have my passwords secure, and use Keepass. The database is backed up on my Truecrypt external drives, in case my laptop is stolen, and I lose the database file. I figure my job is to protect my username and password, so that's exactly what I do, secure them, and have backups. What I don't expect is getting locked out of my account when I have the valid username and password to login. Also, Google provides zero supp…

I keep all security questions and answers in Keepass. If you had done that would you have been locked out?
Post reply on HN