Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

131–140 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#131

Post by sbov »

evanmoran wrote: post #48
rdl wrote: post #43

Earlier quoted context omitted.

You don't have as many computers as I do, or as long a password as I do, I suspect. Having to type a random long passphrase with special characters on the weird keyboards of multiple devices every month was a pain. Even worse, for devices I infrequently use, I ended up basically having to do this every single time I wanted to use the device.

http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines

I like to use keepass with a long, memorable password and key file that I need to manually copy across machines.

So even if they get my password database and my password they don't have the key file. And if they can get the key file, they could have gotten the password database anyways.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#132

Post by mick_dundee »

Two-factor authentication is important for online security (and not just email accounts), but there are other lessons to be learned from Mat Honan's misfortune. I'm probably more extreme in my practices than most people, but I'm OK with the inconviences.

- You can't rely on companies providing online services to have your best interests as their best interests. - Take security seriously because if you don't you won't know about an attack until it's done. - Don't use a vendor's all-in-one services. - Don't use "the cloud" as a backup source. - Back up frequently. - Don't use one email account for everything. - Have an email account that is used for recoveries and nothing else... and keep it obscure. e.g: x90x90recovx@someotherhost.com - Don't use personal credit cards for online purchases. - If it's an option, don't store credit card details against your account; choose to manually enter it every time. - Don't use the same credit card for multiple sources of online shopping/billing/etc. - Don't give real answers to "security questions", such as your mother's maiden name or the name of your first pet. - Don't provide real personal information (address, contact number, etc) to online services when you create an account. - Don't use Facebook, Twitter, etc irresponsibly. - Shutdown if you're not at your computer. - Encrypt your data.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#133

Post by pseudonym »

gsa wrote: post #115
tnorthcutt wrote: post #113

Earlier quoted context omitted.

Are you asking if a hacker could use the application-specific password to access your email account? I'm pretty sure the application-specific passwords are only good for the service using them (e.g. the first service to use a newly generated password is the only one allowed to ever use it), but that would be trivial to test for yourself.

I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.

You're perfectly welcome to use the same password multiple times-- it's as secure as you yourself make it. When Google generates an App password, it displays it once-- and then trashes it. On that same page is a list of the identifiers you've given all of your apps, and the last time that identifier's password was used to log into your account. At any point, you can trash a generated password, and anything using that password can't log into your account anymore.

If you use the same generated password for every application, then you're not in that much better a situation than you would be otherwise. If you use different identifiers for each application, you can identify exactly where a breach happened from by last login time, and disable that password entirely.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#134

Post by raverbashing »

ghshephard wrote: post #19
suresk wrote: post #3

Given how central (for better or worse) of a role email plays in safeguarding other accounts, the hassle of 2-factor auth for it is feeling like less and less of an annoyance. About a month ago, one of my credit card accounts got hacked and was used to send money to someone else - the number itself wasn't compromised, it was the actual account. No doubt, the attackers tried to login and change my email password, but…

I've been using google two-factor auth for the better part of a year now, and the annoyance comes down to, once every 30 days or so, having to take 5 extra seconds during login to enter a code sent to my cell phone. I can't _think_ of anything less of a hassle.

Until you really need to check your email for something urgent and of course then the code will take some time to be received by your phone, your phone will be out of battery, etc

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#135

Post by Tichy »

gsa wrote: post #115
tnorthcutt wrote: post #113

Earlier quoted context omitted.

Are you asking if a hacker could use the application-specific password to access your email account? I'm pretty sure the application-specific passwords are only good for the service using them (e.g. the first service to use a newly generated password is the only one allowed to ever use it), but that would be trivial to test for yourself.

I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.

Sounds as if Pidgin is the problem here.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#136

Post by btb »

The scariest part of this article IMO is how there now is a recipe posted for getting into any amazon account. Imagine all the damage/harassment they could do once in there, buy all kinds of stuff and have it sent to you. Spin up 20 EC2 instances and use them to perform illegal activites etc, while burning up cash on your credit card.

That to me seems much worse than having an imac wiped.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#137

Post by metafunctor »

Some banks provide a service which allows you to create unique credit card numbers without actually having to get separate physical credit cards. Kind of like application-specific passwords, but for credit cards.

See here: https://www.citibank.com/us/cards/gen-content/messages/van/i...

Separate credit card numbers for Amazon and Apple would have prevented this hack.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#138

Post by jvdongen »

tnorthcutt wrote: post #113
kmm wrote: post #85

Earlier quoted context omitted.

There's something that bugged me about two-factor the moment I activated it. The application specific passwords are stored in plain-text. How does Google know that it's actually e.g. Chrome accessing my mail with a given application-specific password? If a hacker gets a hold of an old backup of mine, which includes a Pidgin configuration file I forgot to delete, which holds a plaintext password, can he get into my ac…

Are you asking if a hacker could use the application-specific password to access your email account? I'm pretty sure the application-specific passwords are only good for the service using them (e.g. the first service to use a newly generated password is the only one allowed to ever use it), but that would be trivial to test for yourself.

That can't work - how would they identify the service using them? Ip address is useless for this purpose and other identifiers ar either not available or very easily spoofed and thus equally useless. If somebody gets hold of the application specific password, he'llbe able to use said application.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#139

Post by jcheng »

nilsbunger wrote: post #82
danielpal wrote: post #70

Earlier quoted context omitted.

Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?

Good point. But even two-factor auth wouldn't have saved him because the hacker got the customer support people to issue a temporary password. Apple (and others) need to implement better controls on how you reestablish identity once you've lost access.

Wouldn't the hacker still need the temporary password AND the Google Authenticator code? Or are you assuming that the customer support people could and would turn off two-factor auth while resetting the password?

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#140

Post by gsa »

Tichy wrote: post #135
gsa wrote: post #115

Earlier quoted context omitted.

I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.

Sounds as if Pidgin is the problem here.

I know that at first look it sounds like a Pidgin problem, but they do justify their situation quite well on their site: http://developer.pidgin.im/wiki/PlainTextPasswords
Post reply on HN