Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

51–60 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#51

Post by steve8918 »

danweber wrote: post #26
prawn wrote: post #12

Earlier quoted context omitted.

If you're trying to remote-wipe your computer so that a thief doesn't access your sensitive data, wouldn't you want the data to be lost permanently?

Could be. But that's a very different problem. Old-school computer security breaks things down into the CIA categories: Confidentiality is for things you want secret. Integrity is for things you want to not be altered. Accessibility is for things you want to be able to reach. Honestly, very little of data requires confidentiality. Yet that's what encryption is usually used for. I would, by an order of magnitude, rath…

I encrypt the entire disk of my laptop. That can contain potentially important information, and it also has the best chance of being stolen or lost. I can keep relatively important piece of information on my laptop now after I installed TrueCrypt and encrypted my entire disk. It makes hibernating my laptop about 20x slower, so I stopped doing that, but it's completely worth it.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#52

Post by wallywax »

columbo wrote: post #29
mechanical_fish wrote: post #6

Earlier quoted context omitted.

I have actual work to do, work that I have been putting off too long, so let's try crowdsourcing this question on HN: What should one try to do to protect against this? Hypothetical actions to take: Make sure that an email address that's doing double-duty as a login identifier for a given service is unique to the service and appears nowhere on the web or in outgoing mail. Take particular care to have a "recovery" ema…

The most surprising thing I see out of this isn't the need for more robust authentication but for services that aren't so damn quick to do whatever you want. Website: "Hey Bill, glad to see you today, what do you want to do" Bill: "Delete _everything_ I've ever done on every system I have" Website: "Of course! Let's get this started... beep boop bip and done!" What about this: 1 - Kill request sent 2 - 48 hours is se…

I can just imagine the HN article when someone tries to delete his Facebook account because he disagrees with some new feature, and they won't do it for 48 hours. I've been on the receiving end of "DELETE MY ACCOUNT!!!1!!1" requests, and I know those people wouldn't respond well to "wait two days or pay up."

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#53

Post by zalew »

evanmoran wrote: post #48
rdl wrote: post #43

Earlier quoted context omitted.

You don't have as many computers as I do, or as long a password as I do, I suspect. Having to type a random long passphrase with special characters on the weird keyboards of multiple devices every month was a pain. Even worse, for devices I infrequently use, I ended up basically having to do this every single time I wanted to use the device.

http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines

so if someone wants access to all your passwords, he just needs to compromise your dropbox.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#54

Post by Matt_Cutts »

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it.

Some of the common misperceptions I see:

Myth: But what if my cell phone doesn't have SMS/signal?

Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal.

Myth: Okay, but what about if my cell phone runs out of power (added: or my phone is stolen)?

Reality: You can print out a small piece of paper with 10 one-time rescue codes and put that in your wallet.

Myth: Don't I have to fiddle with an extra PIN every time I log in?

Reality: You can tell Google to trust your computer for 30 days and maybe even longer.

Myth: I heard two-factor authentication doesn't work with POP and IMAP?

Reality: You can still use two-factor authentication even with POP and IMAP. You create a special "application-specific password" that your mail client can use instead of your regular password. You can revoke application-specific passwords at any time.

Myth: Okay, but what if I want to verify how secure Google Authenticator is?

Reality: Google Authenticator is open-source: http://code.google.com/p/google-authenticator/

Hmm. Maybe I should throw this up on my blog too.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#55

Post by adgar »

rdl wrote: post #46
spacemanaki wrote: post #22

Earlier quoted context omitted.

> 2-factor auth has been cracked before I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used. The linked breach was likely due to a social engineering attack on phone company support staff. Yes, it's concerning, and something Google and the phone companies should be investigating, but no, 2-factor auth wasn't "cracked." Someone who's…

Given your iCloud account and/or root on the PC paired to your iPhone, I think it would be possible to compromise your Google Authenticator app. At the limit, jailbreak the connected phone, but I think it could be done more simply (all you need to do is run the Authenticator app and see the screen within 60 seconds, which should be possible from a connected, paired Mac). On Android, way way easier, due to lack of sec…

You're talking way past the problem that's being solved by Authenticator. If your device is physically compromised with 2-factor auth you need to change your password, end of story. There's no point in discussing how the system holds up to a scenario the system is not intended to address. Password reset is assumed if you lose your damn smartphone.

When someone steals your credit card, you just cancel the card and move on with your life. You don't call the credit card's data protection technology a failure. And changing your iCloud/Google/really any password is an orders-of-magnitude better user experience than canceling a credit card.

> It's still better than a password, but not as good as an actually secure independent factor.

Companies like Google have real, statistically significant data on how much 2-factor auth reduces account compromise. Your claims to the contrary seem to be rooted in an academic (at best) perception of weakness in the technology.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#56

Post by jasomill »

rdl wrote: post #47
mechanical_fish wrote: post #6

Earlier quoted context omitted.

I have actual work to do, work that I have been putting off too long, so let's try crowdsourcing this question on HN: What should one try to do to protect against this? Hypothetical actions to take: Make sure that an email address that's doing double-duty as a login identifier for a given service is unique to the service and appears nowhere on the web or in outgoing mail. Take particular care to have a "recovery" ema…

Standard procedure when setting up MDM for a company is to disable iCloud. All remote wipe/etc. done by your own servers, not by Apple. Apple is really bad at running online services. It's a shame that they short-sightedly decided to go to war with Facebook and Google (who are good at services and bad at hardware) rather than playing more nicely together.

More importantly, standard procedure is also to keep multiple backup copies of important data. Because no matter who manages the infrastructure, the only reason the kill switch exists in a corporate environment is because there are scenarios where you plan to use it. Not to mention the very finite lifespan of all forms of modern mass storage, the relative ease of accidental deletion in most file systems, and so on.

For every person who loses "irreplaceable" data to malice, many more lose it out of simple incompetence.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#57

Post by nl »

Last time HN discussed this story, I said "turn on 2-factor authentication for your Google account".

Unsurprisingly, I got the exact reaction I'm seeing here when it has been suggested: lots of questions about how it works, people who think their situation is unique so it won't work for them, and people complaining than SMS is insecure.

1) Don't ask anymore questions. Try it out, if you hate it turn it off.

2) Your situation almost certainly isn't unique. You get 10 codes to print out, you can have (revokable) application-specific passwords that don't require the token. Try it!!

3) Use the smartphone application.

Don't ask any more questions - just try it out!

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#58

Post by yonran »

ghshephard wrote: post #19
suresk wrote: post #3

Given how central (for better or worse) of a role email plays in safeguarding other accounts, the hassle of 2-factor auth for it is feeling like less and less of an annoyance. About a month ago, one of my credit card accounts got hacked and was used to send money to someone else - the number itself wasn't compromised, it was the actual account. No doubt, the attackers tried to login and change my email password, but…

I've been using google two-factor auth for the better part of a year now, and the annoyance comes down to, once every 30 days or so, having to take 5 extra seconds during login to enter a code sent to my cell phone. I can't _think_ of anything less of a hassle.

To reduce the risk of inconvenience, Google should really put an indicator on gmail that tells how many days left until the next authentication and allows you to renew the lease early to avoid having to pull out your phone at random. I only hope I don’t get kicked out of gmail at the most inconvenient times.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#59

Post by rdl »

adgar wrote: post #55
rdl wrote: post #46

Earlier quoted context omitted.

Given your iCloud account and/or root on the PC paired to your iPhone, I think it would be possible to compromise your Google Authenticator app. At the limit, jailbreak the connected phone, but I think it could be done more simply (all you need to do is run the Authenticator app and see the screen within 60 seconds, which should be possible from a connected, paired Mac). On Android, way way easier, due to lack of sec…

You're talking way past the problem that's being solved by Authenticator. If your device is physically compromised with 2-factor auth you need to change your password, end of story. There's no point in discussing how the system holds up to a scenario the system is not intended to address. Password reset is assumed if you lose your damn smartphone . When someone steals your credit card, you just cancel the card and mo…

The problem with Authenticator is that it is usually paired to a personal computer, on a personal phone (or a phone used for everything; the BYOD trend is a lot bigger with phones than computers). If your work accounts use Authenticator, even on relatively secure machines, compromising your personal laptop becomes enough to compromise the phone and thus work accounts, even if the personal laptop isn't used for those accounts. This is a bigger problem with the iPhone due to iTunes -- people pair with a machine which has a lot of music, may be used for general downloading, shared in a family, etc.

The attack can be done by pwning your personal computer, waiting for you to connect your iPhone via wifi or cable to it, and then remote-proxying the display on your phone to the attacker via the compromised personal computer. This would all be undetectable to the user.

Even a bad two factor system is better than passwords from a large service provider's perspective. Two factor using a phone isn't as secure as fully independent two factor for enterprise use.

Add to this that many high security environments don't allow phones, or that people carry only a single device (phone or maybe phone+tablet, often), and the "phone as two factor" becomes a lot less useful.

The big problem is having to carry multiple tokens, the cost of physical tokens (including replacement/management costs), and that no one makes a decent physical token at present.

iOS + some kind of "secure device-local mode" for the OS (which couldn't be remote-accessed for display, and which doesn't get pushed in backups (keystore-like), would make something like Authenticator much closer to a physical token in security.

The funny thing is WP8 actually has the tools to build this, and Enterprise (i.e. huge windows deployments with good device management) is the environment where it would be useful.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#60

Post by steve8918 »

I'm sorry for the journalist who lost all of his digital information, but I think/hope that this article will have a huge impact in terms of how the security practices for all large companies with an Internet presence, will behave.

The fact that they pieced together all this information from multiple sources, including Amazon's ability to add credit cards over the phone, to getting the billing address through domain name registration, to hacking into Apple iCloud really makes me feel... I guess depressed is the word.

We really have no control over our own data security. I've been super paranoid about things like identity theft, and I got my identity stolen, which is something I've been dealing with over the past 2 years or so. Somehow, my birthdate, addresses, etc were all wrong, and I had to jump through hoops to get it changed. As well, I currently have an unpaid credit card linked to my account, and the credit agencies and the collection agency won't remove it. The collection agency required me to submit 3 copies of my signature, a police record, copies of my identification, etc, before they'll remove it, even though THEY were the ones who made the mistake. I went to the police station to file a report, but they needed documentation that I didn't have, since I had already changed most of the information through the credit agencies. At this point, I froze all my accounts through the credit agencies, and I've given up.

The safety of my email, etc, is something that I also take extremely seriously, and now I'm being told that there's a possibility of being hacked via clever hackers piecing together information from various sources, each of which have different security procedures. We literally have no data security except "security through obscurity", meaning that the likelihood of being randomly hacked is low, but if someone wants your account, they can and will get it, pretty easily it seems.

The industry NEEDS to standardize on very rigid set protocols on things like what information they give out, how accounts are reset, how things like credit cards are added to accounts, what information they leak, etc. This is ridiculous.

Post reply on HN