Urgent security warning that may affect all internet users

The question for us, as technologists, is what are we doing about this?

2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web.

Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use password managers (they're complicated and then centralize everything into a single point of failure). Forcing people to use crazy passwords just results in weaker passwords.

I was hopeful that something like persona from Mozilla would catch on, but that has failed. Where are we with replacing the password? It is flawed technology.

On top of this we have the compounding factor that our systems are more complicated than ever and it appears that they're simply impossible to secure. Too many layers exist with too much code. Many sites just don't both with even hashing password, meaning those of us that care, are just kind of throwing our hands up and saying "well it wasn't my site that was compromised, so it isn't my fault". All the while, bad guys walk in the front door because we've decided to ignore the reality of the situation.

I know I'm not providing a constructive alternative here, but I'm a bit ashamed that we've even let it get this far. We're failing those that rely on our systems. I don't have the answer, but would love to hear some ideas about what can be done.

Hi Teddy!

I’m curious what evidence you have that ties these login attempts to the CyberVor (1.2bn) hacked credentials database specifically?

Given that (to my knowledge) none of the data from this database has yet been leaked publicly, couldn’t the credentials being used for these attacks be coming just as easily from any number of sources, or previously-disclosed databases (Adobe, LinkedIn, Forbes, etc.)?

Just trying to distinguish “what we know” from “what we suspect”, here. Thanks!

I advocate for the use of password managers.

I've bought 1Password for everyone in my family, and nagged them into using it. I console people online to do the same, or use keepassx, or last pass.

It's not effortless security, that's for sure. In a perfect world we would have a better system than passwords. But we live in a world of compromises, and I feel it's presently the wisest course of action.

https://lastpass.com https://agilebytes.com

keepass or keepassx should be googled.

> WTF is this "urgent"? How might this affect "all internet users"?

Suppose you have a domain registered with Namecheap (or really anyone). You've reused your password and the attackers get into your account at the registrar. What does that get them?

First they change the MX record for your domain. Immediately they're receiving all your email. Now that they control your email they can get a domain-validated certificate for your domain. Then they can change all your other DNS records to point at their servers and operate them with valid TLS certificates and MITM all the connections to your real servers. Then they can collect all the credentials of users using your website including the administrative credentials that allow them to compromise your real servers. Now they have all your data and your users' data and your password database and your website is hosting malware.

There are very few things more compromising to large numbers of people than attackers quietly getting control of multiple legitimate active domains.

Whatever the solution is, it needs to allow remote permits. e.g., I need to be able to grant an employee access to my NameCheap account for client work purposes.