Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoToMyPC has been hacked, all customer passwords reset

status.gotomypc.com

Post reply on HN
Print view View original

131–140 of 171 posts

Re: GoToMyPC has been hacked, all customer passwords reset

#131

Post by saidajigumi »

shabble wrote: post #86
hackuser wrote: post #78

Earlier quoted context omitted.

> This is not a good suggestion on their part, and has long been proven ineffective: Agreed; that is bad advice. I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g.,…

Are there any good sources on what sort of generative trickery a good cracking tool will use? I've noticed that the OSX Keychain 'memorable' password suggestions are almost always /(\w+\d+[[::punc::]]+\w+)/, which is enough of a pattern to probably make an explicit generator for which will match much faster than a naive brute-force.

Note that what you're really looking for is the amount of entropy in the encoding. So for many 'memorable' encodings, the password does need to be longer vs. an alphanumeric+symbols password, but still encodes the same number of bits of entropy.

Diceware[1] is a nice example of how such a system works, and how you can generate a strong 'memorable' password by hand (and dice ;-). In short, there's a dictionary of short words, letter combinations, and numbers that form the "symbols" of the generated password. A random input (here, rolls of dice) are used to select a series of symbols. You could just as well create your own table and generate the password from that, but if you've got enough randomness as input then it doesn't so much matter what encoding you use. In fact, the general assumption is that you should assume your attacker knows your encoding.

[1] http://world.std.com/~reinhold/diceware.html

Re: GoToMyPC has been hacked, all customer passwords reset

#132

Post by frozenport »

jrockway wrote: post #18
frozenport wrote: post #12

Earlier quoted context omitted.

What you're saying is more drastic then what they wrote here. If you used the same password somewhere else, then you're going to have change all those passwords.

Of course you do. That's why you don't reuse passwords. Why would you trust your other accounts to their internal investigation + PR interpretation anyway?

Because I'm human and can't maintain 30+ passwords?

Re: GoToMyPC has been hacked, all customer passwords reset

#133

Post by chc »

gkop wrote: post #118
ams6110 wrote: post #109

Earlier quoted context omitted.

Is it still the case that for most ISPs the uplink is much slower than the downlink speed? That was one reason running anything other than limited-use servers from your home wasn't feasible.

With the advent of streaming TV and movies, for many of us now the reverse is true.

How do streaming movies make your uplink faster than your downlink?

Re: GoToMyPC has been hacked, all customer passwords reset

#134

Post by zo1 »

zo1 wrote: post #106
voltagex_ wrote: post #94

Earlier quoted context omitted.

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,10…

Too late to edit my post. I made a bit of a mistake referring to it as factorial.

Re: GoToMyPC has been hacked, all customer passwords reset

#135

Post by TylerE »

zo1 wrote: post #106
voltagex_ wrote: post #94

Earlier quoted context omitted.

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,10…

Technically true perhaps, but from my experience the word selection is always way narrower than that, like usually from maybe the 2000-5000 most common words.

Still a big number, but not astronomically big.

Re: GoToMyPC has been hacked, all customer passwords reset

#136

Post by zo1 »

hackuser wrote: post #117
zo1 wrote: post #106

Earlier quoted context omitted.

The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,10…

I agree with your general point, but I have just a couple of mathematical points: > For a normal 5 letter (alpha-numeric only) password: > 36 With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100. > factorial The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So us…

>"The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)"

You're absolutely right, not sure why I got ahead of myself with using factorial so incorrectly.

Re: GoToMyPC has been hacked, all customer passwords reset

#137

Post by gkop »

chc wrote: post #133
gkop wrote: post #118

Earlier quoted context omitted.

With the advent of streaming TV and movies, for many of us now the reverse is true.

How do streaming movies make your uplink faster than your downlink?

Other subscribers in the cell consume more downlink than uplink, in a steep ratio.

Re: GoToMyPC has been hacked, all customer passwords reset

#138

Post by mhurron »

hackuser wrote: post #119
edent wrote: post #20

Earlier quoted context omitted.

A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…

> I use https://lastpass.com/ I feel like it's almost certain that Lastpass is owned, as are other popular online password stores. No security is perfect; all you can do is make it more expensive than it's worth to the attacker. How much would it be worth to have all the passwords to every account of every Lastpass user? Does Lastpass really have the resources and skill to protect something that valuable? Is it even…

Well as long as you 'feel' that way, it must be true.

Lastpass (supposedly) stores the encrypted password vault, never the decrypted. Decryption occurs on the users end. You would need to either have a keylogger on the target users machine to grab their master password, or compromise the software. Neither is impossible, but both are a little harder than simply break in and access Lastpass's storage.

I say supposedly because I do not know of any 3rd party verification.

Re: GoToMyPC has been hacked, all customer passwords reset

#139

Post by kbaker »

0xmohit wrote: post #45
edent wrote: post #20

Earlier quoted context omitted.

A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…

> I use https://lastpass.com/ for generating passwords. ... Would prefer open source, but nothing else comes close. On a linux/unix system, one could use /dev/urandom: tr -dc '[[:alnum:][:punct:]]' would generate a 16 character long password . One could even put the following function in $HOME/.bash_profile or such genpw() { tr -dc '[[:alnum:][:punct:]]' Now invoking it by saying genpw would generate a pseudorandom s…

pwgen already exists, working exactly like you were thinking.

    $ pwgen 16 1
    siaJa9fohnie9aew
Though, you should use lastpass or similar for many other reasons. Not just generating passwords, but for managing them.

Re: GoToMyPC has been hacked, all customer passwords reset

#140

Post by School-Cotton »

zo1 wrote: post #136
hackuser wrote: post #117

Earlier quoted context omitted.

I agree with your general point, but I have just a couple of mathematical points: > For a normal 5 letter (alpha-numeric only) password: > 36 With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100. > factorial The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So us…

>" The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/) " You're absolutely right, not sure why I got ahead of myself with using factorial so incorrec…

You were probably thinking about the fact that picking, in order, 5 elements taken from a set of 1000 elements yields (1000 factorial) / (995 factorial) possible combinations.
Post reply on HN