Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers account for 90% of login attempts at online retailers

qz.com

Post reply on HN
Print view View original

21–30 of 65 posts

Re: Hackers account for 90% of login attempts at online retailers

#21

Post by daxorid »

jhinra wrote: post #19

I don't buy these numbers at all. 90% seems stupid high for retail. From the report, "[...] we rely on data from the Shape Network. Across the US, Shape’s customers represent: [..] 40% of Mobile Retail (by in-store payments)." "We estimated the number of credential stuffing attacks using the total number of credential stuffing attacks observed on Shape’s US customers and the total proportion of the US industry our cu…

Data point of one incoming. I work in ecommerce. 90% seems stupid low, based on our data.

A couple years ago we were seeing a dozen or so successful login requests per minute against a background of ~40 unsuccessful requests per second.

We were forced to implement rate-limiting on logins, which has resulted in more than a few customer service headaches. But it's now the reality of online retail.

Re: Hackers account for 90% of login attempts at online retailers

#22

Post by jandrese »

drchickensalad wrote: post #11
QUFB wrote: post #9

Earlier quoted context omitted.

Agreed, but keep account recovery in mind. Account recovery is a major pain point for any site that supports TOTP 2FA. If you're not using a TOTP application that supports cloud backup (like Authy), when you lose or replace your mobile device the existing TOTP tokens are useless as they can't be recovered. This results in some type of account recovery process to reintroduce the 2FA tokens. Often these recovery proces…

I'd like to get you started on SMS 2fa. I deal with this a lot at work and would like as much information as possible!

SMS is terribly insecure. Using it as a security system is a bad idea.

SMS verification is more for discouraging bots from making accounts by making it expensive--you need to buy a cell phone. Every SMS verification system refuses to send to VoIP type accounts for this reason.

Re: Hackers account for 90% of login attempts at online retailers

#23

Post by wild_preference »

JustSomeNobody wrote: post #18
kevin_b_er wrote: post #10

Earlier quoted context omitted.

They have to balance user attention and user friction. Online retailers want your purchase to be as smooth as possible. There's some studies on how someone won't spend much time on a website if it loads slow. The same can apply to purchase decisions. They need it as impulsive as possible. So annoying things like 2 factor authentication, in their mind, might make a customer give up their purchase. So things are insecu…

Makes sense, nobody like slow pages. However, don't most people have the browser save their password? So couldn't the online retailer have some sort of exponential delay (to a limit) after so many failed attempts? Surely that would affect few real customers.

What is being delayed? Just an IP address or the entire account? Neither really work.

Re: Hackers account for 90% of login attempts at online retailers

#24

Post by thaumaturgy »

swlkr wrote: post #13
vxNsr wrote: post #12

I recently joined a website the did away with passwords, the only way to login was to enter your email address and confirm by pressing a link in the email, while this adds a pain point for customers it offloads most security implications onto the email provider.

I also do this with websites I make. It is a little inconvenient, but it's worth it, assuming the person logging in as a secure way to access their email (2 factor auth).

It is a lot inconvenient, given the various and myriad issues with guaranteeing email deliverability. Multiple hosting providers use greylisting or something like it which can delay email by minutes to hours, depending on the behavior of the sending mail server. Almost all hosting providers use one or more layers of spam filtration which can incorrectly trap or dispose of your message. Many users have additional mailbox rules set up which may accidentally match your message and route it to an unexpected folder. Relatively small mistakes with things like SPF can further complicate deliverability. You may also use some popular mail delivery service or another, which means that when that service has a bad customer that annoys enough other system administrators, the entire service gets blackballed, your messages along with it. (Hi, SendGrid.)

DigitalOcean's two-factor authentication used email, and email only, which several times caused us some headaches when there was an urgent issue and our person-in-charge couldn't access the account.

I've had a system administrator role for multiple companies over almost 15 years now. I've yet to see a perfectly reliable email system.

Doing password resets over email is one thing (though I think SMS is still better). At that point, the individual no longer has access to their account anyway, and you're dealing with a much smaller number of impacted users. It's much worse to throw up your hands and say, "I don't want to deal with passwords, let's use email", especially now that there are so many good password-handling libraries for so many different development environments and numerous articles on proper password handling.

Re: Hackers account for 90% of login attempts at online retailers

#25

Post by jsoverson »

jandrese wrote: post #22
drchickensalad wrote: post #11

Earlier quoted context omitted.

I'd like to get you started on SMS 2fa. I deal with this a lot at work and would like as much information as possible!

SMS is terribly insecure. Using it as a security system is a bad idea. SMS verification is more for discouraging bots from making accounts by making it expensive--you need to buy a cell phone. Every SMS verification system refuses to send to VoIP type accounts for this reason.

Couple this with the fact that mobile services are also subject to credential stuffing attacks constantly and, for the services that allow you to read SMS messages online, the attackers who take over your mobile account also gain a critical piece of your 2FA protection.

Re: Hackers account for 90% of login attempts at online retailers

#26

Post by vxNsr »

dave5104 wrote: post #20
swlkr wrote: post #13

Earlier quoted context omitted.

I also do this with websites I make. It is a little inconvenient, but it's worth it, assuming the person logging in as a secure way to access their email (2 factor auth).

That's a bold assumption, depending on your audience.

But as others have said either way email is an attack vector because it's often used for account recovery, this way at least it's a lot clearer who is in charge of security, it's the user and the email provider (whether they like it or not).

Re: Hackers account for 90% of login attempts at online retailers

#27

Post by garethadams »

vxNsr wrote: post #12

I recently joined a website the did away with passwords, the only way to login was to enter your email address and confirm by pressing a link in the email, while this adds a pain point for customers it offloads most security implications onto the email provider.

While this will work a very large proportion of the time, and has a big benefit of offloading security as you mention, email is fundamentally asynchronous and can be affected by issues outside of your (and the email providers') control.

Another point that UX designers might make is that this solution necessarily takes users away from your site to complete login, and that can introduce a place for users to drop off. I'm not sure it's that significant, but I've heard it used as an argument.

Re: Hackers account for 90% of login attempts at online retailers

#28

Post by dahart »

Any time I start an ssh server for myself on a publicly accessible IP, hackers account for roughly 100% of login attempts. The legit logins are in the noise, and dictionary attacks on username and password fill the logs. With decent passwords, it's not much concern, but nowadays, I disable password logins completely.

Re: Hackers account for 90% of login attempts at online retailers

#29

Post by reaperducer »

jhinra wrote: post #19

I don't buy these numbers at all. 90% seems stupid high for retail. From the report, "[...] we rely on data from the Shape Network. Across the US, Shape’s customers represent: [..] 40% of Mobile Retail (by in-store payments)." "We estimated the number of credential stuffing attacks using the total number of credential stuffing attacks observed on Shape’s US customers and the total proportion of the US industry our cu…

Bottom line, this data comes from a company whose value proposition is that they sit between your company's servers and your clients and filters bad requests for you.

Bottom line, this data comes from a company in a unique position to see all inbound logins on a large number of e-commerce web sites that random HN cynic can't.

FTFY.

Re: Hackers account for 90% of login attempts at online retailers

#30

Post by thaumaturgy »

jhinra wrote: post #19

I don't buy these numbers at all. 90% seems stupid high for retail. From the report, "[...] we rely on data from the Shape Network. Across the US, Shape’s customers represent: [..] 40% of Mobile Retail (by in-store payments)." "We estimated the number of credential stuffing attacks using the total number of credential stuffing attacks observed on Shape’s US customers and the total proportion of the US industry our cu…

A single source of abuse can easily tilt login statistics.

In a recent compromise that I assisted on, the attacker tried 9,000 different credentials before landing on something that worked. This is on a relatively small site that has maybe 100 legitimate logins per day. On larger, more attractive sites, the ratio would only increase as you'd have multiple concurrent attackers trying everything in their combos lists.

We've since built out a small pile of software to detect and prevent this and similar kinds of abuse. It's not yet SOP for small ecommerce sites, but it should be.

...or just use Shopify and let them deal with it.

Post reply on HN