Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoToMyPC has been hacked, all customer passwords reset

status.gotomypc.com

Post reply on HN
Print view View original

141–150 of 171 posts

Re: GoToMyPC has been hacked, all customer passwords reset

#141

Post by drdaeman »

rzzzt wrote: post #103
tonmoy wrote: post #42

Earlier quoted context omitted.

If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain

"service1" could be generated randomly as well, and stored along with the password in a password manager. Another nice property of this suffix is that one can identify who gave away their email address / which site it was scraped from when receiving spam; not sure where I have seen this written down originally.

I think when spammers see a "+" they just strip everything after it down, i.e. me+spam@example.org -> me@example.org. Not to say many sites just don't accept "+" (or, worse, cease to accept such addresses).

Unique, non-guessable, machine-generated addresses are the way to go (do with emails just like password managers do with passwords), but no common person can use those, because they'll need a domain and self-hosted MDA.

E.g.

    $ echo "$(echo -en "secretsalt\nsome.example.net" | sha1sum -b | xxd -r -p | base36 | cut -c-8)@me.example.org" 
    h6t8490d@me.example.org
Or just generating random IDs and maintaining the database.

(Sure, HMAC would be a better idea than this string concatenation, but meh...)

Re: GoToMyPC has been hacked, all customer passwords reset

#142

Post by vladimir-y »

edent wrote: post #125
roddux wrote: post #46

Earlier quoted context omitted.

KeePassX ( https://www.keepassx.org/ ) is free and open source password manager. Having never tried LastPass I can't vouch that it's feature compatible, but it covers all my needs.

I did look at KeePassX - but it doesn't seem to have reliable autofill in Chrome & Firefox (where I use 99% of my passwords). It also means I have to manually synchronise the database between phone, PC, etc. The hunt continues!

> I did look at KeePassX - but it doesn't seem to have reliable autofill in Chrome & Firefox

It does have browser integration, for both Chrome - ChromeIPass extension, and Firefox - KeeFox extension. Both extension work via KeePassHttp plugin. Works well on Arch Linux.

Re: GoToMyPC has been hacked, all customer passwords reset

#143

Post by vladimir-y »

vladimir-y wrote: post #142
edent wrote: post #125

Earlier quoted context omitted.

I did look at KeePassX - but it doesn't seem to have reliable autofill in Chrome & Firefox (where I use 99% of my passwords). It also means I have to manually synchronise the database between phone, PC, etc. The hunt continues!

> I did look at KeePassX - but it doesn't seem to have reliable autofill in Chrome & Firefox It does have browser integration, for both Chrome - ChromeIPass extension, and Firefox - KeeFox extension. Both extension work via KeePassHttp plugin. Works well on Arch Linux.

I meant KeePass http://keepass.info/ writing about browser integration (in my case I run it on mono), not the KeePassX. KeePassX is a very simple app in comparison with KeePass, so I prefer KeePass over KeePassX.

Re: GoToMyPC has been hacked, all customer passwords reset

#144

Post by stephengillie »

lukasm wrote: post #47
acmecorps wrote: post #31

Earlier quoted context omitted.

Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.

How do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?

My personal domain is set to forward all email to my Gmail. Since Google is my registrar, it's expectedly simple to configure this. I haven't setup outbound addresses; services rarely need email sent to them, and replying from my Gmail hasn't caused me any problems yet.

Re: GoToMyPC has been hacked, all customer passwords reset

#145

Post by hackuser »

mhurron wrote: post #138
hackuser wrote: post #119

Earlier quoted context omitted.

> I use https://lastpass.com/ I feel like it's almost certain that Lastpass is owned, as are other popular online password stores. No security is perfect; all you can do is make it more expensive than it's worth to the attacker. How much would it be worth to have all the passwords to every account of every Lastpass user? Does Lastpass really have the resources and skill to protect something that valuable? Is it even…

Well as long as you 'feel' that way, it must be true. Lastpass (supposedly) stores the encrypted password vault, never the decrypted. Decryption occurs on the users end. You would need to either have a keylogger on the target users machine to grab their master password, or compromise the software. Neither is impossible, but both are a little harder than simply break in and access Lastpass's storage. I say supposedly…

I didn't make that claim; why add that attitude to an otherwise pleasant conversation?

When disagreeing, please reply to the argument instead of calling names. E.g. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."

https://news.ycombinator.com/newsguidelines.html

Re: GoToMyPC has been hacked, all customer passwords reset

#146

Post by hackuser »

sandworm101 wrote: post #122
hackuser wrote: post #115

Earlier quoted context omitted.

> It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. They reduce complexity: It reduces the number of possibilities on the first character, and the attacker knows that one word must be a (conjugated? present participle?) verb yet, when otherwise it could be anything.

Those are rules in the user's head. We assume that the enemy only knows that the user is chaining words.

That might not be true for an enemy who has access to some of your other passwords already, but assuming it is I still don't see how the strategy above increases complexity. At best, the complexity remains the same.

Re: GoToMyPC has been hacked, all customer passwords reset

#147

Post by Hondor »

TylerE wrote: post #135
zo1 wrote: post #106

Earlier quoted context omitted.

The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,10…

Technically true perhaps, but from my experience the word selection is always way narrower than that, like usually from maybe the 2000-5000 most common words. Still a big number, but not astronomically big.

It's big enough to matter. 2000^5 ~= 60^9 so it's as strong as a 9 random character password which is usually regarded as strong enough, and far better than a typical 1 word with 3 or 4 special characters mixed in.

Re: GoToMyPC has been hacked, all customer passwords reset

#148

Post by Mandatum »

edent wrote: post #20
wsr wrote: post #3

As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!

A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…

What provider do you use that allows for catch-all? I really like GMail but the lack of support is really annoying, and a lot of sites & dump leaks are beginning to ignore the "+word" notation for email addresses.

Re: GoToMyPC has been hacked, all customer passwords reset

#149

Post by Hondor »

zeta0134 wrote: post #80
walrus01 wrote: post #77

Earlier quoted context omitted.

In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router. One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set…

If you're on a Windows system this is even easier. Go to System -> Remote Desktop Connections and check the box to enable incoming connections. On your router, forward port 3389 to the machine you want to access. On any client device running Windows (linux/mac can use FreeRDP, for which there are numerous wrappers) connect to your home's Public IP, and log in with your computer's usual username and password. For the…

Thanks. So it sounds like port forwarding is the major barrier. That and having to remember your IP address and update it every time it changes.

I wonder if IPVv6 would help here? Would we expect to get a static IP address for a device that can stay the same even when we're connected to different networks or via mobile data and wifi? That would mean even different network interfaces in the device would need to share the same address so I guess it still won't happen.

Re: GoToMyPC has been hacked, all customer passwords reset

#150

Post by EdHominem »

xoa wrote: post #121
mcpherrinm wrote: post #97

Earlier quoted context omitted.

One time pads are rarely useful: The key is as big as the data, so you need a secure channel to transmit the key. If you had that channel, why not just transmit the data over it?

Your mistake here is failing to consider that sharing an entropy pool does not (and in fact should not, it must be shared out-of-band anyway) need to be real time. Fundamentally, OTPs involve leveraging physical security and fleeting points of physical contact to create a pre-shared perfectly secure future communication channel. Ie., two people meet up an exchange a USB stick (or HDD), then consume the entropy pool o…

> The issues with OTP [...]

The primary issue is that through misuse it degrades almost instantly from unbreakable to "little better than ROT13". And, it still appears secure to the hapless user.

Post reply on HN