Wait, you have to receive a phone call every time you want to check your email from a different computer than usual? This sounds incredibly annoying - especially if someone's actually trying to break into your account.
Break into my email: get $10,000. Here is my username and password.
11–20 of 61 posts
Re: Break into my email: get $10,000. Here is my username and password.
#12This is out of my field, but how do you all think this will be compromised? My guess would be by spoofing the CEO's home IP & cookie to bypass the verification, based on this paragraph from the site: "Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required.…
Also people have cracked telephonic networks in the past. Why can't they do it again?
Definitely. I read recently that a certain model of Nokia from a certain German factory are in high demand because they make it so easy to clone numbers. So I'd imagine cloning the number is one way through, but I wonder if there's not an even simpler way in.
Re: Break into my email: get $10,000. Here is my username and password.
#13Sounds like a fun way to launch a DoS attack on someone's phone when you only know their email address.
You need the correct password as well. The phone verification takes place after the username/password authentication.
Re: Break into my email: get $10,000. Here is my username and password.
#14"Here’s the thing, in order to get into a StrongWebmail account, the account owner must receive a verification call on their phone. This means that even if your password is stolen, the thief can’t access your email because they don’t have access to your telephone." Great. Users will love receiving calls at all hours as script kiddies in Russia try to log in to their accounts. "Break into my email: get $10,000. Here i…
But look at how much free press they are getting.
Re: Break into my email: get $10,000. Here is my username and password.
#15This is out of my field, but how do you all think this will be compromised? My guess would be by spoofing the CEO's home IP & cookie to bypass the verification, based on this paragraph from the site: "Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required.…
Assuming that they use a strong enough cookie (eg, containing a randomized unique key that's verified by the server) and all connections are made over SSL, it should basically be as resistant to remote attack as the person's cellphone (eg, SIM chip spoofing to get two cells on the network under the same call number).
I say that here, the weak points are the user and the cellphone; I think that the barriers to usage that the site sets up will most likely deter all but the most paranoid users from using it.
Re: Break into my email: get $10,000. Here is my username and password.
#16>> "Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required."
So all an attacker needs to do is get access to your home or work computer...
Re: Break into my email: get $10,000. Here is my username and password.
#17"Here’s the thing, in order to get into a StrongWebmail account, the account owner must receive a verification call on their phone. This means that even if your password is stolen, the thief can’t access your email because they don’t have access to your telephone." Great. Users will love receiving calls at all hours as script kiddies in Russia try to log in to their accounts. "Break into my email: get $10,000. Here i…
But look at how much free press they are getting.
Indeed! Since the username and/or password are invalid anyway, why not make it a cool million dollar contest? Or for that matter, a billion? Perhaps it would be a trifle TOO obvious.
Re: Break into my email: get $10,000. Here is my username and password.
#18Ten THOUSAND dollars. That's literally, like, an entire FRACTION of what an application penetration test costs! They must really be serious! [ quick edit: I really hate talking about numbers here, because if you have some bootstrapped YC-style company and you're worried about security, I'd love to think you could reach out to us and not have us try to get into you for tens of thousands of dollars --- but for an actua…
Low quality distributed penetration testing is cheap :).
Re: Break into my email: get $10,000. Here is my username and password.
#19Wait, you have to receive a phone call every time you want to check your email from a different computer than usual? This sounds incredibly annoying - especially if someone's actually trying to break into your account.
Annoying in a good way -- you need to change your password ASAP.
Re: Break into my email: get $10,000. Here is my username and password.
#20Ten THOUSAND dollars. That's literally, like, an entire FRACTION of what an application penetration test costs! They must really be serious! [ quick edit: I really hate talking about numbers here, because if you have some bootstrapped YC-style company and you're worried about security, I'd love to think you could reach out to us and not have us try to get into you for tens of thousands of dollars --- but for an actua…
Right, hence crowdsourcing.