Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Urgent security warning that may affect all internet users

community.namecheap.com

Post reply on HN
Print view View original

71–80 of 120 posts

Re: Urgent security warning that may affect all internet users

#71

Post by reitanqild »

saosebastiao wrote: post #69

I've seen a huge uptick in spam email the last few days, and although I have no indication that I've been hacked, I feel as though I should probably fear for the worst and aggressively change all my passwords from their current kindergarten security levels. Is there a widely accessible, secure, multi platform, free/libre password manager that is recommendable as easy to use? I reuse passwords because its easy to reme…

I've used Keepass for a few years. Takes a little setup (2 plugins I think) to get form flling on web pages.

I also use lastpass.com for most of my stuff. While not libre it is free and multiplatform. (I still pay to get mobile sync.)

Re: Urgent security warning that may affect all internet users

#72

Post by logn »

orofino wrote: post #51

The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…

> Where are we with replacing the password?

What about you load a site, get an HTTP 401 response, your browser sends back an auth header with a password generated for that domain name, based on some secret global key/password. Then in response, most sites would set a cookie. To change the password, you could have a second header that has the new password, along with the original. No usernames needed. The browsers would have a global password for cases of shared computers. Log out buttons on sites just remove the cookie. Or without cookies, just have the browser send the auth header each time until a native log out button is pressed.

Re: Urgent security warning that may affect all internet users

#73

Post by jacquesm »

orofino wrote: post #51

The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…

It would be a great start if sites that don't actually require an account to get the job done would stop asking you to create one. For instance, most e-commerce transactions where you buy a single item still require you to register with the store. That's like having a loyalty card forced upon you because you tank gas somewhere.

Usually I just want to buy the item, not become 'a member'.

Re: Urgent security warning that may affect all internet users

#74

Post by jacquesm »

kbar13 wrote: post #65
ted0 wrote: post #12

Hey all, Teddy from Namecheap here. Happy to answer any questions here or at ted@namecheap.com. As always, we advise turning on 2-factor authentication on your account.

two factor authentication via SMS is the biggest waste of time. It's not true two factor authentication as you need to depend on the network and protocol between namecheap and my phone. Not to mention the code is probably not originating from a namecheap server but from a third party service. TOTP is a standard, it's great, there are open source implementations, and it's easy to integrate. Google even has that pam mo…

> It's not true two factor authentication as you need to depend on the network and protocol between namecheap and my phone.

That's rubbish. 2FA means 'something you know and something that you have'.

What you know is your account credentials, what you have is your phone.

Re: Urgent security warning that may affect all internet users

#75

Post by junto »

Funnily enough there was a HN post yesterday that looked like a phishing attempt on namecheap accounts:

  Gift HN: Unused domain 'appstores.io' with ~11 months registration left

  Post your namecheap username and I'll pick someone at
  random in 24 hours and push it to the winner.
https://news.ycombinator.com/item?id=8250981

Maybe it was genuine, but if I had posted my name cheap account name there, I think I'd want it deleted now.

Re: Urgent security warning that may affect all internet users

#76

Post by Xylakant »

lobster_johnson wrote: post #35
ted0 wrote: post #12

Hey all, Teddy from Namecheap here. Happy to answer any questions here or at ted@namecheap.com. As always, we advise turning on 2-factor authentication on your account.

OT, but why is that providers like Namecheap implement 2FA but not organizational team support? If I set up 2FA, only my device can log in. If I become unavailable for some reason, none of my team members can access the account. The only way to do this is for all team members to do the 2FA setup at the same time, which I believe will seed the generator so that they will all produce the same sequence of tokens. But th…

At least with gandi, you can keep the barcode of the 2FA seed around (or the text seed) and set up new devices with it. We use Gandi and everyone with access uses Google Authenticator with the same 2FA seed.

Re: Urgent security warning that may affect all internet users

#77

Post by Gustomaximus »

elbenshira wrote: post #68
Gustomaximus wrote: post #67

The way I have organised is to have 5 varying levels. This limits the volume of passwords I have to recall whilst maintaining variety. While there is still opportunity for cross-use if one is hacked it does create breakage points from areas more likely to be hacked and avoids a single point of failure. It's structured something like this; 1) Random sign-ups. 2) Slightly personal information e.g. Hackernews 3) Persona…

Why not just use: https://lastpass.com/ https://agilebits.com/onepassword http://keepass.info/

Isn't there greater risk in using these than my method?

My logic: If one of these solutions e.g. LastPass is compromised then I am compromised across all sites. They may even bypass 2 factor authentication that goes via my email/messaging. Whereas using my method if one website gets hacked then I only give access to a segment. If it is worst case and a financial site is compromised they still don't have the password for accounts where they could see any 2-factor authentication messages. Does that make sense or am I missing something?

Re: Urgent security warning that may affect all internet users

#78

Post by Perseids »

logn wrote: post #72
orofino wrote: post #51

The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…

> Where are we with replacing the password? What about you load a site, get an HTTP 401 response, your browser sends back an auth header with a password generated for that domain name, based on some secret global key/password. Then in response, most sites would set a cookie. To change the password, you could have a second header that has the new password, along with the original. No usernames needed. The browsers wou…

>> We can't expect people to use password managers (they're complicated and then centralize everything into a single point of failure).

> What about you load a site, get an HTTP 401 response, your browser sends back an auth header with a password generated for that domain name, based on some secret global key/password.

You essentially describe a password manager with deterministic password generation. It has all the upsides and downsides of a regular one, except migrating passwords is harder (you need to change them instead of storing them).

Re: Urgent security warning that may affect all internet users

#79

Post by porker »

orofino wrote: post #51

The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…

> I was hopeful that something like persona from Mozilla would catch on, but that has failed.

I talked with two people from Mozilla at a conference in February and was disappointed (though not altogether surprised) to discover they couldn't articulate the compelling reason why someone would move to using Persona. For something to mainstream, the marketing, positioning and ease-of-use is crucial. They had no answers other than 'privacy' and 'ease of use' -- which while valid, aren't going to convince my aunt & uncle to adopt something new. Until they've been hacked, scammed and otherwise suffered pain.

Post reply on HN