Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post a boarding pass on Facebook, get your account stolen

michalspacek.com

Post reply on HN
Print view View original

261–270 of 313 posts

Re: Post a boarding pass on Facebook, get your account stolen

#261

Post by justboxing »

pfultz2 wrote: post #258
sersi wrote: post #11

And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question.. My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager Security questions weakens the security of an account, they are easil…

You can't do that with United Airlines. The answers have to be picked from a drop-down of answers.

>

I didn't believe you when I read this, but you are right. => https://krebsonsecurity.com/wp-content/uploads/2016/08/unite...

and..

> Yes, you read that right: The answers are pre-selected as well as the questions. For example, to the question “During what month did you first meet your spouse or significant other,” users may select only from one of…you guessed it — 12 answers (January through December).

> The list of answers to another security question, “What’s your favorite pizza topping,” had me momentarily thinking I using a pull down menu at Dominos.com — waffling between “pepperoni” and “mashed potato.”

Wow.

Source: United Airlines Sets Minimum Bar on Security => https://krebsonsecurity.com/2016/08/united-airlines-sets-min...

Video => https://www.youtube.com/watch?v=vmrdLAp7wSw

Re: Post a boarding pass on Facebook, get your account stolen

#262

Post by hvindin »

FabHK wrote: post #257
marcosdumay wrote: post #234

Earlier quoted context omitted.

At least here in Brazil, airlines are expected to authenticate you at boarding time and not a second earlier. This is the sanest option too, since they will have to authenticate you at boarding time anyway, and anything earlier will at most cause a mild economical loss for the company.

I always wonder about that. Often, in the line at the boarding gate several agents will walk around, compare your boarding pass with your passport (and your face), and then draw a squiggle on your boarding pass (sometimes with a coloured felt-tip pen, sometimes with a biro/ballpoint pen). It seems to me that it would be trivial to squiggle on your boarding pass yourself, and then claim that you've been checked alread…

But usually when people get to the front of the line they still present both documents, the fact that 9/10 times the passport is ignored just makes it a judgement call by the ground staff.

Having spent some time working on staff management systems in airports I can say with some confidence that (at least in australia) most of the ground staff will immediately flag someone not at least offering their passport, and/or trying to talk their way out of needing to do so as sus.

And let's not forget that if your entire plan was to get on a plane under a fake name, it's a hell of a risk to just hope that you end up in a situation where some chap is squiggling on boarding passes.

Re: Post a boarding pass on Facebook, get your account stolen

#264

Post by remarkEon »

sersi wrote: post #11

And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question.. My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager Security questions weakens the security of an account, they are easil…

Often for security questions like "what was the name of your grade school" or "in what city was your father born" I'll give intentionally wrong answers for the exact reasons you outlined.

Re: Post a boarding pass on Facebook, get your account stolen

#265

Post by always_good »

ubernostrum wrote: post #232
always_good wrote: post #159

Earlier quoted context omitted.

>requires the attacker to know you do this Nah, "well, it kinda looks like random characters" is information a support rep will give you. Welcome to social engineering and info escalation.

If the support rep is just giving away enough info to figure this out, there is nothing you can do to protect yourself against the company's policies.

Yes, which is why social engineering is going to get a whole lot worse before it gets better.

Re: Post a boarding pass on Facebook, get your account stolen

#266

Post by chiph »

Natanael_L wrote: post #241
chiph wrote: post #162

Earlier quoted context omitted.

Close! Cryptonomicon. I'm guessing that having every book loaded into a password cracking database, subdivided and indexed by each leading phrase word, is still computationally infeasible for non-government actors.

Bitcoin brain wallets based on obscure Africa poems have been successfully cracked. Don't trust your choice of obscure books to be sufficient.

I need to look into that some.

If I walk into a library, pick a floor, aisle, shelf, book, and page at random (just walk, don't think about it), and use a phrase that is a minimum of 12 words long -- is that more random than what I presume happened here, where someone knew that their target liked that style of poetry and was able to concentrate their search on that genre? ( a "crib" in Bletchley Park terms)

The comments about English grammar are correct - classes of words (nouns, verbs, adverbs, etc) do fall in certain positional order and frequency analysis becomes important. A brute-force attacker would have to work through four types of passwords - the commonly used passwords like "12345" and "letmein", language-based phrases (like my not-great idea), language-based phrases with letter substitution (leet-speak, etc), and then truly random letter sequences.

Re: Post a boarding pass on Facebook, get your account stolen

#267

Post by grzm »

teddyh wrote: post #250
grzm wrote: post #197

Earlier quoted context omitted.

Sure. So is there nothing to my intuition above? If you were to have users choose between (a) and (b) above, is (b) generally safer than (a)? Much safer? Only marginally so? When using a password manager that presents 10 passwords, should I always choose the first one to remove my choice from the equation? Are those few bits I've removed that important, given that the entire set is random? I'm not trying to catch you…

A user-chosen password have exactly 0 bits of guaranteed randomness. A randomly generated password has X bits of randomness, and a list of Y passwords of X bits each, where the user is allowed to choose exactly one of the passwords, has exactly X−(log2(Y)) bits. So, to answer your questions: Your intuition is correct – since user-chosen passwords do not contain any guaranteed randomness, generated passwords are bette…

That's consistent with what I was thinking. Thanks!

Re: Post a boarding pass on Facebook, get your account stolen

#268

Post by sersi »

projektir wrote: post #179
cortesoft wrote: post #168

Earlier quoted context omitted.

Yeah, but the key is you need to be able to remember it. Sure, you could store it somewhere, but often times the reason you are needing to use it is because you don't have access to your normal system (computer, phone) that you use to login with.

I don't recall the last time I used secret answers to get into anything. I don't perceive it as a valid way to get into an account. But the option cannot be refused... so to me it's just a security risk.

I've had to use security answers because I was locked out by systems that detected I was using an ip from a different country and so refused my correct password and were using the security questions as a kind of extra authentication.

The amount of stupidity needed to build such a system is staggering.

Re: Post a boarding pass on Facebook, get your account stolen

#269

Post by jacquesm »

noir_lord wrote: post #49
jacquesm wrote: post #28

Earlier quoted context omitted.

What if it turns out to be 70/30 or 50/50? Stuff like this should be configurable or over-ridable, especially when it has legitimate uses. There will always be a balancing act between features, security and usability, to ram the needle one way and to say 'tough luck' to everybody else is not a solution because then people will try to find ways around the block.

As a programmer the problem with feature toggles is this, lets say we have 1 feature toggle with on been 1 and off been 0. For one feature that means we have 1,0 states (two states). For two features we have 1,0/1,0 (four states). By the time you get to 10 feature toggles you have 1111111111 (1024 possible states). In case I wasn't clear hammering home this obvious (to us but sadly not managers usually) point, featur…

That's a very good point, in fact I always use the various global state variables of a program to explain the complexity of the program to others to show them why they can't possibly know their programs do not contain bugs simply because they have not tested all possible states.

Thank you for pointing this out, it is a very important thing to realize and it applies to configurables, global variables and feature switches alike. The more you have seen of the guts of complex systems the more amazed you will be that they work at all.

Re: Post a boarding pass on Facebook, get your account stolen

#270

Post by sersi »

tonyedgecombe wrote: post #122
musage wrote: post #40

Earlier quoted context omitted.

But the attacker kind of has to know the answer is gibberish from the bat, otherwise they'd either guess or pretend to not remember a real answer, which is noticeably different from saying something like "oh, that's 30 random characters but I don't have the note with me right now".

But we already know @sersi just mashes the keyboard for those questions :)

Sure, but I doubt it would be easy to find my identity from my hn account name.
Post reply on HN