Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Somebody implemented something I wrote a blog about

news.ycombinator.com

Post reply on HN
Print view View original

241–250 of 253 posts

Re: Tell HN: Somebody implemented something I wrote a blog about

#241

Post by minifyre »

I once contacted Patreon about re-adding support for non-SMS-based 2FA & while the customer service agent didn't seem to entirely understand, they did forward my request to the dev team when I asked. A few days/weeks later, it was back[1]. I'm grateful for all those involved who made that happen, as most companies don't listen when contacted about 2FA.

And tangentially, while I can't be as certain about my involvement in this next part, Nickelodeon eventually uploaded a non-pixelated version of ATLA on Google Play shortly after the second time I contacted them. I still can't understand how an MS Paint quality version was uploaded in the first place, but I'm glad no one else will have to suffer through that like my brother did.

[1] https://blog.patreon.com/TOTP-two-factor-authentication

Re: Tell HN: Somebody implemented something I wrote a blog about

#242

Post by v64 »

duckmysick wrote: post #233
v64 wrote: post #171

> Tell people about things you do that they played a part it- it might just make their day. Thank you for putting this out there! I once reverse engineered the protocol for a popular mobile game so I could write my own client for it and posted my library online for others to do the same without any expectation it'd ever get seen. Months later, I received an email from someone reverse engineering the protocol as well…

Impressive story! Did the devs try to further obfuscate the protocol after they discovered your library?

By that point, I no longer played and the game had gone through a rewrite that used a new API, so my library no longer worked and I never updated it for v2.

Re: Tell HN: Somebody implemented something I wrote a blog about

#243

Post by Jemaclus »

jabbany wrote: post #212
Jemaclus wrote: post #187

Earlier quoted context omitted.

> Now, if someone fails the password check, clearly the user's current password is still secure so leaking that the attempted password was wrong to an attacker is not particularly helpful to them. Maybe I misunderstand your post, but I think the parent comment is talking about leaking whether a password is correct and not whether it's wrong . (If I did misread your comment, apologies in advance and disregard the rest…

But the moment the attacker knows the password is correct, you/the platform would also know the password is compromised assuming they cannot get past 2FA. There is an extremely limited amount of situations that end up with "passed password authentication but failed 2FA" and all the platform needs to tell them apart is a simple "Hmm, were you attempting to login?" email or notification. The leak of the password's corr…

I think we're still talking past each other. In both of your comments, you seem focused on the particular site with the 2FA. I'm suggesting that that vector is irrelevant.

I'm not concerned about someone hacking this site with the 2FA tripwire, but instead about leaking password's correctness could impact usage of that password on other sites that use the same username/password and do not have 2FA.

Imagine if I go to Amazon and put in jabbany@email.com / hunter2 and then come up against a 2FA prompt instead of a password error prompt. Okay. I have a signal that suggests that hunter2 is, in fact, your password. I bail immediately. No point in randomly trying to guess a 2FA auth code.

Now I go to Walmart.com and put in jabbany@email.com / hunter2, and it works -- because there's no 2FA on Walmart.com and you re-used the password!

In this scenario, 2FA doesn't actually stop the hacker from compromising your accounts! It only stops this account with 2FA -- in that sense, you are 100% correct! -- but perhaps only temporarily, because they may be able to compromise other accounts that would allow them to eventually reset your 2FA tokens and get through.

If Amazon were to tell me "hey, someone failed the 2FA auth attempt, you should you change your password," then that's one thing. But we both know most sites don't do that.

Re: Tell HN: Somebody implemented something I wrote a blog about

#244

Post by jabbany »

Jemaclus wrote: post #243
jabbany wrote: post #212

Earlier quoted context omitted.

But the moment the attacker knows the password is correct, you/the platform would also know the password is compromised assuming they cannot get past 2FA. There is an extremely limited amount of situations that end up with "passed password authentication but failed 2FA" and all the platform needs to tell them apart is a simple "Hmm, were you attempting to login?" email or notification. The leak of the password's corr…

I think we're still talking past each other. In both of your comments, you seem focused on the particular site with the 2FA. I'm suggesting that that vector is irrelevant. I'm not concerned about someone hacking this site with the 2FA tripwire, but instead about leaking password's correctness could impact usage of that password on other sites that use the same username/password and do not have 2FA. Imagine if I go to…

Password reuse is a very different issue. You should not be reusing passwords on accounts you care about period. 2FA isn't meant to protect against reuse (though it does help). If a password is reused your 2FA becomes just 1 factor.

This does not make reuse more dangerous either. An attacker with a leaked password list will try them against known sites anyways. If they wanted to try a leaked password against Walmart they'd have done it regardless of the 2FA signal. There's no reason to assume that if a password is (in)correct on one site that it would (not) be on another. The information of whether a password worked or not on a site means nothing to someone trying to hack your account.

Also 2FA sites do do this already. Google and Amazon both do this along with many others (and increasingly many). Also it does not have to force a password reset. A notification email about an attempt is sufficient, you can decide for yourself whether it was you or a suspicious attacker.

Re: Tell HN: Somebody implemented something I wrote a blog about

#245

Post by aktenlage »

wallfacer wrote: post #89

If any Spotify devs are here, please let me explore and add songs, artists and albums to my library without “hearting” it. I often just want to follow up later by “adding to my library,” and it feels weird to “LOVE” it before ever hearing it. I really feel pain when I hear something terrible that I’ve already “liked” and consider the impacts to my algorithm. Please distinguish between “like” and “save.” A simple “plu…

And I would wish so much for a button "play next", that makes a song play directly after the current song (and then proceed with whatever was scheduled before).

I often browse spotify while listening. If I find something I haven't heard for a long time, I often want to directly listen to it, but not cut of the current track.

Re: Tell HN: Somebody implemented something I wrote a blog about

#246

Post by RockRobotRock »

stavros wrote: post #225
RockRobotRock wrote: post #205

Earlier quoted context omitted.

Bitwarden is by no means perfect but I really appreciate their user engagement and excellent documentation.

How is it not perfect? I haven't noticed a flaw yet.

The UI isn't all that intuitive, the 'ask to save'/'ask to update' prompts don't work that well, but I don't really blame them because they are injecting into the DOM which usually changes. As someone else mentioned, it's a bit slow to sync and load sometimes. I wish it was more obvious when I have an existing session with the desktop app which can send a token to the browser extension to keep it loaded.

You can tell i'm really reaching for bad things to say about it, haha

Re: Tell HN: Somebody implemented something I wrote a blog about

#248

Post by _HMCB_ »

pasc1878 wrote: post #231
_HMCB_ wrote: post #179

Earlier quoted context omitted.

Agreed. Especially on iOS has it become obtrusive. Form inputs being obscured by mini pop-ups. I could go on. I’m waiting for the release of the new macOS and I’m going to evaluate using the native implementation and ditching 1P.

The promlem with using apple password management on macos is that I need vertical tabs. Only vivaldi and Firefox provide them now and they don't use the macos key chain

What do you mean by vertical tabs?

Re: Tell HN: Somebody implemented something I wrote a blog about

#249

Post by pasc1878 »

_HMCB_ wrote: post #248
pasc1878 wrote: post #231

Earlier quoted context omitted.

The promlem with using apple password management on macos is that I need vertical tabs. Only vivaldi and Firefox provide them now and they don't use the macos key chain

What do you mean by vertical tabs?

The tabs are to the side rather than along the top.

This allows you to see the text in the tab when you have several tabs open.

Ideally tabs should be indented so you can see which tab you linked the page from.

The best implementation is the Firefox extension Tree Style tab https://addons.mozilla.org/en-GB/firefox/addon/tree-style-ta...

But simpler vertical tabs are on Vivaldi, OmniWeb which had them since the mid 1990s but unfortunately has not kept up with allowing other extensions, Opera used to have them when it was not Chrome. Chrome had them at one stage but reading the issues on that the developers really showed a complete lack of understanding.

Re: Tell HN: Somebody implemented something I wrote a blog about

#250

Post by brianpan »

levymetal wrote: post #149
spiffytech wrote: post #28

Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…

And now we’ve come full-circle as 1Password 8 requires you to save your password prior to submitting the form instead of offering to save it after submission. Which is a huge regression as it results in this exact issue all over again. https://support.1password.com/save-fill-passwords/

I just did a whole test because I missed the fact that you said 1Password 8. I'm still on 1Password 7: https://imgur.com/a/WpeffJE
Post reply on HN