How Apple and Amazon Security Flaws Led to My Epic Hacking • Hacker News Board

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#141

Post by zwily » Tue, Aug 07, 2012, 5:34 AM UTC

jmillikin wrote: post #109

danielpal wrote: post #70

Earlier quoted context omitted.

Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?

If I'm reading the blog post correctly, his Twitter account was compromised via GMail. If his GMail account had not been compromised, they wouldn't have gained access to his Twitter feed (which was the true target of the attack). They would still have been able to compromise his iCloud account and thus destroy the data stored on his computers. Unfortunately, I think that in this particular case, having two-factor aut…

Password recovery does not bypass two-factor auth.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#142

Post by gsa » Tue, Aug 07, 2012, 5:37 AM UTC

pseudonym wrote: post #133

gsa wrote: post #115

Earlier quoted context omitted.

I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.

You're perfectly welcome to use the same password multiple times-- it's as secure as you yourself make it. When Google generates an App password, it displays it once-- and then trashes it. On that same page is a list of the identifiers you've given all of your apps, and the last time that identifier's password was used to log into your account. At any point, you can trash a generated password, and anything using that…

You are right and that's what I'm going to do. But it's no less secure until you don't "remember" that token anywhere. A remembered password in Google Talk (desktop client) is just encrypted and can be easily recovered.

Edit: To add to my reply, I have never used the remember password for Pidgin in the past, however enabling 2 step auth require me to do that. It'd be great if Google could somehow allow only the first associated app with a password for subsequent uses. Technically that looks very challenging (if at all possible).

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#143

Post by user-id » Tue, Aug 07, 2012, 5:40 AM UTC

gsa wrote: post #115

tnorthcutt wrote: post #113

Earlier quoted context omitted.

Are you asking if a hacker could use the application-specific password to access your email account? I'm pretty sure the application-specific passwords are only good for the service using them (e.g. the first service to use a newly generated password is the only one allowed to ever use it), but that would be trivial to test for yourself.

I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.

If Pidgin is your use-case, the only solution is not using Pidgin.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#144

Post by Legion » Tue, Aug 07, 2012, 5:42 AM UTC

kmm wrote: post #85

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

There's something that bugged me about two-factor the moment I activated it. The application specific passwords are stored in plain-text. How does Google know that it's actually e.g. Chrome accessing my mail with a given application-specific password? If a hacker gets a hold of an old backup of mine, which includes a Pidgin configuration file I forgot to delete, which holds a plaintext password, can he get into my ac…

If you didn't revoke the application-specific password. And you should be revoking them when you're no longer using them.

If you weren't using application specific passwords, of course, it would have been your actual Google password in that Pidgin config.

It's a little disappointing that the app-specific password isn't more secure, but it's certainly not less secure than foregoing them.

App-specific passwords are bypasses of 2-factor auth. Use them selectively and with care, revoke ones you're not using anymore. And replace them from time to time.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#145

Post by cookiecaper » Tue, Aug 07, 2012, 5:44 AM UTC

The fact is that Apple and Amazon have far more confused customers than targets for social engineering attacks. They are always going to have an "I forgot everything about myself and my account, please let me in!" option. All cloud service providers are going to have this.

With this in mind, it may not be wise to remotely link your MacBook such that it can be wiped by Apple Central Command. Do people seriously do that? A phone is maybe kind of reasonable for this kind of thing (only kind of), but your actual laptop? Is this a requirement of new versions of OS X or something? I don't know who would set this up willingly.

Any local data that you want to keep from attackers should be stored as ciphertext. Your secret key should be encrypted with a strong passphrase. Most thieves, even high-level corporate espionage-type thieves, won't know how to use GPG in the first place, but if they do, if you've done it right they won't be able to get in.

From the perspective of keeping ourselves safe in a world where all data is kept on (or hooked up to a remote control at) the server of a big faceless corporation, all plaintext should be considered public info. Just because they haven't published or leaked it yet doesn't mean they won't, and it doesn't mean that anyone with an interest can't go in and take it, or that they won't wreak havoc for an ultimately minor goal (like access to Twitter).

Encryption and backup. The two constantly repeated, never honored mantras whose inconveniences have plagued computer users for decades now. If people did these things correctly, hacks would rarely matter or jeopardize significant amounts of data. This is a field that is ripe for system-level disruption; Time Machine kind of helped with the backup, but we still don't have anything decent for layman's crypto (perhaps because the business models of companies are now so dependent on reading our information and selling it back to interested parties).

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#146

Post by frio » Tue, Aug 07, 2012, 5:45 AM UTC

pseudonym wrote: post #133

gsa wrote: post #115

Earlier quoted context omitted.

I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.

You're perfectly welcome to use the same password multiple times-- it's as secure as you yourself make it. When Google generates an App password, it displays it once-- and then trashes it. On that same page is a list of the identifiers you've given all of your apps, and the last time that identifier's password was used to log into your account. At any point, you can trash a generated password, and anything using that…

Kind of. This is the reason 2-factor makes me uncomfortable too: instead of having 1 username/1 password, it's actually 1 username/lots of passwords. And the passwords generated are all lowercase alphabetic characters (I assume to make them easier for users who don't/can't copy-paste).

It'd make me a lot more comfortable if I could lock each password down to a specific Google service (for instance: generate an OTP for Pidgin, and enable it only for Google Talk), they were a lot longer, and had special chars + numbers in them.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#147

Post by dnaquin » Tue, Aug 07, 2012, 5:45 AM UTC

jrockway wrote: post #71

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

Facebook. See https://www.facebook.com/settings?tab=security&section=a...

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#148

Post by LVB » Tue, Aug 07, 2012, 5:50 AM UTC

nl wrote: post #57

Last time HN discussed this story, I said "turn on 2-factor authentication for your Google account". Unsurprisingly, I got the exact reaction I'm seeing here when it has been suggested: lots of questions about how it works, people who think their situation is unique so it won't work for them, and people complaining than SMS is insecure. 1) Don't ask anymore questions. Try it out, if you hate it turn it off. 2) Your s…

Definitely print the codes! As a newbie I didn't, and as luck (or a 1/30 chance) would have it, I forgot my phone at home the same day my 30-day login window expired at work. Not a huge deal but a bit of a PITA, and there really was no way to log in until after I got home (which is obviously the point).

Now I have some codes squirreled away in a couple key locations.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#149

Post by Groxx » Tue, Aug 07, 2012, 5:52 AM UTC

jamesbritt wrote: post #120

dkersten wrote: post #98

Earlier quoted context omitted.

These "security" questions are usually, IMHO, the weakest link.

That's why you make stuff up when initially providing the answers to be used.

and then immediately forget them, and discover that they weren't really necessary anyway and your lets you in with other questions.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#150

Post by Kerrick » Tue, Aug 07, 2012, 5:52 AM UTC

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

I was wary to set up 2FA until I learned that you can set it up even without a cellphone or your own computer. You can have the second factor be a voice call, so it can call a landline or dumbphone without an SMS plan. Plus, if you ever lose your phone or cancel your number, you can set up backup phone numbers. I set up my fiancee's phone number as a backup number in case I ever lose my phone.