Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alleged leak of more than 5M Gmail accounts

isleaked.com

Post reply on HN
Print view View original

131–140 of 141 posts

Re: Alleged leak of more than 5M Gmail accounts

#131

Post by the_af »

blueskin_ wrote: post #130
the_af wrote: post #98

Earlier quoted context omitted.

Is this enough, though? Probably to prevent an attacker from stealing your account, but not to stop them from reading your emails. Do you encrypt your emails? Do you regularly send emails to other people (who probably have Gmail accounts)?

>Probably to prevent an attacker from stealing your account, but not to stop them from reading your emails. Since nothing important goes to them any more and I mainly keep them active to stop them getting squatted for for some highly intermittent email (3+yrs) I might have forgotten, then it doesn't matter much there. As it is, the main attacker where gmail is concerned is google itself, followed by the NSA. As for o…

The problem is that, as a security solution, having your own mail server and being careful about who you send emails to doesn't scale and it's not feasible in the general case. If you're worried about Google/NSA/spies as the main attackers, I'm not sure hosting your email is the best solution. Yes, it works if you never send email to anyone with Gmail, Yahoo, Hotmail, etc. But that will prevent most normal uses of email. And if you do send email to regular people, then someone, somewhere, will read your emails; that's what they are for after all. And then the privacy of your email is as good as the security measures your recipient has in place.

Same with 2FA: it's a security measure to make it difficult for an attacker to gain access to your account, and one all of us should use, but it's not there to prevent them from reading your emails.

Maybe the overall solution is "don't use email -- self-hosted or otherwise -- for anything sensitive, ever." This will probably work, but is not feasible for most of us.

Re: Alleged leak of more than 5M Gmail accounts

#132

Post by marcodena »

sinak wrote: post #32

Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services: - Google: https://www.google.com/landing/2step/ - Github: https://github.com/settings/security - AWS: http://aws.amazon.com/mfa/virtual_mfa_applications - Facebook: https://www.facebook.com/settings?tab=security - Twitter: https://twitter.com/settings/security - Dropbox: https://www.dropbox.com/acco…

I would add Mitro.co, which is Open Source (http://www.marcodena.it/blog/stop-remembering-passwords/)

Re: Alleged leak of more than 5M Gmail accounts

#134

Post by rodrigorega »

bagels wrote: post #2

Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it. I generally don't bother, because it's just more security risks.

To avoid this, I made this script to check if my email addresses are in a leak list: https://github.com/rodrigorega/wordlist_compare

Re: Alleged leak of more than 5M Gmail accounts

#135

Post by mlatu »

nzadrozny wrote: post #117
sp332 wrote: post #110

Earlier quoted context omitted.

I have ssh-agent for SSH. Can we get something similar for websites?

Actually, I was recently pointed at Joyent's node-http-signature[1], which is pretty clever. It can sign an HTTP request using one's SSH keys. Handy for a CLI client for a HTTP API. I've done a couple of HTTP auth schemes for my dayjob and am thinking of using something like this for my next. 1. https://github.com/joyent/node-http-signature/blob/master/ht...

http://blog.cryptographyengineering.com/2012/12/the-anatomy-...

as long as we need to depend on javascript for crypto there will not be a secure way to do such things. im saying this because you can not safely assume the integrity of your crypto system to be intact if you have to download it with the page it's used on. thats about the same as always having to download your ssh client first from the server you are connecting to. someone could tinker with that download and give you something that uses the attacker as a proxy to connect to your server of choice and while you notice nothing, that malware would upload your private key. same thing could happen when you use some sort of crypto implemented in javascript.

lets talk about this when someone made it possible to have a website instruct the browser to make a call to a crypto library or some such

Re: Alleged leak of more than 5M Gmail accounts

#136

Post by mlatu »

polarix wrote: post #23
durrrrrrr wrote: post #10

Earlier quoted context omitted.

Are you being serious? Next time you search google, would you rather they display 5,000,000 results on one page and you Ctrl+F the response?

If the local client could handle it, this would be a much more secure way of browsing.

i sure hope you are beeing sarcastic, if not, consider this: it is possible to use javascript to override ctrl+f or other keystrokes. if that site would have displayed the list, and someone used ctrl+f on it, they could have simply used such a technique to add your input to the list to generate positive findings on the fly.

http://arstechnica.com/security/2012/12/how-script-kiddies-c...

Re: Alleged leak of more than 5M Gmail accounts

#137

Post by mlatu »

durrrrrrr wrote: post #10
joeblau wrote: post #6

Earlier quoted context omitted.

Exactly. just show me the list and let me do a command+f. I'm not trying to enter my email into their system.

Are you being serious? Next time you search google, would you rather they display 5,000,000 results on one page and you Ctrl+F the response?

you should reconsider this, because it is possible to use javascript to override ctrl+f or other keystrokes. if that site would have displayed the list, and someone used ctrl+f on it, they could have simply used such a technique to add your input to the list to generate positive findings on the fly.

http://arstechnica.com/security/2012/12/how-script-kiddies-c...

Re: Alleged leak of more than 5M Gmail accounts

#138

Post by mlatu »

rodrigorega wrote: post #134
bagels wrote: post #2

Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it. I generally don't bother, because it's just more security risks.

To avoid this, I made this script to check if my email addresses are in a leak list: https://github.com/rodrigorega/wordlist_compare

nice.. i'll use grep instead, thanks for the effort though

Re: Alleged leak of more than 5M Gmail accounts

#139

Post by TheDong »

mlatu wrote: post #135
nzadrozny wrote: post #117

Earlier quoted context omitted.

Actually, I was recently pointed at Joyent's node-http-signature[1], which is pretty clever. It can sign an HTTP request using one's SSH keys. Handy for a CLI client for a HTTP API. I've done a couple of HTTP auth schemes for my dayjob and am thinking of using something like this for my next. 1. https://github.com/joyent/node-http-signature/blob/master/ht...

http://blog.cryptographyengineering.com/2012/12/the-anatomy-... as long as we need to depend on javascript for crypto there will not be a secure way to do such things. im saying this because you can not safely assume the integrity of your crypto system to be intact if you have to download it with the page it's used on. thats about the same as always having to download your ssh client first from the server you are con…

He did not say web or browser. He said nodejs. Node can call native crypto libraries, but also is not subject to the mitm issue.

Please read up on what "nodejs" is before lambasting it with an oft repeated security trope.

Re: Alleged leak of more than 5M Gmail accounts

#140

Post by nzadrozny »

TheDong wrote: post #139
mlatu wrote: post #135

Earlier quoted context omitted.

http://blog.cryptographyengineering.com/2012/12/the-anatomy-... as long as we need to depend on javascript for crypto there will not be a secure way to do such things. im saying this because you can not safely assume the integrity of your crypto system to be intact if you have to download it with the page it's used on. thats about the same as always having to download your ssh client first from the server you are con…

He did not say web or browser. He said nodejs. Node can call native crypto libraries, but also is not subject to the mitm issue. Please read up on what "nodejs" is before lambasting it with an oft repeated security trope.

> He did not say web or browser. He said nodejs.

Indeed; more generally, I said CLI. TLDR of the previous link: it's an interesting general-purpose take on using ssh public/private keys (and methods) to sign and authenticate HTTP requests.

Post reply on HN