Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

71–80 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#71

Post by jrockway »

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs?

Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed on a protocol, then I could have everything in one place, which would make two factor authentication significantly more enjoyable to use. (I know there are standards: the question is, who other than Google follows them? :)

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#72

Post by SCdF »

Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless?

(insert your answer below)

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#74

Post by adgar »

rdl wrote: post #59
adgar wrote: post #55

Earlier quoted context omitted.

You're talking way past the problem that's being solved by Authenticator. If your device is physically compromised with 2-factor auth you need to change your password, end of story. There's no point in discussing how the system holds up to a scenario the system is not intended to address. Password reset is assumed if you lose your damn smartphone . When someone steals your credit card, you just cancel the card and mo…

The problem with Authenticator is that it is usually paired to a personal computer, on a personal phone (or a phone used for everything; the BYOD trend is a lot bigger with phones than computers). If your work accounts use Authenticator, even on relatively secure machines, compromising your personal laptop becomes enough to compromise the phone and thus work accounts, even if the personal laptop isn't used for those…

This is the most detached-from-reality crypto comment I've come across. Google Authenticator works. I really hate to break it to you - but it's actively working right now to protect millions of real users and saving enormous enterprises real money.

It seems like you refuse to accept any of that because if someone roots my laptop and proxies my phone's display over the internet then Google's 2-factor might as well be ROT13.

Maybe - just maybe - those two things don't need to be in conflict. But you're insisting on that conflict, not me.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#75

Post by drgath »

adgar wrote: post #24
cubicle67 wrote: post #16

Earlier quoted context omitted.

the weakness with 2-factor auth is that almost all of us with a smartphone use that phone for email. And that phone is the same one google sends the sms to...

Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation. Edit: forgot to mention, also open-source.

On Google's "Enter your code" screen, if you click the "Don't have your phone?" link, you get a pop-up that gives you the following options:

   * Use a backup code. Learn more
   * Send to your backup phone number ending in ##
   * I cannot access any of my phones Learn more
I presume option #2 is the one cubicle67 is referring to.

So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#76

Post by adgar »

drgath wrote: post #75
adgar wrote: post #24

Earlier quoted context omitted.

Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation. Edit: forgot to mention, also open-source.

On Google's "Enter your code" screen, if you click the "Don't have your phone?" link, you get a pop-up that gives you the following options: * Use a backup code. Learn more * Send to your backup phone number ending in ## * I cannot access any of my phones Learn more I presume option #2 is the one cubicle67 is referring to. So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...

> So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...

If someone gets your wallet, they can use your credit cards to gain access to your credit. You cancel the credit cards. Move on with your life.

Your phone already matters as much as your wallet now - that's just reality. Secure your phone as best you can. Use full-disk encryption wherever backups are stored. Don't give your phone to people you can't trust. Change your password if you lose it or it gets stolen. Move on.

These are tools to solve problems, not shrines to worship.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#77

Post by nilsbunger »

jrockway wrote: post #71
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

Amazon AWS supports the google authenticator app.

It is an open standard protocol, but I don't know in practice how many companies have compatible implementations.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#78

Post by danielpal »

jrockway wrote: post #71
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed…

A lot of the tokens(Google Auth included) follow http://www.ietf.org/rfc/rfc4226.txt. Problem is everyone has a different way of provisioning the secure key. Some of which are unsafe (I am looking at you Google Authenticator!. Yes a qrcode is kool idea but theres no guarantee that you are the only one who provisions the key using the image.)

I designed Authy with that in mind. I wanted a way to have a 1 token for all accounts. Maybe we will add support for Google Authenticator, so you could import your Google Auth token into the app.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#79

Post by grey413 »

SCdF wrote: post #72
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless? (insert your answer below)

I just set up 2-factor auth

1) You still need to enter your password every time you log in.

2) You can add backup phones that can be called/texted with the verification codes

3) You can print out back-up codes that will always work (once)

4) If your phone is stolen and is using an application-specific password, you can revoke that password for that application.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#80

Post by rblackwater »

SCdF wrote: post #72
Matt_Cutts wrote: post #54

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but…

Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless? (insert your answer below)

You should be using POP or IMAP only on your phone so that you can revoke permission after it is stolen (when you log in to your account from a desktop and use a backup key from the printout). If you are logged in to your main Google account on your phone you are asking for trouble. While I will be sympathetic after it gets stolen and someone ruins your life, I won't be surprised.
Post reply on HN