Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Getting Hacked

ahmeto.com

Post reply on HN
Print view View original

31–40 of 77 posts

Re: On Getting Hacked

#31

Post by ahmetomer »

close04 wrote: post #25

> but on a universal level, we're missing a cohesive master plan, in which a user, a human, need not undertake endless and repeated manual fend-off of the devil This is a very good way of stating the problem in terms anyone can relate to. > I had one brow raised, a little suspicious, but not very much to initiate a full-scale defense This on the other hand seems overly superficial. You get your eMarketplace account h…

Totally on point. I should've taken it more seriously in the first incident. That way, I could've kept my TikTok and X accounts. But the damage is done, and it has been a good lesson to me. Hopefully my post could be as much of a "lesson" to those reading, without getting compromised as I was.

Re: On Getting Hacked

#32

Post by n2h4 »

SeanAnderson wrote: post #11

I got hacked late last year. It sucked. Do not recommend. I'm not going to blog about it, but will at least share how I messed up. Maybe it'll help someone else. I was phished through Discord. A CEO that I was friends with was phished prior to me and I let my guard down when someone I put on a pedestal reached out to me. The hacker asked me to review a video game prototype they'd been tinkering with in their spare ti…

what i noticed from you and a couple other similar stories in this thread is that a same email is used at multiple places. Have you looked into email aliases like simplelogin, anonaddy, or anything of that sort?

or at the very least, the basic username+alias@domain.tld? this let's you know at least which thing was compromised.

of course, I don't recommend doing the same for important services like you banking accounts, but for the vast majority, having an alias would be enough.

and compartmentalisation always helps (different emails/accounts for personal, govt, and work domains).

Re: On Getting Hacked

#33

Post by embedding-shape »

jasode wrote: post #22
akersten wrote: post #5

> open their password manager which also might need you to authenticate, type in their master password, search for the name of the said website, copy the password, paste it in This is one way to guarantee you'll eventually fall for a phishing attack. Are we really running URL-unaware password managers in the year 2026?

>Are we really running URL-unaware password managers in the year 2026? URL-aware browser plugins for autofilling passwords can also make people _more_ susceptible to phishing . The password managers plugins sometimes not working correctly changes the Bayesian probabilities in the mind such that username/password fields that remain unfilled becomes normal and expected for legitimate websites . If that happens enough,…

Even if autofill breaks, the moment it does, if you're security aware, is to actually read the URL you're at, not start copy-pasting like it's the wild west.

> autofilling passwords can also make people _more_ susceptible to phishing

No, it doesn't. What it does, is generally make people _less_ susceptible to phishing, but the moment you stop paying attention when autofill breaks, is the moment you can STILL get phished. But in 90% of the cases, the autofill will HELP you avoid getting phished.

What an absolutely bananas thing to say, that autofilling passwords make people more susceptible to phishing, completely wrong and borderline harmful to spread things like this.

Re: On Getting Hacked

#35

Post by dns_snek »

jasode wrote: post #22
akersten wrote: post #5

> open their password manager which also might need you to authenticate, type in their master password, search for the name of the said website, copy the password, paste it in This is one way to guarantee you'll eventually fall for a phishing attack. Are we really running URL-unaware password managers in the year 2026?

>Are we really running URL-unaware password managers in the year 2026? URL-aware browser plugins for autofilling passwords can also make people _more_ susceptible to phishing . The password managers plugins sometimes not working correctly changes the Bayesian probabilities in the mind such that username/password fields that remain unfilled becomes normal and expected for legitimate websites . If that happens enough,…

I don't think your other comment supports your assertion. I've experienced Bitwarden failing to auto-fill due to quirks on websites, but I've never seen it fail to identify the domain correctly.

You link to Bitwarden's issues mentioning autofill and while it's true that autofill might break, if you click on the extension icon it's going to present you with a list of credentials for the current domain and give you options to quickly copy the username and password to your clipboard.

If that list is empty then I'm immediately put on high alert for phishing, but so far it's always been due to the website changing its URL/domain. I retrace my steps, make sure I'm on the right domain, then I have to explicitly search for the old entry and update it with the new URL.

That said, I've seen people do: Empty account list -> The darn password manager is misbehaving again -> Search and copy the password. I wouldn't consider those people to be sophisticated users since they're misunderstanding and defying the safety mechanisms.

Re: On Getting Hacked

#36

Post by embedding-shape »

Y-bar wrote: post #15
akersten wrote: post #5

> open their password manager which also might need you to authenticate, type in their master password, search for the name of the said website, copy the password, paste it in This is one way to guarantee you'll eventually fall for a phishing attack. Are we really running URL-unaware password managers in the year 2026?

It’s also an issue that extensions like 1Password are _too_ URL-aware, until recently it tried to use heuristics and ignore subdomains for matching credentials. This meant that we used to get a list of almost a hundred options when logging into our AWS infrastructure. No matter which actual domain used. Someone could have used this vulnerability as part of a phishing campaign.

> extensions like 1Password are _too_ URL-aware, until recently it tried to use heuristics and ignore subdomains for matching credentials

I've used 1Password for years (Linux+Firefox though, FWIW), and this never happened to me or our family. I did discover though that the autofill basically went by hierarchy in the URI to figure out what to show, so if you specify "example.com" and you're on "login.example.com", you'll see everything matching "*example.com" which actually is to be expected. If you only want to see it on one subdomain, you need to specify it in the record/item.

That it ignored the subdomains fully sounds like it was a bug on your particular platform, because 1Password never did that for me, but I remember being slightly confused by the behavior initially, until I fixed my items.

Re: On Getting Hacked

#37

Post by sneak »

morgan814 wrote: post #6

Not all too long ago I had someone port out my VOIP number. They had it for a few hours. This was after I had spent extensive effort attempting to secure my digital life. VOIP was SIM-swap resistant sure, but I totally missed that port out requests default to failing open. Thankfully the VOIP operator alerted me and pulled the number back. Then I set a port out code. Who knows how many other holes I have. I lost my s…

Using SMS 2FA has been explicitly deprecated for years. It’s insecure for this and a million other reasons.

TOTP is also trivially phishable.

I still have my sense of smugness because I use SOTA 2fa.

Re: On Getting Hacked

#38

Post by sneak »

pjerem wrote: post #16
Y-bar wrote: post #15

Earlier quoted context omitted.

It’s also an issue that extensions like 1Password are _too_ URL-aware, until recently it tried to use heuristics and ignore subdomains for matching credentials. This meant that we used to get a list of almost a hundred options when logging into our AWS infrastructure. No matter which actual domain used. Someone could have used this vulnerability as part of a phishing campaign.

Haha and Bitwarden is url aware but not enough. I work in a company where I have two okta accounts (because hey, why not) on two .okta.com subdomains. Bitwarden _randomly_ messes up the two subdomains and most of the times (but not always, which seems strange actually), it fills the form with the wrong password. I don’t know why. I know that there is an option to make it stricter on domain matching but you can’t conf…

You can indeed configure it on a per-item basis. The vault-wide setting you found is just the default for ones that don’t have an override set. Click on the domain/url matching setting in the individual credential and you can change it to exact host match.

Re: On Getting Hacked

#39

Post by SeanAnderson »

anonymous908213 wrote: post #30
SeanAnderson wrote: post #11

I got hacked late last year. It sucked. Do not recommend. I'm not going to blog about it, but will at least share how I messed up. Maybe it'll help someone else. I was phished through Discord. A CEO that I was friends with was phished prior to me and I let my guard down when someone I put on a pedestal reached out to me. The hacker asked me to review a video game prototype they'd been tinkering with in their spare ti…

For a cautionary tale, I'm not seeing a mention of how you were actually compromised? You mentioned losing multiple accounts, but presumably didn't decide to sign up for their 'game' website while entering your gmail address and password plus Discord password. KeePass should rule out having used the same password for all three accounts. KeePass should also, in theory, not immediately give up all of your credentials t…

Oh, hah, fair.

I downloaded and ran an executable from the website under the belief I was checking out a game prototype. My Chrome browser instance crashed the moment it ran. I re-opened Chrome, got an email about suspicious login, and immediately turned the computer off to triage on a clean machine. I knew I was hacked within moments of being hacked and was fully at my computer for it.

I'm assuming I lost access to the Google account through session hijacking / exfiltrating an active session token. That doesn't really make complete sense, though, because I wasn't logging in to that second Chrome account with any regularity. It also doesn't explain how they got access to my 2FA-enabled account. I had some thoughts there about how easy it is to click "Remember this PC" and weaken 2FA and maybe the malicious script made my machine a proxy for their actions to leverage my PC being remembered? I'm not sure how practical that theory is in practice.

Re: On Getting Hacked

#40

Post by wt__ »

ahmetomer wrote: post #27
keysersoze33 wrote: post #23

Sadly the blogpost fails to mention which browser extension was the macilious one that compromised his session tokens. While quite technical users (a la. this community and devs in general) would be able to inspect the source code of browser extensions to do an audit, most of us don't have time for this, and we just have to rely on the browser add-on number of downloads & reviews as a poor indicator. It would be real…

Hi, OP here: Unfortunately, with a brisk urge to clean it all up, I hadn't paid attention to which extension it was that got my browser compromised; I had immediately removed all extensions, cleared browser data, stopped the sync, and uninstalled it altogether (for fear of getting further compromised). What I can say is that I have tried a number of extensions for the purpose of making a website in dark theme, for ea…

Firstly, I really liked the way you wrote your blog post.

FWIW, I experimented with dark theme extensions (paid and free) and gave up on them after a while: it just all felt a bit too clunky and unreliable, the flashes of unstyled pages were annoying too.

I've now standardised (this is in Firefox) on a combination of:

- Reader mode

- a very simple extension that allows per-domain custom CSS…

- …and another that lets you disable Javascript completely per site (which adds a bit of security, generally improves the experience, including the side effect of removing cookie popups.)

Post reply on HN