Break into my email: get $10,000. Here is my username and password.
strongwebmail.com
Break into my email: get $10,000. Here is my username and password.
1–10 of 61 posts
Re: Break into my email: get $10,000. Here is my username and password.
#2the email/password combo given in the blog is invalid. i get an error.
Re: Break into my email: get $10,000. Here is my username and password.
#3I worked on something similar in the 90s. One of the problems that we found was that people dislike having to answer their phone late at night. (Or making phone calls, for that matter.)
The biggest security risk we found wasn't the second form of authentication; it was making sure it was just as hard to add other phone numbers. Then there were instances of disconnected phones, dead cell phones, etc to deal with.
If these guys can make it all work successfully and be profitable, more power to them; it's an uphill battle for sure.
I'm not working on it any more, so I'll offer some free suggestions to them:
* Offer other means of authentication - biometric seems pretty popular, but you lose mobility. Rolling keycode generators are also nice (and not terrible to implement).
* Double-check your security at the data center. I was working on secure data storage, not email, so the problem set was slightly different. However, there was some technology we were looking at licensing that used a physical air-gap on a router to remove data from the network when it wasn't authorized to be online. Probably not economical for individual email accounts; but possibly useful for bigger clients. As an example, years ago I was talking to someone at a Proctor & Gamble research facility. All of their computers used detachable hard drives (well, Iomega Jaz drives, but still) and at the end of the day, every drive got removed from the computer and locked into a safe. That way if there was an intrusion, the data was totally inaccessible.
* Add an sms interface that would just text someone a keycode (similar to a rolling code generator, but would just require a cell phone).
Re: Break into my email: get $10,000. Here is my username and password.
#4This is out of my field, but how do you all think this will be compromised?
My guess would be by spoofing the CEO's home IP & cookie to bypass the verification, based on this paragraph from the site:
"Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required."
Does that seem like a big hole to anyone else?
Re: Break into my email: get $10,000. Here is my username and password.
#5"Here’s the thing, in order to get into a StrongWebmail account, the account owner must receive a verification call on their phone. This means that even if your password is stolen, the thief can’t access your email because they don’t have access to your telephone."
Great. Users will love receiving calls at all hours as script kiddies in Russia try to log in to their accounts.
"Break into my email: get $10,000. Here is my username and password. Username: CEO@StrongWebmail.com Password: Mustang85"
Great! Let's give it a go:
Error Logging In
We could not log you into your account because of the following error(s):
The username or password you entered is incorrect, or your account has been suspended/closed.
Re: Break into my email: get $10,000. Here is my username and password.
#6Sounds like a fun way to launch a DoS attack on someone's phone when you only know their email address.
Re: Break into my email: get $10,000. Here is my username and password.
#7users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required."
1) Compromise targets computer using some known exploit
2) Retrieve cookie
3) Profit
Re: Break into my email: get $10,000. Here is my username and password.
#8This is out of my field, but how do you all think this will be compromised? My guess would be by spoofing the CEO's home IP & cookie to bypass the verification, based on this paragraph from the site: "Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required.…
Also people have cracked telephonic networks in the past. Why can't they do it again?
Re: Break into my email: get $10,000. Here is my username and password.
#9Ten THOUSAND dollars.
That's literally, like, an entire FRACTION of what an application penetration test costs!
They must really be serious!
[quick edit: I really hate talking about numbers here, because if you have some bootstrapped YC-style company and you're worried about security, I'd love to think you could reach out to us and not have us try to get into you for tens of thousands of dollars --- but for an actual security assessment with a public statement at the end of it this is way, way south of what the market pays]
Re: Break into my email: get $10,000. Here is my username and password.
#10This is out of my field, but how do you all think this will be compromised? My guess would be by spoofing the CEO's home IP & cookie to bypass the verification, based on this paragraph from the site: "Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required.…
If it were me, I'd probably go to work on the database that stored the phone numbers first.