5 ms·
Kenneth should repeat N's big takeaway: • Avoid using custom DNS emails (e.g. yourname@yourdomain.com) for any login purposes. It basically opens you up for th
by vtange 10y ago
Kenneth should repeat N's big takeaway:
• Avoid using custom DNS emails (e.g. yourname@yourdomain.com) for any login purposes. It basically opens you up for these kind of attacks (where a hacker breaks into your domain name account and forwards your custom email to his own).
Read N's story at https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd#.ler9o3cmg https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
- mplewis 10y agoBut I don't want to use @gmail.com because that ties me down to the vendor. What am I supposed to use then?
- greenleafjacob 10y agoBuild your own security mechanisms (alerting, etc.)
- c22 10y agoYou could use @[IP address]? No guarantees this will pass whatever-service's arbitrary validation filters though.
- beagle3 10y agoOr that you can maintain that IP address if it was directly assigned to you by IANA/RIPE. (And in some cases, even if it WAS assigned to you). @[IP address] is a really bad idea.
- c22 10y agoYes, as it turns out using the internet requires reliance on third parties. Is the IP address of your mailserver as easy to compromise as your domain name? I don't know, it depends on your ISP, but it almost certainly requires a targeted attack. Using email to "secure" access to accounts is already "a really bad idea", so what can one do?
- PeterisP 10y agoIP address is harder to compromise, however, unlike domain names you cannot guarantee to own it permanently.
- c22 10y ago> unlike domain names you cannot guarantee to own it permanently. I'm not convinced this is a property of domain names. It seems like as long as you pay your bills, your provider stays in business, and no governments get involved, both these identifiers are effectively permanent. Your IP is likely provided by the same people who own or co-locate your physical server anyway. In any case, you're likely to get enough advance notice of ip changes to update your various accounts.
- kobayashi 10y agoIt'd be an imperfect solution, but use Gmail (or equivalent) address(es) for logins elsewhere, and then your personal email communications via a custom domain hosted with your provider of choice (e.g. FastMail, Zoho, StartMail, Tutanota, etc.) Preferably, the Gmail addresses should not be directly tied to your identity IRL, such that your email is secured but somewhat sandboxed from the large data piles companies store about Your Name.
- pmontra 10y agoI'm using a POP3 mailbox hosted by the registar of my custom domain and I download all the messages on my computer. No web mail. I'm trusting the DNS of my registar in the same way I would trust the one of FastMail, Zoho, etc. Is that any different?
- bigiain 10y agoThat's kind of an "all your eggs in one basket" approach - you're relying completely on the security of one 3rd party (your registrar). Whether this is better or worse than relying on two 3rd parties (your registrar and a different email provider) is a good question. Are you sure your POP3 mailbox is using encryption for the password? The original port 110 POP3 protocol sends it in cleartext unless there's an STLS command sent (which is MITM-able) - POP3S over port 995 (or 997?) will be encrypted (but then you need to consider whether all the software in the chain is actually checking SSL certs and their chains...)
- dredmorbius 10y agoI'm rather not a fan of Google in general, and particularly not these days (though they're hardly the only tech company backing the TPP). That said: on account of size, targeting, procedures, and what I find are generally fairly diligent employees on the tech side (design, products, ads, and gov't rel'n are another story), you're probably as safe with Google as with any other large vendor. That said, the basic problem here -- getting locked out of your account or profile, or allowing the wrong person in -- is a HYUUUGE problem. And the 2nd Amendment people can't do anything about it either, to continue the allusion.... I wrote of my own "I've been locked out of a Google account" account, well, twice. It's been pretty annoying (particularly as I'm paranoid and don't trust Google to know who I really am, because reasons). It's been resolved within a few days, though it leaves me scratching my head a bit. As I noted the first time, and have adopted as a slogan for this type of event, "Who are you is the most expensive question in information technology. No matter how you get it wrong, you're fucked." See: https://redd.it/2w618r https://redd.it/2w618r https://redd.it/3mo7l6 https://redd.it/3mo7l6 Unfortunately, that issue is paired with another, also sloganed and given to much use: Data are liability. If you hold data about people, or state they consider important (e.g., a widely used codebase), or other elements, then you've got control point others may well find they wish to avail themselves of. I don't have solutions to either of these problems (I'm paranoid, not narcissitically delusional). I can see the shapes of possible solutions, including reducing attack services and possibly having a more widely distributed and socially-integrated identity verification mechanism. Or offering far more services as stateless and without locally-maintained data, at least in cleartext. Better notifications, recovery, and encryption methods for mail would also help -- capture of email accounts would matter far less if they were encrypted to keys held only by the user (and absolutely not on the control path involved in accessing or specifying them, such as MXs).
- ComodoHacker 10y ago>It's been resolved within a few days Could you share a way to resolve it? I've been in such situation recently. I was forced to change VPN I used for long time to access my Gmail account. And I haven't 2FA enabled because I didn't want to give out my phone number.
- aianus 10y agoA better takeaway is to use a better registrar with good security. I almost lost an old @gmail.com address when they asked me to verify a really old phone number for no reason. Never trusted them again.
- RubyPinch 10y agoBut what is a better registrar? I've heard most all of the main players seem to have social engineering issues, regardless of twofactor, and google domains is still US only
- deleted 10y ago[deleted]
- aianus 10y agoCloudflare made a product exactly for this purpose: https://blog.cloudflare.com/introducing-cloudflare-registrar/ https://blog.cloudflare.com/introducing-cloudflare-registrar...
- type0 10y agoGandi.net maybe. I haven't used them, a friend said that I should consider moving there, any thoughts on this, what alternatives is there that offer 2FA and operate in EU?
- catwell 10y agoI have been using Gandi for 10 years and they are definitely great. I see no reason not to use them, except maybe that they usually aren't the cheapest.
- AdamN 10y agoGandi is great! I'm a long time user and highly recommend them.
- raesene2 10y agoGotta say I disagree with this. I'd say what it means Is recognize that DNS security is important and treat it as such. The reason I disagree is that if you use something like gmail or outlook.com for logins/ password resets there Is a nasty potential problem which Is if the provider locks you out of your account you could be completely stuffed. There have been cases of people losing access to their accounts because of ToS breaches in the past. If that account is your login account for other systems you could also lose access to those.
- pmontra 10y agoIt seems he got his account back https://twitter.com/N https://twitter.com/N
- deleted 10y ago[deleted]