Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxford Temporarily Blocks Google Docs

blogs.oucs.ox.ac.uk

Post reply on HN
Print view View original

61–70 of 160 posts

Re: Oxford Temporarily Blocks Google Docs

#61

Post by eertami »

FourthProtocol wrote: post #11
joelthelion wrote: post #7

Earlier quoted context omitted.

Network Admins need to learn that looking at what your users do and meddling with his data is not a legitimate activity. They should have learned that long ago. Fortunately, with encryption becoming more widespread, they will have to learn the lesson.

If it's your network, and you graciously allow me to use it, and I, through my use of your network breach the security of systems on your network, would you not do anything in the interests of not meddling with my data?

But as a student, you are paying for the network.

Re: Oxford Temporarily Blocks Google Docs

#62

Post by blisterpeanuts »

marios wrote: post #45
blisterpeanuts wrote: post #13

Summary of the blog posting: Google Docs forms are being used in phishing attacks against stupid users. We closed down Google Docs. It didn't work and we had to open it up again after 2.5 hours. Unfortunately, there's no easy solutions to so-called phishing attacks other than educating users. I would recommend that the IT dept. dedicate its considerable resources and creativity to that end, and try to minimize use of…

This. The only effective solution is to educate users, but that in itself is a difficult task. Phishing attacks rely on users being gullible / distracted / ignorant. Telling users _not_ to be any of these usually results in angry answers such as "Are you implying I am stupid !?", and the important part of the dialogue where you explain things to be wary of is completely ignored. Another way to communicate these thing…

"phish your own users"

Now that's the best idea I've heard all morning. You should be running Oxford's IT dept!

Re: Oxford Temporarily Blocks Google Docs

#63

Post by Major_Grooves »

UnoriginalGuy wrote: post #59
mcherm wrote: post #27

They're attacking the wrong part of the problem. If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few: * Train your users where it is…

I just want to re-enforce your second bullet... It is 2013, two factor authentication is here and it is open source software. You can use Google Authenticator[1] for free or you can use something like the YubiKey[2]. If the students have a smartphone then Google Authenticator is on almost all of the major platforms. [1] http://code.google.com/p/google-authenticator/ [2] http://www.yubico.com/about/background/

unfortunately most of the University runs on Microsoft Exchange I believe, and they do not support 2-factor authentication.

Re: Oxford Temporarily Blocks Google Docs

#64

Post by jacques_chester »

Pezmc wrote: post #42
anonymouz wrote: post #12

Earlier quoted context omitted.

The quote continued: "That’s easy with unencrypted traffic. If the site uses SSL, then you have to do some kind of SSL interception. Straightforward on a corporate network full of tightly-managed systems. Much harder on a network full of student machines, visitor laptops and the like, and in our opinion, something to be avoided. " Obviously, they do not see intercepting traffic as desirable. But who has time to read…

Does SSL prevent the network admin from seeing the URL that is being visited? I did in fact read the article in full, but I was under the impression that the encryption just encrypted the data in the request. From a read through of the Wikipedia article on SSL it's now clear to me that all HTTP headers are encrypted, including the requested path.

> Does SSL prevent the network admin from seeing the URL that is being visited?

My understanding is that SSL establishes an end-to-end secure channel, then HTTP is inside that channel. Consequently, GETs and POSTs are not visible to outside parties.

Re: Oxford Temporarily Blocks Google Docs

#65

Post by EwanToo »

jacques_chester wrote: post #56
EwanToo wrote: post #21

Earlier quoted context omitted.

I also wonder why so many phishing emails are getting through the university spam filters - a slightly better solution might of been to remove links in external emails that point to docs.google.com. But anyway, I don't want to start slagging off a particular team that I've never met - maybe they wanted to do all sorts of other, smarter, things and weren't allowed, and maybe they'll be allowed to do them now..

> I also wonder why so many phishing emails are getting through the university spam filters It's usually customised for each university.

I can believe it, I just don't know why it's not been customised to react to links to docs.google.com if it's such a high volume issue.

It's not a trivial problem by any means, but from the network security team's blog it doesn't seem like they've taken many of the steps that I'd expect prior to cutting off a very high traffic website.

Re: Oxford Temporarily Blocks Google Docs

#67

Post by czzarr »

blisterpeanuts wrote: post #13

Summary of the blog posting: Google Docs forms are being used in phishing attacks against stupid users. We closed down Google Docs. It didn't work and we had to open it up again after 2.5 hours. Unfortunately, there's no easy solutions to so-called phishing attacks other than educating users. I would recommend that the IT dept. dedicate its considerable resources and creativity to that end, and try to minimize use of…

Next time you can enter your summary in tldr.io so that anyone (not only people on HN) can benefit from it. For instance: http://tldr.io/tldrs/51238c89b3a7a6ca1000002b/google-blocks

Re: Oxford Temporarily Blocks Google Docs

#68

Post by marcloney »

jacques_chester wrote: post #52
mcherm wrote: post #27

They're attacking the wrong part of the problem. If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few: * Train your users where it is…

> Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a universit…

If you place rate limiting on email accounts by default and then for the lower percent of users that need a higher rate do it on a case-by-case basis. In my experience most users that fall victim to these types of phishing attacks do not need to send high volumes of emails.

Re: Oxford Temporarily Blocks Google Docs

#69

Post by Major_Grooves »

deelowe wrote: post #50
bat99 wrote: post #41

I wonder how many of the keyboard warriors in this thread have any experience of running very large and incredibly diverse networks like Oxford University's. The guys handling security for Oxford are highly experienced and capable. Oxford's network is far more complicated than a typical University.

Yet they apparently have not implemented 2-factor authentication or rate limiting for students' email accounts... As others have pointed out, there are a few very simple ways to deal with this sort of thing. Rate limiting alone would like take care of the problem. This is probably a simple config update on the smtp server.

they run the mail on Microsoft Exchange I think and I don't think there is an easy way to use 2-factor authentication with Exchange (as opposed to Gmail).

Re: Oxford Temporarily Blocks Google Docs

#70

Post by jacques_chester »

EwanToo wrote: post #65
jacques_chester wrote: post #56

Earlier quoted context omitted.

> I also wonder why so many phishing emails are getting through the university spam filters It's usually customised for each university.

I can believe it, I just don't know why it's not been customised to react to links to docs.google.com if it's such a high volume issue. It's not a trivial problem by any means, but from the network security team's blog it doesn't seem like they've taken many of the steps that I'd expect prior to cutting off a very high traffic website.

Time.

There's the nice clever intelligent solution which could be developed over a few weeks, or there's the fact that the phishers have decided -- for whatever reason -- to go apeshit today.

Post reply on HN