Git ransom campaign incident report • Hacker News Board

Re: Git ransom campaign incident report

#71

Post by theamk » Thu, May 16, 2019, 2:57 PM UTC

michaelmior wrote: post #70

theamk wrote: post #66

Earlier quoted context omitted.

I disagree, I believe TOTP belongs firmly in the "something you have" category. You cannot memorize TOTP password, nor you can store in your password manager. You also cannot pass that knowledge to another person. So this is more like a public key than a password. Ultimately, everything is "permanent, unchangeable secret", including private key and biometric data. Where the data is stored and how is it accessed makes…

> nor you can store in your password manager Some 2FA apps also allow you to back up your codes to a cloud service.

Yes, but I put it into category of "unsafe things that defeat the point of mechanism"

For example, you can put your spare house key under doormat. This effectively makes a lock on your house door require "something you know" (you need to know where the key is stored).

However, that does not mean that we can say that all keys are "something you know". The fact that many people decided to compromise their security does not reflect on other intended use of locks and keys.

Re: Git ransom campaign incident report

#72

Post by theamk » Thu, May 16, 2019, 3:01 PM UTC

thaumasiotes wrote: post #69

theamk wrote: post #66

Earlier quoted context omitted.

I disagree, I believe TOTP belongs firmly in the "something you have" category. You cannot memorize TOTP password, nor you can store in your password manager. You also cannot pass that knowledge to another person. So this is more like a public key than a password. Ultimately, everything is "permanent, unchangeable secret", including private key and biometric data. Where the data is stored and how is it accessed makes…

> You cannot memorize TOTP password, nor you can store in your password manager. You also cannot pass that knowledge to another person. But none of these things are true. For example, my most recent job involved sharing a 2FA-protected online account. We all had the code.

Sorry, "none of these things are true" in your environment. They are certainly true for other people, in fact, I bet they are true for majority of them.

I think analogy to physical house keys is very helpful. What did your work do?

Did you show the enrollment QR code, and multiple people scanned it --> this is like duplicating house key.

Did you put the key into password manager -> this is like that combination lockbox that releases house key if you enter the right combination.

People do all sorts of unusual things, this does not change the properties of intended usage.

Re: Git ransom campaign incident report

#73

Post by michaelmior » Thu, May 16, 2019, 4:47 PM UTC

theamk wrote: post #71

michaelmior wrote: post #70

Earlier quoted context omitted.

> nor you can store in your password manager Some 2FA apps also allow you to back up your codes to a cloud service.

Yes, but I put it into category of "unsafe things that defeat the point of mechanism" For example, you can put your spare house key under doormat. This effectively makes a lock on your house door require "something you know" (you need to know where the key is stored). However, that does not mean that we can say that all keys are "something you know". The fact that many people decided to compromise their security does…

Agreed. But I think it goes to show how blurry the line is between "know" and "have."

Re: Git ransom campaign incident report

#74

Post by jredmond » Thu, May 16, 2019, 7:13 PM UTC

ralph84 wrote: post #30

sverhagen wrote: post #27

Earlier quoted context omitted.

Weird, weren't GitHub and friends restoring these repositories for these unlucky users?

I assume they're trying to contact the repo owners to see how they want to proceed. Even if the change seems obvious, changing the contents of a repo is definitely a case where the git host should involve the owner of the repo (barring ToS violations).

This is the safer bet. The host should offer to restore from their own backups, but some customers may have already taken care of their own stuff.

Re: Git ransom campaign incident report

#75

Post by thaumasiotes » Thu, May 16, 2019, 8:34 PM UTC

theamk wrote: post #72

thaumasiotes wrote: post #69

Earlier quoted context omitted.

> You cannot memorize TOTP password, nor you can store in your password manager. You also cannot pass that knowledge to another person. But none of these things are true. For example, my most recent job involved sharing a 2FA-protected online account. We all had the code.

Sorry, "none of these things are true" in your environment. They are certainly true for other people, in fact, I bet they are true for majority of them. I think analogy to physical house keys is very helpful. What did your work do? Did you show the enrollment QR code, and multiple people scanned it --> this is like duplicating house key. Did you put the key into password manager -> this is like that combination lockb…

> They are certainly true for other people, in fact, I bet they are true for majority of them.

Well, no. Everyone who uses TOTP, without exception, has their secret stored in a password manager. That's what the TOTP app or device is.

Re: Git ransom campaign incident report

#76

Post by theamk » Thu, May 16, 2019, 11:50 PM UTC

thaumasiotes wrote: post #75

theamk wrote: post #72

Earlier quoted context omitted.

Sorry, "none of these things are true" in your environment. They are certainly true for other people, in fact, I bet they are true for majority of them. I think analogy to physical house keys is very helpful. What did your work do? Did you show the enrollment QR code, and multiple people scanned it --> this is like duplicating house key. Did you put the key into password manager -> this is like that combination lockb…

> They are certainly true for other people, in fact, I bet they are true for majority of them. Well, no. Everyone who uses TOTP, without exception, has their secret stored in a password manager. That's what the TOTP app or device is.

There is a big difference between TOTP app/device and a password manager.

The password manager returns passwords directly. They can be viewed, memorized, passed to another person, copied to another device, or checked into git.

With TOTP, there is a private key inside, but it is not accessible to user. You cannot view it, or memorize it, nor can you pass it to another person or check it into git. It is purely implementation detail which is not exposed in any way.

Disclaimer: this is the case with classical TOTP devices, like RSA SecurID hardware token, or un-rooted Android phone running Google Authenticator. I have those, and everyone I know have them as well.

There are exceptions, like people using LastPass 2FA or people who store TOTP secret on their PC. This is not intended usage, and it does not matter for most users.