Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notes on the Celebrity Data Theft

nikcub.com

Post reply on HN
Print view View original

71–80 of 292 posts

Re: Notes on the Celebrity Data Theft

#71

Post by wmf »

tlrobinson wrote: post #54
harryh wrote: post #3

Earlier quoted context omitted.

Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.

While I think using password managers with random passwords is far better than sharing the same password between every account, I've never really gotten comfortable with storing passwords in a file on my computer. What I'd really like is a password manager hardware dongle of some kind, like the Bitcoin Trezor wallet.

If the dongle sends cleartext passwords to the computer then the passwords may still be captured. If the dongle sends one-time passwords then it's basically a Yubikey.

Re: Notes on the Celebrity Data Theft

#72

Post by tlrobinson »

nwh wrote: post #66
tlrobinson wrote: post #54

Earlier quoted context omitted.

While I think using password managers with random passwords is far better than sharing the same password between every account, I've never really gotten comfortable with storing passwords in a file on my computer. What I'd really like is a password manager hardware dongle of some kind, like the Bitcoin Trezor wallet.

It doesn't matter. If you have malware lurking in your computer it will just snarf your passwords from the wire and then you're owned all the same. If you use some sort of auth signing system, the request can just be intercepted and modified on the fly.[0] The Trezor is next to useless even for bitcoin for this very reason. Sure they can't steal your money directly, but just replacing the addresses you see and send t…

For passwords you're right, but at least it prevents theft of every password all at once.

For Bitcoin hardware wallets like Trezor, IIRC they either do or will support BIP-70 "Payment Protocol" payment requests that are signed with an X.509 cert, allowing you to verify the request on the dongle's screen.

Re: Notes on the Celebrity Data Theft

#73

Post by lambdasquirrel »

The thing that bugs me is that you could have good password practices. But if you're having a party, having a fun time (and lets face it, people are going to do shit...), and one of your friends is snapping photos of you, and they have bad password practices, then you are kind of screwed. People don't typically make friends on the basis of: do you have good password practices.

Re: Notes on the Celebrity Data Theft

#74

Post by eknkc »

ptwiggens wrote: post #61
eknkc wrote: post #26

Earlier quoted context omitted.

Yeah, how about the first time? I mean, I do not buy apps all the time, maybe once a week. And I'd have my battery dead or something like that in between those attempts. So, I never had a chance to just hold my thumb on the home button and go my way.

This is really easy. You have one good password for 1pass, and one good password for iCloud. If you can manage to memorize one, you can memorize two.

My real problem with this is writing the password with numbers, punctuation and stuff on a mobile keyboard. Feels like surgery even if I'd memorize it.

I use 1P on my laptop most of the time so it's not a huge deal. Everything else on the iPhone just remembers credentials.

I know I can force myself to use a great password for iCloud but my point is that most of the time, I'd go for an idiot password rather than forcing myself. Just like most people.

Re: Notes on the Celebrity Data Theft

#75

Post by ddrmaxgt37 »

lambdasquirrel wrote: post #73

The thing that bugs me is that you could have good password practices. But if you're having a party, having a fun time (and lets face it, people are going to do shit...), and one of your friends is snapping photos of you, and they have bad password practices, then you are kind of screwed. People don't typically make friends on the basis of: do you have good password practices.

Yup. And that very reason is why many people don't have social networking accounts. You can control what you share, but you can't control what your friends share.

Re: Notes on the Celebrity Data Theft

#76

Post by michaelt »

rayiner wrote: post #2

I wrote this in the other thread on the leak before it died: > Even if the leaks result from one at a time social engineering, it still really calls into question the practical security of the cloud. I doubt it's much harder to steal, e.g. confidential business documents from executives' cloud accounts than it is to steal pictures from celebrities' cloud accounts. > If I were a big organization with confidential info…

  I'd really be thinking hard about my cloud policies
A lot of social engineering attacks involve things like security question password reset, lost second factor reset, lost access to backup e-mail/phone, and things like that.

Don't most enterprise cloud offerings dispense with things like that, because users can visit a helpdesk in person?

Re: Notes on the Celebrity Data Theft

#77

Post by jberryman »

eknkc wrote: post #21

I use strong passwords generated by 1Password for everything.. except for iCloud. There I have an idiot password. Why? Because freaking iPhone asks for that when I want to download something from App Store. How do you guys handle that?

lastpass on android has the ability to insert your passwords into app login forms (via a custom keyboard / accessibility API, I think). I don't know if the same is true on iOS

Re: Notes on the Celebrity Data Theft

#78

Post by city41 »

> Password reset is answering the date of birth and security question challenges (often easy to break using publicly available data – birthdays and favorite sports teams, etc. are often not secrets)

I really dislike this trend of "personal questions" to reset your password. The first car I owned or where I'd like to retire is easily obtained information. When are websites going to stop doing this?

I answer these questions using passwords generated from 1Password. So basically I have 4+ passwords per sites that use these questions. Very annoying.

Re: Notes on the Celebrity Data Theft

#79

Post by nwh »

tlrobinson wrote: post #72
nwh wrote: post #66

Earlier quoted context omitted.

It doesn't matter. If you have malware lurking in your computer it will just snarf your passwords from the wire and then you're owned all the same. If you use some sort of auth signing system, the request can just be intercepted and modified on the fly.[0] The Trezor is next to useless even for bitcoin for this very reason. Sure they can't steal your money directly, but just replacing the addresses you see and send t…

For passwords you're right, but at least it prevents theft of every password all at once. For Bitcoin hardware wallets like Trezor, IIRC they either do or will support BIP-70 "Payment Protocol" payment requests that are signed with an X.509 cert, allowing you to verify the request on the dongle's screen .

Nothing stops a threat from just lying and waiting for you to expose a large number of passwords. Having one stolen doesn't raise red flags in itself.

I don't think signed addresses will be particularly effective. With the sort of key stores we have now, it seems pretty plausible that a bad actor to get a certificate that would pass on the Trezor device. It raises the barrier of entry a little though.

Re: Notes on the Celebrity Data Theft

#80

Post by abalone »

Choice quote:

To reiterate what the main bugs are that are being exploited here, roughly in order of popularity / effectiveness:

Password reset (secret questions / answers)

Phishing email

Password recovery (email account hacked)

Social engineering / RAT install / authentication keys

Note: Not weak passwords.

Post reply on HN