Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Ransom, Bitcoin Replaces the Bag of Bills

nytimes.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#31

Post by id_ris »

bdcravens wrote: post #30
gknoy wrote: post #29

Earlier quoted context omitted.

Google apps lets you generate a series of one-time use codes, which you can print out and keep in a safe/folder/notebook, so that if your 2-factor-auth device (phone, fob, etc) gets nuked, you can still log in. I find it interesting that he could log in without 2-factor auth. Those things I thought were keyed to phone hardware.

Many 2fa implementations offer SMS (which would be compromised given a social engineering cell redirect) as an alternative to TOTP. (What's commonly referred to as "Google Authenticator" - it's time-based, so if you capture the initial image or code, you can actually set it up on multiple devices, so it's not exactly device-based)

This is a reason to not verify over SMS and to instead use the Google Authenticator app. It seems easier to socially engineer a SMS redirect than to obtain the mobile device and bypass its login authentication.

If you are going to verify over SMS, don't have your SMS messages forwarded to email as that would render your 2fa pointless.

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#32

Post by thret »

grogenaut wrote: post #27
roflchoppa wrote: post #6

Earlier quoted context omitted.

Yeah thats one way to address the issue (or even using multiple emails), but you know what's even better than that? Having competent customer support, that would be able to address situations like this. Esp. with the amount of people that are using these home automation services with "cloud" support, its only going to get worse the more integrated these services become. My friend has had a similar situation with the…

Lol, I was 1/2 way through this email thinking I'd respond that the only one worse is valve... turnabout. I've never had them respond to me. I've got several tickets multi months outstanding.

It is possible they queue their client service based on how much money each client has spent. It is what I would do if I did not have time to get to everyone cost effectively.

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#35

Post by eru »

o87dv wrote: post #4
sorrythrowaway9 wrote: post #3

I know this is not 100% specific to this article, but this is happening right now to a friend of mine's gmail account. Scammer was able to social engineer the cell phone company to forward his number, then did a password reset, and locked him out of his account. 20BTC Ransom. He followed every single google customer service link/resource he could find and tried to reset link, which said they would contact him in 3-5…

Hopefully the next step is going to be switching from Google to a different provider.

Use the cryptography based 2FA (with Google Authenticator on your phone). SMS is too open to social engineering, and as a second factor might actually make your account less safe.

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#36

Post by ikeboy »

eru wrote: post #35
o87dv wrote: post #4

Earlier quoted context omitted.

Hopefully the next step is going to be switching from Google to a different provider.

Use the cryptography based 2FA (with Google Authenticator on your phone). SMS is too open to social engineering, and as a second factor might actually make your account less safe.

Think I read that Google Auth falls back to SMS, so that wouldn't help.

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#37

Post by rjbwork »

thret wrote: post #32
grogenaut wrote: post #27

Earlier quoted context omitted.

Lol, I was 1/2 way through this email thinking I'd respond that the only one worse is valve... turnabout. I've never had them respond to me. I've got several tickets multi months outstanding.

It is possible they queue their client service based on how much money each client has spent. It is what I would do if I did not have time to get to everyone cost effectively.

Yep. I've spent ~1k dollars on steam and i've gotten games refunded within days, even though they dont have to according to their TOS.

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#38

Post by ikeboy »

rwallace wrote: post #18
ikeboy wrote: post #17

Earlier quoted context omitted.

Iirc you are able to get priority support for resetting a Google password if you pay.

That would certainly be good news! I don't suppose you remember any references to how?

I can't find it now, but I seem to remember seeing some option to pay for priority in the account recovery options when resetting one of my accounts in the past.You could always try it on one of your accounts and see.

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#39

Post by codeshaman »

To me this is a serious downside of cryptocurrencies - the fact that criminals have this secure channel of stealing from victims.

Besides malware, one can be blackmailed with information disclosure (everyone has secrets), one can be physically bullied into transferring his BTC or forced to pay bribes by police or corrupt authorities. In western countries some of these may seem impossible, but in a lot of places, police or authorities are worse than criminals. And of course good old hacking.

It's also a very good incentive for maybe-criminals to actually go and do the crime - because the risks of being caught are very small.

One counter argument is that it's possible to steal cash anonymously too, but of course it's not the same thing, just like crypto is not cash.

This is serious problem with (anonymous) crypto and it will only grow bigger and bigger as it goes more mainstream..

Re: For Ransom, Bitcoin Replaces the Bag of Bills

#40

Post by DrJokepu »

rtpg wrote: post #21
superuser2 wrote: post #14

Earlier quoted context omitted.

fastmail.fm is where people disillusioned with GMail traditionally go.

Have you heard any story similar to what's happening with OP where fastmail support ended up resolving the issue quickly and in a timely manner? I'm not trying to imply that it would be the same, genuinely curious if I can expect better by switching.

I have dealt with Fastmail support in the past, although it was regarding invoicing questions, not identity fraud. My experiences were fairly positive.
Post reply on HN