GoToMyPC has been hacked, all customer passwords reset
status.gotomypc.com
GoToMyPC has been hacked, all customer passwords reset
1–10 of 171 posts
Re: GoToMyPC has been hacked, all customer passwords reset
#2Lame excuses ("a very sophisticated password attack") with no details so that we can estimate the risk.
Re: GoToMyPC has been hacked, all customer passwords reset
#3As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
Re: GoToMyPC has been hacked, all customer passwords reset
#4I wonder if this is the same group which targeted the other remote desktop service a few weeks ago?
Re: GoToMyPC has been hacked, all customer passwords reset
#5The headline seems a bit inaccurate. It looks like someone is trying to hack their customer accounts rather than GoToMyPC itself.
Re: GoToMyPC has been hacked, all customer passwords reset
#6As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
Use a password manager. One strong password per site.
Also, use 2FA wherever available. Google Authenticator is good enough.
Store your backup codes somewhere safe (your keepass db, for example. Although that goes a bit counter to the point of 2FA, if someone cracks your keepass db, you're pretty screwed regardless).
Re: GoToMyPC has been hacked, all customer passwords reset
#7Lame excuses ("a very sophisticated password attack") with no details so that we can estimate the risk.
What risk is there to estimate? Assume that the attackers have the clear text of your password, and know that it's your password.
Re: GoToMyPC has been hacked, all customer passwords reset
#8As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I use the excellent 1Password, syncing over WiFi with my phone as the source of truth for my vault. 2FA enabled for everything that supports it and backup codes stored physically. Works great and password managers are one of the few times when something is both more convenient and more secure.
Re: GoToMyPC has been hacked, all customer passwords reset
#9Aren't these remote access solutions primarily on demand and therefore coupled to a one-time password generated each time it's started? Isn't Chrome's remote access otp only? Maybe it's time to ask friends/family to use that instead.
I mean, if I want permanent remote access, then I'd set up a reasonably secure VPN solution that also required client side certificates, without the use of a trusted intermediary/proxy.
Interactive access to remote servers seems also to get less important with push/pull of configuration/deployment recipes and immutable deployment.
Re: GoToMyPC has been hacked, all customer passwords reset
#10Lame excuses ("a very sophisticated password attack") with no details so that we can estimate the risk.
What risk is there to estimate? Assume that the attackers have the clear text of your password, and know that it's your password.
Would be nice if they told us how they hashed it or if they hashed it at all. If the passwords are bcrypt then it wouldn't matter if an attacker got that hash.