151–160 of 220 posts
Earlier quoted context omitted.
Passwords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.
I agree. However I have yet to see a better alternative. Are there any out there?
Earlier quoted context omitted.
I agree. However I have yet to see a better alternative. Are there any out there?
Absolutely! My favorite is usually referred to as passwordless authentication, and generally means that when a user gives you their email address/SMS/etc, you send a login link to their device. Here's an article: https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483...
So although I do agree with you (and have created sites in the past that do passwordless login), the general password problem doesn't really get solved with this approach.
EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your accoun…
> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.
Although I guess if you had a circular recovery chain of this google account depending on a different email that depended on this google account, the attacker could use your email to recover the other email then use the other email to recover this google account. So it might be wise to change the passwords to everything.
Earlier quoted context omitted.
I agree. However I have yet to see a better alternative. Are there any out there?
Absolutely! My favorite is usually referred to as passwordless authentication, and generally means that when a user gives you their email address/SMS/etc, you send a login link to their device. Here's an article: https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483...
Earlier quoted context omitted.
It's really a question of how malicious the author was- if they set it up to download everything attached to the account as soon as it connected, it could still cause a lot of damage.
Even worst: The hacker could have taken a list of lets say the top 1000 banking (or any type of online service) websites accross the globe. The moment the hacker get access to your gmail account, he initiatite a password recovery request on each of those 1000 websites, get the password reset link from the email, reset the password, delete the email. he could now have access to any other online account you have that h…
(or is that somehow against the 'only our anonymized ad display program can scan your email' privacy policy?)
Earlier quoted context omitted.
> Each box has a 50 email limit (FIFO) which was immediately overwhelmed. That makes me think the malicious author didn't expect this to spread as wide as it did.
It's my guess that Mailinator is extremely irrelevant to their plan. They planned to propagate via BCC but they needed a "To:" address - preferably one that didn't bounce. So they hit the "h" key awhile, then added @mailinator.com
I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…
This was particularly effective because the app was registered as "Google Docs" - to not even filter names of your own products out seems ripe picking for imposter apps.
Mailinator here: Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email. It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial). Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immedi…
I decided gmail wasn't for me when I read they harvested your emails for ads. 1GB in 2004 sounded so enticing too!
If you are technically savvy and have access to a static IP, I highly recommend setting up postfix/dovecot and registering a domain. It's fairly straight forward for technical people. You can have it setup, soup to nuts in an hour or two. There's online docs everywhere.
It's probably not going to be as secure as a gmail, but it's a much smaller target. Most internet providers will give you a static for an extra $5 or so.
Earlier quoted context omitted.
It's my guess that Mailinator is extremely irrelevant to their plan. They planned to propagate via BCC but they needed a "To:" address - preferably one that didn't bounce. So they hit the "h" key awhile, then added @mailinator.com
Why didn't they just send the email to the recipient? What does the BCC add in this context?