Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding vulnerable Twitter accounts with expired domains

zainamro.com

Post reply on HN
Print view View original

101–110 of 128 posts

Re: Finding vulnerable Twitter accounts with expired domains

#101

Post by arsome »

Spivak wrote: post #70
varenc wrote: post #63

Earlier quoted context omitted.

Biometrics are unrevokable. If yours are compromised through some other way then you can’t trust biometric authentication for the rest of your life.

But that doesn’t matter! I hate this argument because it misses the point of biometric authentication as “something you are.” There’s no such thing as compromise or revocation. It’s a piece of public information that can’t be stolen or used by anyone other than yourself. The world can have high def scans of my fingerprint for all it matters, they can’t produce a living human finger with the same print. And if you can…

> It’s a piece of public information that can’t be stolen or used by anyone other than yourself.

The point here is that this is completely wrong. Biometrics can be stolen and they're unreplaceable. There's no device in the world that can be sure it's reading a fingerprint from a living human. Drop a quick query into Google, you'll find dozens of methods that fool Apple's TouchID and that's probably one of the more robust implementations as it makes it rather difficult to do something like replace the sensor and feed in fake data directly to the system. There's only so much you can do to tell human flesh from inanimate objects when all you have is a tiny fingerprint sensor.

> Biometrics is not transmitting a picture of a fingerprint, it’s presenting your hand.

Biometrics is read with sensors, sensors produce data, data can be copied. If you were to publish scans you would have effectively allowed anyone the information needed to fake your fingerprint and authenticate as you. That's the definition of compromise.

Re: Finding vulnerable Twitter accounts with expired domains

#102

Post by twicetwice »

knowledge-clay wrote: post #72
twicetwice wrote: post #69

Earlier quoted context omitted.

I want a private key embedded in a chip, that never leaves that chip, so all encryption and decryption happens on that chip—similar to how chip-and-pin credit cards work now. I'm identified by the corresponding public key. Then I want to embed that chip in my hand. Then I can unlock my car, house, computer, or phone and sign into any online service the same way: you send me a challenge token, I sign it with my privat…

The security and privacy implications of this are horrifying to me, as are they to enough of the population that I doubt this will get widespread adoption.

I've thought about this a lot—I'm very interested in both security and privacy, so I wouldn't want to do this if I thought it would compromise either.

My current solution is that the device has three functions: encrypt/sign with private key, decrypt with private key, and send public key. They would be protected by a PIN—probably a six-digit alphanumeric pin. You might want to rate limit PIN attempts to one per second, as well.

With this scheme, I can't see how it would compromise privacy or security. No one can just scan your hand and know your identity, since you need the PIN to get your public key. And since all encryption/decryption happens on the chip, the chance that your private key gets stolen is pretty much as low as possible.

If you see any flaws with this scheme—I certainly wouldn't be surprised if there are, I just can't see any right now—please critique away!

Re: Finding vulnerable Twitter accounts with expired domains

#104

Post by ROARosen »

reaperducer wrote: post #61
0xfffafaCrash wrote: post #50

Earlier quoted context omitted.

In Sweden, BankID covers well over 90% of the population between ages 20 and 60 with a unique electronic ID. (Including 98% of those between 20 and 40.) It supports identifying yourself with a credit card and pin using a card reader given to you by your bank or alternatively (and more commonly) a pin combined with a smartphone/computer that you have identified as being yours.

BankID covers well over 90% of the population between ages 20 and 60 What do the other 206,868 people do? If a similar system were implemented in the United States, that would leave 6,514,383 out. What do you do with six million people who can't be part of the standard ID scheme?

In 2015 9% Americans had never sent an email. https://fivethirtyeight.com/features/lindsey-graham-isnt-alo...

Re: Finding vulnerable Twitter accounts with expired domains

#105

Post by giancarlostoro »

Taek wrote: post #12

At some point in time we decided that email addresses control the keys to the kingdom. If you lose access to your email, there goes your social media accounts, your bank accounts, your gaming accounts, and potentially many of your commercial accounts as well. And then we decided that custom domains are the most professional. Which does make sense, there can only be one 'robert@gmail.com'. But, this is coupled with th…

Maybe there should be some transparent way for mail servers to request public encrypted keys to an email address and any incoming mail gets decrypted by the private key. So if someone hijacks your domain any password reset emails should be gibberish unless they magically got the private key, in which case you have worse problems.

This is the only technique I think might work till someone social engineers people at Twitter.

Re: Finding vulnerable Twitter accounts with expired domains

#106

Post by Moru »

pwdisswordfish0 wrote: post #65
asciident wrote: post #15

Earlier quoted context omitted.

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

> Without emails as the keys to the kingdom, what would you use? PKI. Service providers shouldn't give you access to an account just because you can prove you control an email address (during a narrow and predictable time window, no less). The simplest thing would be to encrypt the relevant part of the payload (the one containing the password reset link), so resets are only possible if you can receive the email and h…

But Photo ID was forged long before the computers came along. There's always some way of getting around the security if you really want to. That is part of why we don't want to give in to electronic voting even though we work with computers.

Re: Finding vulnerable Twitter accounts with expired domains

#107

Post by Moru »

twicetwice wrote: post #100
cortesoft wrote: post #76

Earlier quoted context omitted.

And when I lose that chip, or it is damaged or stolen?

Well, lost or stolen hopefully wouldn't happen if it's embedded in my hand—that's the point of embedding it in my hand! To protect against damage—which is a very real possibility, of course—I'd put identical chips in each hand, and if one fails or gets damaged, then you'd have to rotate keys by replacing both chips. And you could have a third identical chip/key (or a different private key on another device in a safe…

I prefer losing the keys to my email than to lose my hand because someone wants to empty my bank account.

Re: Finding vulnerable Twitter accounts with expired domains

#109

Post by Moru »

PinguTS wrote: post #35
dewey wrote: post #19

Earlier quoted context omitted.

There's a difference between an email address and a social security number in a way that the latter will still be around if you stop paying for it or something happens to you. In some way (at least for this threat model) a gmail address is better than one on your own domain as it's unlikely to go away or get taken over.

Why should my own domain taken over. It can be taken over as easily as someone could take over my gmail. I use my own domain on my own server with my own running mail server. Why should someone take that over? Of course someone with state level hacking experience could do that, but I am not a target for those. Script kiddies have no luck, because you can't even login from the Internet into my server you will need to…

That's the whole beauty with your own domain. They don't have to touch your server at all, it's enough if they can social engineer their way into your account at the DNS provider and point your domain to their own email server. Your security isn't even considered in this case. The only thing that can save you there is how good the DNS security is.

Re: Finding vulnerable Twitter accounts with expired domains

#110

Post by tiaait »

Taek wrote: post #12

At some point in time we decided that email addresses control the keys to the kingdom. If you lose access to your email, there goes your social media accounts, your bank accounts, your gaming accounts, and potentially many of your commercial accounts as well. And then we decided that custom domains are the most professional. Which does make sense, there can only be one 'robert@gmail.com'. But, this is coupled with th…

" but gmail as a single source of failure makes me nervous. Using any email provider besides gmail makes me even more nervous, because they don't have the full power and knowledge of Google protecting their databases. "

Good Practice: Never use gmail for registrations. If you get locked out, that's it. Good luck trying to call google.

Am people have gotten locked out or their gmail accounts been closed. I myself was not able to log into one of my gmail accounts and I had to reset a PW for a domain register that was about to expire. I was able to log in and save it since I managed to boot up an old laptop with a corrupted had drive for a few minutes. The Browser must have had a cockie associated with this gmail account.

Post reply on HN