Hackers account for 90% of login attempts at online retailers • Hacker News Board

Re: Hackers account for 90% of login attempts at online retailers

#61

Post by vxNsr » Thu, Jul 19, 2018, 3:14 PM UTC

garethadams wrote: post #27

vxNsr wrote: post #12

I recently joined a website the did away with passwords, the only way to login was to enter your email address and confirm by pressing a link in the email, while this adds a pain point for customers it offloads most security implications onto the email provider.

While this will work a very large proportion of the time, and has a big benefit of offloading security as you mention, email is fundamentally asynchronous and can be affected by issues outside of your (and the email providers') control. Another point that UX designers might make is that this solution necessarily takes users away from your site to complete login, and that can introduce a place for users to drop off. I…

> email is fundamentally asynchronous

Yes, but this affects your recovery attempts as well, today email is basically instantaneous for most people.

> this solution necessarily takes users away from your site to complete login

This is probably the biggest reason to avoid this solution, but I still like it over other options.

Re: Hackers account for 90% of login attempts at online retailers

#62

Post by ggggtez » Thu, Jul 19, 2018, 5:48 PM UTC

jhinra wrote: post #39

ggggtez wrote: post #32

Earlier quoted context omitted.

Why would you think 90% is high? That's only 9 in 10. Remember, attackers using dictionary attacks are going to be trying hundreds or thousands of log in attempts, and a real user is only going to try at most a handful of times. You don't need that many attackers to easily approach 99% or higher. I'd say 90% is likely conservative for some companies.

I think 90% is high for a few reasons: 1) Rate limiting of login attempts takes a bite out of the large numbers you're talking about. If we are only looking at retail companies without rate limiting, well, duh, I guess >90% makes sense, but I expect a large portion of the global e-commerce retail segment _does_ employ rate limiting of logins. 2) The report lists, "Averages derived from customers’ login traffic before…

I think an important thing is that you should consider that attackers will log in at the maximum rate limit allowed. The traffic may even be greater than the rate limit, and they'll have some requests dropped by the server. But it still represents and attempted login regardless.

So, yes, even with rate limiting, you can still easily hit 99% fradulent attempts. Obviously you'd be foolish to actually process all of those, and likely the attackers would realize they were rate limited and would slow down for their own best interest, but it's not a guarantee that they actually do obey the rate limit.

Re: Hackers account for 90% of login attempts at online retailers

#63

Post by choward » Thu, Jul 19, 2018, 6:08 PM UTC

dogma1138 wrote: post #55

choward wrote: post #15

Earlier quoted context omitted.

Exactly. The only password that really matters is the one for your email. Everything else just provides additional attack vectors.

That only works for services that do not store any sensitive data and employ costumer controller encryption, if your password is used as a cryptographic tool then it’s out of the question to use such mechanism.

Then how would you be able to reset your password? All I'm saying is that any service that allows password resets shouldn't have passwords at all.

Re: Hackers account for 90% of login attempts at online retailers

#64

Post by PappaPatat » Sat, Jul 21, 2018, 6:34 PM UTC

vxNsr wrote: post #60

dogma1138 wrote: post #55

Earlier quoted context omitted.

That only works for services that do not store any sensitive data and employ costumer controller encryption, if your password is used as a cryptographic tool then it’s out of the question to use such mechanism.

Whatsapp has figured out a solution to this problem. i.e. what is your Whatsapp password?

Your telephone number. So instead of something you know (password), they use something you have (phone).

Re: Hackers account for 90% of login attempts at online retailers

#65

Post by IdontRememberIt » Sun, Jul 22, 2018, 2:08 PM UTC

On our site, for an unknown reason almost 80% of the hacked accounts used are with @outlook, @hotmail, @live, etc domains. Does not look like they got the credentials from a massive leak. Issue with that, is that the hacker deletes our warning/advice emails. Not a funny situation to handle. Any idea about the source?