GoToMyPC has been hacked, all customer passwords reset • Hacker News Board

Re: GoToMyPC has been hacked, all customer passwords reset

#121

Post by xoa » Sun, Jun 19, 2016, 5:33 PM UTC

mcpherrinm wrote: post #97

_asummers wrote: post #89

Earlier quoted context omitted.

> optional one time pads Any good reason why this wouldn't be the default? Speed + key exchange transmissions, maybe?

One time pads are rarely useful: The key is as big as the data, so you need a secure channel to transmit the key. If you had that channel, why not just transmit the data over it?

Your mistake here is failing to consider that sharing an entropy pool does not (and in fact should not, it must be shared out-of-band anyway) need to be real time. Fundamentally, OTPs involve leveraging physical security and fleeting points of physical contact to create a pre-shared perfectly secure future communication channel. Ie., two people meet up an exchange a USB stick (or HDD), then consume the entropy pool over time. These days that could mean trivially having a pool of hundreds of gigabytes to terabytes, which equates to tens of thousands of hours of high quality voice communications, ludicrous amounts of plain text, etc, and that's assuming direct consumption. If instead it's used just for symmetrical session keys then from a human perspective it'll last forever (can burn through thousands of 512-bit keys an hour for an entire lifetime and still be fine).

The issues with OTP include that it doesn't provide authentication, it doesn't scale, pure point-to-point, etc., and that in the end the benefits it offers just don't matter in general right now vs the costs and disadvantages. There's no reason in general not just use a decent pre-shared self-gen cert, PKI or WoT key system instead. OTP applies best to any organization that can already handle physical security. Basically, if an organization moves weapons, money, or drugs around securely then it could move entropy too, so governments, militaries, banks, organized crime and the like. But for anyone to bother all existing crypto would have to be utterly broken, otherwise it's superior to just use standard crypto.

Re: GoToMyPC has been hacked, all customer passwords reset

#122

Post by sandworm101 » Sun, Jun 19, 2016, 5:44 PM UTC

hackuser wrote: post #115

sandworm101 wrote: post #98

Earlier quoted context omitted.

Five or six words is a huge amount of entropy. In reality there are other rules in my example than just using words. It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. And it of a random length, having taken its length from my selection of words rather than from any fixed policy. Few services accept random lengths but imho all should. There is a gr…

> It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. They reduce complexity: It reduces the number of possibilities on the first character, and the attacker knows that one word must be a (conjugated? present participle?) verb yet, when otherwise it could be anything.

Those are rules in the user's head. We assume that the enemy only knows that the user is chaining words.

Re: GoToMyPC has been hacked, all customer passwords reset

#123

Post by sandworm101 » Sun, Jun 19, 2016, 5:54 PM UTC

voltagex_ wrote: post #94

sandworm101 wrote: post #93

Earlier quoted context omitted.

But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

^This shouldn't be downvoted. It is a perfectly valid question.

Re: GoToMyPC has been hacked, all customer passwords reset

#124

Post by wepple » Sun, Jun 19, 2016, 6:38 PM UTC

There are two things that are rapidly becoming negligent not to offer:

- 2FA (mobile, yubikey, duo)

- basic monitoring and notification when login patterns change

These are both relatively simple and effective. You needn't force 2FA, but please offer it.

A password I shared across a couple of test accounts for various services was compromised when one of the sites storing cleartext passwords was popped.

A Microsoft account was the winner of the day - they notified me that a login from $home followed by a login from Brazil looked suspicious, and they were correct. This is basic and often effective.

Re: GoToMyPC has been hacked, all customer passwords reset

#125

Post by edent » Sun, Jun 19, 2016, 6:39 PM UTC

roddux wrote: post #46

edent wrote: post #20

Earlier quoted context omitted.

A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…

KeePassX ( https://www.keepassx.org/ ) is free and open source password manager. Having never tried LastPass I can't vouch that it's feature compatible, but it covers all my needs.

I did look at KeePassX - but it doesn't seem to have reliable autofill in Chrome & Firefox (where I use 99% of my passwords). It also means I have to manually synchronise the database between phone, PC, etc.

The hunt continues!

Re: GoToMyPC has been hacked, all customer passwords reset

#126

Post by edent » Sun, Jun 19, 2016, 6:42 PM UTC

0xmohit wrote: post #45

edent wrote: post #20

Earlier quoted context omitted.

A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…

> I use https://lastpass.com/ for generating passwords. ... Would prefer open source, but nothing else comes close. On a linux/unix system, one could use /dev/urandom: tr -dc '[[:alnum:][:punct:]]' would generate a 16 character long password . One could even put the following function in $HOME/.bash_profile or such genpw() { tr -dc '[[:alnum:][:punct:]]' Now invoking it by saying genpw would generate a pseudorandom s…

O...K... but where do you store them? How do you sync them between devices? How do you auto fill them in the browser? How do you change them when a service is compromised? How do you securely share them with other users?

LastPass does all of that. And I don't even have to drop into the terminal.

Re: GoToMyPC has been hacked, all customer passwords reset

#127

Post by steveeq1 » Sun, Jun 19, 2016, 7:18 PM UTC

magoon wrote: post #49

This is not a good suggestion on their part, and has long been proven ineffective: Substitute numbers for letters that look similar (for example, substitute “0” for “o” or “3” for “E”.

https://xkcd.com/936/

Re: GoToMyPC has been hacked, all customer passwords reset

#128

Post by yborg » Sun, Jun 19, 2016, 7:19 PM UTC

rmdoss wrote: post #48

They don't really say it has been hacked, just that being a target of an advanced password attack. It might mean attackers are using password lists from previous leaks (linkedin), so they decided to force a pass reset to everyone. Or maybe they got hacked. Who knows, not very clear.

As has been proven many times before, "very sophisticated", "advanced", "highly complex" etc. actually generally means "our staff was humiliatingly negligent" in some regard. i.e. they were spearphished and the attacker pulled a password database from their internal network. It seems very odd that they resorted to resetting all passwords instead of just affected or potentially affected accounts as Github did recently.

Re: GoToMyPC has been hacked, all customer passwords reset

#129

Post by tmpanon1234act » Sun, Jun 19, 2016, 8:04 PM UTC

The best part about running a cybersecurity company: lots of easy, free marketing. It's a really good time to be in the industry. It is unfortunate that people are trusting companies to protect their information and it ends up being really hard to do properly. Every able-bodied security engineer really should get in the game since there's money to be made as well as good to be done.

Re: GoToMyPC has been hacked, all customer passwords reset

#130

Post by b3n » Sun, Jun 19, 2016, 8:18 PM UTC

amelius wrote: post #28

wsr wrote: post #3

As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!

I'm hashing my passwords. For example, when logging into any google service, I use: echo "secret123|google" | sha1sum where "secret123" is my master password (I use a much longer one actually to be safe). Similarly, on facebook, I woudl use: echo "secret123|facebook" | sha1sum To both passwords, I add "Aa1!" to make it pass the capital/lowercase etc. tests. EDIT: it is best to write a script for this

I do this too, but with bcrypt instead of sha1.