Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be warned, there's a nasty Google 2 factor auth attack going around

twitter.com

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#41

Post by vilhelm_s »

tetraodonpuffer wrote: post #31
Alex3917 wrote: post #18

Earlier quoted context omitted.

> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.

I would love for services that I REALLY care about never ever ever being broken into (email, web hosting) there was ONLY the $100-and-speak-to-a-human option to change the password I would even make it $100 + skype and show live on skype your passport.

"showing your passport on skype" seems insecure - I imagine it would not be very hard to paste a page with some computer-vision image registration barcodes on the photo page, and then hack up a video filter which pastes in an arbitrary bitmap.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#42

Post by copperx »

Alex3917 wrote: post #35
ocdtrekkie wrote: post #25

Earlier quoted context omitted.

Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc. Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.

> Charging $100 is pretty punitive Not really, considering there is zero reason for anyone to ever lose a password assuming they are using a password manager. You could even make it free for the first few hours after the account is created or the password is changed in case the user pastes it into their password manager incorrectly.

And how many "normal" people do you know that use a password manager? It's 0 for me. They don't even use post-it notes, which would be an improvement over "I'll just try to remember the password, and if I can't, I'll ask someone to help me ".

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#44

Post by copperx »

_delirium wrote: post #15
reitanqild wrote: post #14

Earlier quoted context omitted.

I'd say it is two factor (googles implementation, the attack is classical social engineering): something you know (the password) and something you have (access to your phone).

In Google's implementation, only the "something you have" is really necessary for access. If you have the phone but not the password, you can just issue a password reset, which is confirmed via the phone, so the password doesn't function as a second factor independent of the phone.

Whoa. I hadn't realized this. So someone that knows my email address and has my phone has access to my entire life, because all password resets use my email address.

If it's come to this, to using "something you have", then we can all go back to using paper password notebooks. They offer the same security, surprisingly.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#45

Post by parent5446 »

kjaftaedi wrote: post #28
JohnTHaller wrote: post #11

This isn't a 2 factor attack. It's a social engineering Google account password reset attack. The attacking party is resetting your Google password and asking you to provide the code Google sends your registered mobile number via text to them.

It is a 2 factor attack in the sense that it reduces the two factors down to one.

It does not reduce the two factors down to one. You still need two factors (password and SMS code) to login. It's just that you're giving both of them to the attacker.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#46

Post by lgas »

copperx wrote: post #42
Alex3917 wrote: post #35

Earlier quoted context omitted.

> Charging $100 is pretty punitive Not really, considering there is zero reason for anyone to ever lose a password assuming they are using a password manager. You could even make it free for the first few hours after the account is created or the password is changed in case the user pastes it into their password manager incorrectly.

And how many "normal" people do you know that use a password manager? It's 0 for me. They don't even use post-it notes, which would be an improvement over "I'll just try to remember the password, and if I can't, I'll ask someone to help me ".

Assuming the "someone" is the forgot password feature and not a person, this seems like a sound approach. It's basically using the site itself as a slightly clunky password manager.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#47

Post by maxander »

_delirium wrote: post #15
reitanqild wrote: post #14

Earlier quoted context omitted.

I'd say it is two factor (googles implementation, the attack is classical social engineering): something you know (the password) and something you have (access to your phone).

In Google's implementation, only the "something you have" is really necessary for access. If you have the phone but not the password, you can just issue a password reset, which is confirmed via the phone, so the password doesn't function as a second factor independent of the phone.

I wonder if anyone implements the restriction that a password reset can only be ordered after a certain time (a week, say) since the last successful password entry, for long-established accounts. Most real password resets are likely either in long-dormant or recently-created accounts, and this would add just another layer of partial protection against these kinds of attacks.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#48

Post by quanticle »

ocdtrekkie wrote: post #25
Alex3917 wrote: post #18

Earlier quoted context omitted.

> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.

Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc. Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.

The problem with charging people for password resets is that by making the process of resetting a password more expensive, you've now encouraged people to reuse passwords. People know when they sign up for your service that resetting a password is going to be expensive, so they'll use a password that they're sure not to forget, i.e. the password they use for everything else.

I would posit that even with this social engineering exploit, Google's two-factor SMS authentication is still more secure than charging people for password recoveries (and thus encouraging password reuse).

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#49

Post by chris_wot »

technofiend wrote: post #23
chris_wot wrote: post #22

Earlier quoted context omitted.

Don't forget to apply a ROT-13 encoding afterwards, that should make it super secure.

I'm doubly secure with ROT-13 applied twice! ROT-26 (Patent Pending). Don't leave home without it.

The nice thing about applying ROT-13 twice is that it greatly reduces decoding time.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#50

Post by [deleted] »

copperx wrote: post #44
_delirium wrote: post #15

Earlier quoted context omitted.

In Google's implementation, only the "something you have" is really necessary for access. If you have the phone but not the password, you can just issue a password reset, which is confirmed via the phone, so the password doesn't function as a second factor independent of the phone.

Whoa. I hadn't realized this. So someone that knows my email address and has my phone has access to my entire life, because all password resets use my email address. If it's come to this, to using "something you have", then we can all go back to using paper password notebooks. They offer the same security, surprisingly.

[deleted]
Post reply on HN