Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding vulnerable Twitter accounts with expired domains

zainamro.com

Post reply on HN
Print view View original

81–90 of 128 posts

Re: Finding vulnerable Twitter accounts with expired domains

#81

Post by popotamonga »

ugexe wrote: post #14
superasn wrote: post #10

Even though they show the starred email address and one of the suggestions is not to show the email, I really hope people don't do that. There is nothing more frustrating when you're recovering your password and the site says we have sent you an email with no hint where and even worse sometimes they say "if that email was in our records then you should get the link" and you're wondering did that work and #1 worst is…

I don’t think you having to either A) remember what email you used or B) creating a new account is a big ask when the alternative is leaking your account presence on a given system. Not everyone wants other people to be able to essentially query a given app for an email account.

Amazon leaks iirc

Re: Finding vulnerable Twitter accounts with expired domains

#82

Post by capableweb »

superasn wrote: post #10

Even though they show the starred email address and one of the suggestions is not to show the email, I really hope people don't do that. There is nothing more frustrating when you're recovering your password and the site says we have sent you an email with no hint where and even worse sometimes they say "if that email was in our records then you should get the link" and you're wondering did that work and #1 worst is…

I understand you feel that way, just want to explain why sites do that. If they give you a clear answer yes or no if it worked, others could check which emails are registered on the website. So in order to leak the information on who has an account or not, they are ambiguous with their answers if the recovery was triggered or not.

It's, as always, about a balance between faster user experience and more extensive security features.

Re: Finding vulnerable Twitter accounts with expired domains

#83

Post by sedatk »

Taek wrote: post #49
asciident wrote: post #15

Earlier quoted context omitted.

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

I would suggest having a bank or similarly regulated institution manage identity recovery. They can declare a login invalid, and they can go through the process of KYC (drivers license, SSN, in-person visit, etc) to get you a new identity. Think Facebook login except instead of tab unrestricted entity that steals every piece of dignity it gets its hands on, its a bank or legal custodian with strict responsibilities,…

Central regulation of the identification is also subject to central censorship, discrimination, and oppression.

Re: Finding vulnerable Twitter accounts with expired domains

#84

Post by g_p »

cortesoft wrote: post #76
twicetwice wrote: post #69

Earlier quoted context omitted.

I want a private key embedded in a chip, that never leaves that chip, so all encryption and decryption happens on that chip—similar to how chip-and-pin credit cards work now. I'm identified by the corresponding public key. Then I want to embed that chip in my hand. Then I can unlock my car, house, computer, or phone and sign into any online service the same way: you send me a challenge token, I sign it with my privat…

And when I lose that chip, or it is damaged or stolen?

I guess the approaches taken with U2F tokens here (and FIDO2) makes sense - have more than one token enrolled, and allow either to be used.

It's not perfect and there are usability issues around this, but they're mostly solvable. Needing both keys around to enrol into each service can be an issue, but this could be addressed by letting a user enrol other public keys as a delegate, and present a signed delegation token allowing that token to enrol a public key on behalf of an off-site token.

Revocation is the next issue - how do you revoke either of your tokens if stolen or compromised? PKI had this issue and ended up down the CRL Vs OCSP approaches. Clearly you need to be able to revoke without the token being present (maybe storing a signed revocation for A on your B token), and some kind of gossip-based network to spread the signed revocation around. That might avoid centralising it.

As long as your "chip" is designed as an ISO smartcard, you can also rely on pin protection (I'll ignore the implanted under skin aspect, other than to observe that does adjust the threat model as deniability around knowing the PIN is lost at that point. A duress PIN that validly unlocks but generates different keys would be a potential solution here for where mistaken identity can be used as an escape from an adversary).

Re: Finding vulnerable Twitter accounts with expired domains

#85

Post by g_p »

knowledge-clay wrote: post #72
twicetwice wrote: post #69

Earlier quoted context omitted.

I want a private key embedded in a chip, that never leaves that chip, so all encryption and decryption happens on that chip—similar to how chip-and-pin credit cards work now. I'm identified by the corresponding public key. Then I want to embed that chip in my hand. Then I can unlock my car, house, computer, or phone and sign into any online service the same way: you send me a challenge token, I sign it with my privat…

The security and privacy implications of this are horrifying to me, as are they to enough of the population that I doubt this will get widespread adoption.

Putting aside the embedded beneath the skin aspect (I share your concerns), this concept can actually work - see FIDO2 and U2F protocols. They're actually pretty good from a privacy perspective too, and give you unlinkability between services (as the key you present is derived from factors including the verified origin, i.e. URL, of the resource you're authenticating to).

Clearly the verified URL origin of something in the real world is complex, but there are ways to potentially make this work. Devices might have certificates for a URI, and this URI could be verifiable and convey attributes like the GPS coordinates to within 25m, that you can verify before authenticating. Users could presumably also whitelist certain origins (garagedoor.home.mydomain.net)

All of this apart from the subdermal part actually could work out well - a small number of people already do this via U2F, or even traditional smartcards.

Re: Finding vulnerable Twitter accounts with expired domains

#86

Post by Thorrez »

> I believe it accounts for a large portion of stolen accounts/handles on the platform.

I doubt it's a large portion. It costs money for each hijacked account, and custom domains I would assume are only used on a tiny fraction of accounts. The vast majority of stolen accounts I would attribute to credential stuffing.

Re: Finding vulnerable Twitter accounts with expired domains

#87

Post by Thorrez »

cortesoft wrote: post #75
anoncow wrote: post #51

Earlier quoted context omitted.

There are other aspects here. If you use a third party service for your email ID, the third party can ban you or like you mention - disappear and basically take your identity away. If you rely on national ID cards, you have another set of problems. If you rely on phone numbers, these can be sim-jacked. If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromise…

The problem is that every new source of identity added is another new attack vector. If there are 10 different ways for me to prove I am who I say I am, it only takes a security flaw in one for my account to be compromised.

If you set login to require 3/10 then 3 of those ways would need a security flaw before your account is compromised.

Re: Finding vulnerable Twitter accounts with expired domains

#88

Post by Thorrez »

ObsoleteNerd wrote: post #67
WA wrote: post #3

This was a common way to harvest 6-digit ICQ numbers back in the day. Hotmail, MSN etc. had expiring email addresses as well that you could register to reset the password to the ICQ number.

Yeah this has been a common attack since as early as I can remember. Company goes bust? Wait for their domain to expire then register/catch-all and start seeing what mail you get from websites to see where there’s accounts using that domain. Also plenty of more targeted methods too.

I wonder if it would be useful to use Have I Been Pwned to find a list of accounts on websites using that domain.

Re: Finding vulnerable Twitter accounts with expired domains

#89

Post by hnick »

anoncow wrote: post #51
Taek wrote: post #12

At some point in time we decided that email addresses control the keys to the kingdom. If you lose access to your email, there goes your social media accounts, your bank accounts, your gaming accounts, and potentially many of your commercial accounts as well. And then we decided that custom domains are the most professional. Which does make sense, there can only be one 'robert@gmail.com'. But, this is coupled with th…

There are other aspects here. If you use a third party service for your email ID, the third party can ban you or like you mention - disappear and basically take your identity away. If you rely on national ID cards, you have another set of problems. If you rely on phone numbers, these can be sim-jacked. If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromise…

I think the usual suggestion is a public/private keypair. You then sign accounts saying they are yours.

This would also allow you to have multiple identities in cases where that is useful.

I've heard of various groups doing this under blockchain (of course) which is a way to solve the problem of publishing the details, but in many cases you don't really need that. It should be enough to make a key and get involved, like Bitcoin.

The issue of course is that if you lose the key(s) you have a major problem, whether they're just lost or stolen. This is probably solved with MFA but it's not a solution if that opens up other attacks.

Re: Finding vulnerable Twitter accounts with expired domains

#90

Post by hnick »

rexpop wrote: post #53
asciident wrote: post #15

Earlier quoted context omitted.

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

> Without emails as the keys to the kingdom, what would you use? From Ursula K. LeGuin's indispensable "Dispossessed": “You're really much too polite for ...” “For what?” “For an anarchist,” she said, in her thin and affectedly drawling voice (it was the same intonation Pae used, and Oiie when he was at the University). “I'm disappointed. I thought you'd be dangerous and uncouth.” “I am.” She glanced up at him sidelo…

That seems vulnerable to the Spartacus attack.
Post reply on HN