Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoToMyPC has been hacked, all customer passwords reset

status.gotomypc.com

Post reply on HN
Print view View original

31–40 of 171 posts

Re: GoToMyPC has been hacked, all customer passwords reset

#31

Post by acmecorps »

edent wrote: post #20
wsr wrote: post #3

As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!

A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…

Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.

Re: GoToMyPC has been hacked, all customer passwords reset

#32

Post by cm3 »

csydas wrote: post #19
cm3 wrote: post #9

Aren't these remote access solutions primarily on demand and therefore coupled to a one-time password generated each time it's started? Isn't Chrome's remote access otp only? Maybe it's time to ask friends/family to use that instead. I mean, if I want permanent remote access, then I'd set up a reasonably secure VPN solution that also required client side certificates, without the use of a trusted intermediary/proxy.…

Yes and no. Teamviewer, for example, has a few use-scenarios, one of which is the unattended access, which is what appeared to be compromised. Essentially there was an always-on agent process running on the target machine that you could access with a Teamviewer account you set up; said account could manage any number of PCs that had always-on unattended access. Teamviewer also has a "Quick Support" option, in which t…

re Teamviewer: http://blog.trendmicro.com/trendlabs-security-intelligence/u...

It's our responsibility to not configure hard to secure and easy to exploit remote access on friend/family computers but use on demand solutions instead.

If you need always-on remote access, then it's a requirement to secure it properly, and I will argue there's no need for always-on remote access on friend/family machines. Those aren't usually online anyway, so there's no hurdle to know beforehand and exchange the access token.

That said, I don't understand why anyone would trust an intermediary with access to their computer. Do they have a contract in place to expect a certain level of support and security? If not, there's no explanation I can think of.

Re: GoToMyPC has been hacked, all customer passwords reset

#33

Post by mikenon »

swiley wrote: post #30
Hondor wrote: post #26

It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.

I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out…

You could use https://ngrok.com to expose the ports.

Re: GoToMyPC has been hacked, all customer passwords reset

#34

Post by brillenfux »

amelius wrote: post #28
wsr wrote: post #3

As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!

I'm hashing my passwords. For example, when logging into any google service, I use: echo "secret123|google" | sha1sum where "secret123" is my master password (I use a much longer one actually to be safe). Similarly, on facebook, I woudl use: echo "secret123|facebook" | sha1sum To both passwords, I add "Aa1!" to make it pass the capital/lowercase etc. tests. EDIT: it is best to write a script for this

Somebody has told me, that this would be bad because "something" (I think entropy?). I didn't understand that.

Can somebody with sense please explain if this is a good or bad idea?

Re: GoToMyPC has been hacked, all customer passwords reset

#35

Post by jhasse »

wsr wrote: post #3

As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!

I'm using this password calculator: https://extensions.gnome.org/extension/825/password-calculat...

It's basically a SHA1 of an alias and a secret (similar to amelius' approach https://news.ycombinator.com/item?id=11932624). I've also started recoding the extension for Windows and other DEs: https://github.com/jhasse/pwcalculator

Re: GoToMyPC has been hacked, all customer passwords reset

#36

Post by jhasse »

brillenfux wrote: post #34
amelius wrote: post #28

Earlier quoted context omitted.

I'm hashing my passwords. For example, when logging into any google service, I use: echo "secret123|google" | sha1sum where "secret123" is my master password (I use a much longer one actually to be safe). Similarly, on facebook, I woudl use: echo "secret123|facebook" | sha1sum To both passwords, I add "Aa1!" to make it pass the capital/lowercase etc. tests. EDIT: it is best to write a script for this

Somebody has told me, that this would be bad because "something" (I think entropy?). I didn't understand that. Can somebody with sense please explain if this is a good or bad idea?

It's a good idea if you're using a secure secret or if an attacker doesn't know your exact method.

Re: GoToMyPC has been hacked, all customer passwords reset

#38

Post by robogrowth »

swiley wrote: post #30
Hondor wrote: post #26

It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.

I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out…

Ngrok.com for ssh tunneling.

Re: GoToMyPC has been hacked, all customer passwords reset

#39

Post by tmat »

robogrowth wrote: post #38
swiley wrote: post #30

Earlier quoted context omitted.

I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out…

Ngrok.com for ssh tunneling.

Can't recommend Ngrok enough... saved my bacon and makes testing on devices so easy and painless.

Re: GoToMyPC has been hacked, all customer passwords reset

#40

Post by tacostakohashi »

brillenfux wrote: post #34
amelius wrote: post #28

Earlier quoted context omitted.

I'm hashing my passwords. For example, when logging into any google service, I use: echo "secret123|google" | sha1sum where "secret123" is my master password (I use a much longer one actually to be safe). Similarly, on facebook, I woudl use: echo "secret123|facebook" | sha1sum To both passwords, I add "Aa1!" to make it pass the capital/lowercase etc. tests. EDIT: it is best to write a script for this

Somebody has told me, that this would be bad because "something" (I think entropy?). I didn't understand that. Can somebody with sense please explain if this is a good or bad idea?

It's not a terrible idea, but it does fall apart if you need to change one of the passwords (say, because you were using this strategy for a number of services including gotomypc). Now you need to have multiple master passwords, or you need to increment the service name (gotomypc2?), and then you're remembering the increment as well as the service and master password.

It's a cute trick, but I don't think it really scales well for the number of accounts we tend to have these days, and the frequency with which passwords must be changed due to hacks, password aging policies, validation ("must have 1 punctuation character"), etc.

As for entropy, it's limited by the master password, and whatever obscurity the hashing and service name provide. If you have a short master password, you're not getting the as much uniqueness as you might think by looking at the length of the hash output.

Post reply on HN