Urgent security warning that may affect all internet users • Hacker News Board

Re: Urgent security warning that may affect all internet users

#111

Post by SomeCallMeTim » Wed, Sep 03, 2014, 2:47 AM UTC

mynameishere wrote: post #46

SomeCallMeTim wrote: post #23

Earlier quoted context omitted.

As someone who plays online games, I get really, really annoyed when I'm forced to create a password to log in. ALL non-secure online sites that need to identify users should allow for Google or Facebook authentication, or I will never try to access the game from my phone or tablet. I refuse to use the same password everywhere, but that means I have a password vault on my computer . If I need to create a password and…

So, having large corporations (google, facebook, etc) know everything you're doing all the time at every site and in every app is better than...having to keep track of various passwords? I don't get it. I find 3rd party authentication without the slightest appeal. Maybe it's a teensy bit easier.

Everything? Hardly. Certainly everything important lives in the password vault.

But playing games? Why do I care if Facebook or Google knows I play a particular game? On Android Google is going to know what games I have anyway.

"MAYBE" it's easier? On a PHONE?! Let's see, I can click "Google" to log in, and I'm done, or I can...open my key vault, enter my 16-character-random-password into my key manager using a touch keyboard, and then do the copy/paste of the user name and the password.

What? I don't have a password for this site yet? Then I have to get my computer and generate the password there, because I don't trust "the cloud" with my critical password vault, encrypted or not.

It's so much easier to use OAUTH it's not even a close comparison.

Re: Urgent security warning that may affect all internet users

#112

Post by SomeCallMeTim » Wed, Sep 03, 2014, 2:55 AM UTC

csacc wrote: post #81

orofino wrote: post #51

The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…

Just throwing this out there but when signing up for sites while using Safari, Apple gives me the option of using a (Apple generated) random password that is stored to my keychain and synced to my iCloud account. This means both of my MacBooks, my iPhone, and my iPad all have access to these sites with no effort on my part (I never could remember my passwords) while also being random and secure(-ish?). All that is ne…

Sorry, but there's no way I'd allow any cloud service to hold my password vault, and recommending it to end users seems like a colossally bad idea.

I'd want at least two layers of different encryption types (generated by distinct software) protecting any such file if it were to be stored in the cloud. That way if one software package or one encryption algorithm were compromised, there would at least be a chance the other layer would protect it.

So at the moment I put my vault on my laptop and copy it directly to my phone, but I don't copy it into the cloud, ever.

I might consider using something like SpiderOak [1] in conjunction with a Keepass encrypted container, for instance. But I haven't even done that.

[1] https://spideroak.com/

Re: Urgent security warning that may affect all internet users

#113

Post by cpblockphishing » Wed, Sep 03, 2014, 4:16 AM UTC

kbar13 wrote: post #65

ted0 wrote: post #12

Hey all, Teddy from Namecheap here. Happy to answer any questions here or at ted@namecheap.com. As always, we advise turning on 2-factor authentication on your account.

two factor authentication via SMS is the biggest waste of time. It's not true two factor authentication as you need to depend on the network and protocol between namecheap and my phone. Not to mention the code is probably not originating from a namecheap server but from a third party service. TOTP is a standard, it's great, there are open source implementations, and it's easy to integrate. Google even has that pam mo…

Aside from expensive, and questionable reliability, there is are a few other major issues SMS just doesn't address:

1) Blocking phishing: where are you typing that code into? the real site? Are you sure......zeus-in-the-mobile coming at you

2) and once you are into the actual site and you want to do something of value, man-in-the-browser becomes an issue

>>>> this sums it up http://blogs.computerworld.com/data-security/24250/financial...

oh yes, and the 34 banks that have been spear-phished and SMS compromised know about it too.......

Re: Urgent security warning that may affect all internet users

#114

Post by dredmorbius » Wed, Sep 03, 2014, 9:58 AM UTC

tribaal wrote: post #86

bambax wrote: post #66

Earlier quoted context omitted.

All the security measures usually presented (including here) are completely unrealistic - no one can use different, complex passwords on every site we log into, and then change them every month! The only way to do this would be to use a password manager in an Saas mode... and if it gets cracked then you're completely doomed and lose all access to all services. People probably assume that the time saved by not caring…

I do exactly that, using keepassX. Single use, complex passwords that I change every two months, stored in a shared encrypted database. What exactly is hard about it?

Does keepassX manage the password changing or is that something you schedule and do manually?

Re: Urgent security warning that may affect all internet users

#115

Post by lotsofcows » Wed, Sep 03, 2014, 1:21 PM UTC

MarkMc wrote: post #47

For sensitive sites like this, users should not be given the option to use the same username/password as other websites: The username should be issued by the site in the form Sally379687 or Fred965912

Define "sensitive site". Any email provider, if it's your main email account would qualify as very sensitive. However, people also have myriad junk accounts. As soon as you start to enforce this sort of thing you limit who's going to sign up.

I've got accounts with two brokers. One has good tools which I can use with simulated ledgers but won't manage SIPPs. It has a crap password which I can remember and bang in whenever I want to check performance. The other's password is in KeePass and requires a small but significant effort to access. You could argue that the former doesn't want my "business" but if they started handling SIPPs or if I start doing some speculation I'd convert instantly. Is my low level leeching worth an instant convert?

Re: Urgent security warning that may affect all internet users

#116

Post by quoiquoi » Wed, Sep 03, 2014, 4:46 PM UTC

diafygi wrote: post #98

bambax wrote: post #87

Earlier quoted context omitted.

keepassX seems to be a local application: how do you use it on mobile, or when you're not at home? Also: if the database gets corrupted, you lose access to all services; if you have backups then it's a little less safe; if the main password for the database is strong you may forget it (or need to write it down somewhere outside the system); if it's not strong it's not safe.

There are mobile clients for KeePass databases. So you just need to keep a copy of your database on your phone. That's extremely easy to do with syncing data apps like SpiderOak.

Soooo you're still using a cloud service to sync your passwords, right?

Re: Urgent security warning that may affect all internet users

#117

Post by quoiquoi » Wed, Sep 03, 2014, 4:48 PM UTC

dredmorbius wrote: post #114

tribaal wrote: post #86

Earlier quoted context omitted.

I do exactly that, using keepassX. Single use, complex passwords that I change every two months, stored in a shared encrypted database. What exactly is hard about it?

Does keepassX manage the password changing or is that something you schedule and do manually?

You still have to do it manually I think. Having a standardized API to change passwords (a "Rotate all my passwords" buttons) would be nice, but potentially a huge step forward in automating password attacks.

Re: Urgent security warning that may affect all internet users

#118

Post by quoiquoi » Wed, Sep 03, 2014, 5:11 PM UTC

saosebastiao wrote: post #69

I've seen a huge uptick in spam email the last few days, and although I have no indication that I've been hacked, I feel as though I should probably fear for the worst and aggressively change all my passwords from their current kindergarten security levels. Is there a widely accessible, secure, multi platform, free/libre password manager that is recommendable as easy to use? I reuse passwords because its easy to reme…

Why not use your browsers' password manager?

Re: Urgent security warning that may affect all internet users

#119

Post by dredmorbius » Thu, Sep 04, 2014, 1:53 AM UTC

quoiquoi wrote: post #117

dredmorbius wrote: post #114

Earlier quoted context omitted.

Does keepassX manage the password changing or is that something you schedule and do manually?

You still have to do it manually I think. Having a standardized API to change passwords (a "Rotate all my passwords" buttons) would be nice, but potentially a huge step forward in automating password attacks.

Thanks. I confirmed a Debian package. If I can sync devices I think I'm golden.

Re: Urgent security warning that may affect all internet users

#120

Post by Spooky23 » Thu, Sep 04, 2014, 4:52 PM UTC

SomeCallMeTim wrote: post #109

Spooky23 wrote: post #63

Earlier quoted context omitted.

Find a better vault solution. Keepassx is available for every platform out there, and when combined with a file sync solution like dropbox, box, etc can be trivially used on iOS or android.

I do use Keepass, but I don't want to need to trust Dropbox etc. I know the Keepass file is nominally password protected, but once I upload a Keepass file with all my important passwords to a site like Dropbox, there's no way to ever recall it reliably. So if there's a Dropbox security hole, someone can potentially grab a copy. And then if there's a Keepass security hole (or if they otherwise acquire my password), th…

My assumption is that a skilled attacker targeting me in particular will be able to compromise my access to services. Easiest vector is probably compromising email and doing password resets.

IMO the security controls that I have in place for my vault files are strong enough to make it too expensive for a general attack on files in Dropbox to be cost effective.