8 ms·

It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.). So the #1 step to reducing your risk of an a

It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.). So the #1 step to reducing your risk of an attack like this would be setting up 2FA on your email account. The industry standard is password resets via email. If an attacker has access to your email, they have access to every online account you own. Stealing email passwords is easy. So easy. No matter how complicated your password is or how often you change it. 2FA is an easy, reliable way to make it orders of magnitude harder for any attacker to breach your account. I know I'm preaching to the choir here on HN but I'm just flabbergasted this didn't make it into the article.

darkhorn 10y ago
Step #2 is to use unique passwords for your main email addresses. These passwords should be unique in the universe. You must not use them with another account or to encrypt a file etc. Nowhere! And step #3 is to keep all your softwares up to date; OS, antivirus, browser, your WordPress, its plugins, your Notepad++, WinRAR, firmware of your ADSL modem, other computers on the network, BIOS, smart TV etc. Everything should be updated to the latest version.
- korethr 10y ago
  And step #4 is to throw up your hands and shout "Fuck it!" the Nth time you lost everything because you can't find your master copy of your password manager, your back up has drifted out of sync, and you just accidentally spilled your coffee on the flash drive that holds your backup-backup--destroying it. Hyperbolic sarcasm aside, keeping on top of security is starting to feel like Alice and the Red Queen -- it takes as fast as you can run just to remain in place. I'm starting to feel a bit more sympathy for those who give up on good practices and start using the same password/pin everywhere and pray that ill will never befall them.
toothbrush 10y ago
Yeah so about that 2FA. I have a local email client, which uses IMAP and hence cannot do 2FA. What now? I've always thought this is rather a gaping hole. Of course i use app-specific passwords which presumably won't allow access to webmail or changing the account password, but still, if someone got my app password for IMAP, they could still siphon out password reset emails for all my other services. What do the rest of you do? Only use webmail with 2FA, disable all other access? That seems onerous.
- tobyjsullivan 10y ago
  Depends on your underlying email service provider. If it is gmail, for example, then they provide one-time use passwords for exactly his purpose. What this means is if you enable 2FA for your gmail account, you can generate a one-time password to authorize any client which does not support a 2FA auth flow. This password is then destroyed by both parties. If you run your own email server, I think you are at low risk of being attacked in a more general phishing net. An attacker targeting you personally still has many options but that is much less likely.
  - sly010 10y ago
    > This password is then destroyed by both parties. I don't quite understand this. Won't the email client need the need the password every time to auth with IMAP?
    - zeroxfe 10y ago
      Some IMAP providers like Gmail use a more sophisticated auth mechanism where a secret token is shared over the encrypted link after the first password auth. This token typically has a long lifetime and is used for future sessions.
      - BrandoElFollito 10y ago
        I have never heard of that, do you have any sources?
- tedunangst 10y ago
  If you simply don't use webmail, you're about 99% less likely to accidentally type your password into a website that happens to look like your webmail login page (which doesn't exist).
  - toothbrush 10y ago
    Sure. FWIW i avoid using webmail as much as i can, but that's just because i love my mu4e. Still though, i wonder about what would happen in the (admittedly very unlikely) event that someone compromised my secrets file. (example off the top of my head: seized backup disk at border control)
x0x0 10y ago
Except 2fa doesn't work in practice unless you're an expert. See eg gmail: you can't set up 2fa without supplying a cell (you will be allowed to remove it later, but how many know to do this?) Your phone number is trivially stealable -- see eg youtube video of people just stealing phone numbers with a crying baby and a sob story. https://youtu.be/F78UdORll-Q?t=133 https://youtu.be/F78UdORll-Q?t=133 Also, lots and lots of places have trivial routes around 2fa because people losing their password and/or 2fa is an order of magnitude more common than theft.
- skylark 10y ago
  Google actually lets you use a physical key to protect your account. https://support.google.com/accounts/answer/6103534?hl=en&ref_topic=6103521 https://support.google.com/accounts/answer/6103534?hl=en&ref...
- striking 10y ago
  2FA works in practice against people who don't have physical contact with you. For most people, that's the only threat vector they're worried about. It hardly makes your life more difficult, and it does help at least a little bit. So it's worth setting up.
  - x0x0 10y ago
    Not really; sms as 2fa has regularly enabled people to steal accounts they otherwise couldn't have gotten by allowing password resets by stealing your phone number. See eg @deray getting hacked.
    - erroneousfunk 10y ago
      If a password reset is allowed by pin that's not two factor authentication, that's SINGLE factor authentication. I know we tend to think of 2FA as anything involving a pin sent to your phone, but it does require two factors. GMail, for instance, will not allow a password reset with just a phone pin.
- whyagaindavid 10y ago
id122015 10y ago
Your preaching but some ears cant hear you. I want to turn on 2FA but I dont know when will that day will come. It also happened to me to loose a smartphone without PIN, and I never thought it would happen and I kept postponing that simple step. Maybe this time I should listen.
- striking 10y ago
  2FA isn't hard to use, and is barely inconvenient. How often do you log into your email, anyway? Also, if you lose your phone, you can make use of your recovery code.
  - id122015 10y ago
    The reason I mentioned about loosing phone was not related to email recovery but the fact that I did not learn the security lesson of not using a PIN to protect my data. After I have read this post I wanted to actually enable 2FA right now, but then I discovered that breaking news, terror attack, and again I postponed, the same like I postponed securing my phone with a PIN.
    - Gigablah 10y ago
      Have you enabled 2FA yet?
- erroneousfunk 10y ago
  I keep backup codes for my account in two places: My wallet (which I always have on me, so I won't be locked out if I'm traveling), and at home. If you're really paranoid, you could also give backup codes to a friend or relative, or put them in a bank safe or something like that.

darkhorn 10y ago

Step #2 is to use unique passwords for your main email addresses. These passwords should be unique in the universe. You must not use them with another account or to encrypt a file etc. Nowhere! And step #3 is to keep all your softwares up to date; OS, antivirus, browser, your WordPress, its plugins, your Notepad++, WinRAR, firmware of your ADSL modem, other computers on the network, BIOS, smart TV etc. Everything should be updated to the latest version.

korethr 10y ago
And step #4 is to throw up your hands and shout "Fuck it!" the Nth time you lost everything because you can't find your master copy of your password manager, your back up has drifted out of sync, and you just accidentally spilled your coffee on the flash drive that holds your backup-backup--destroying it. Hyperbolic sarcasm aside, keeping on top of security is starting to feel like Alice and the Red Queen -- it takes as fast as you can run just to remain in place. I'm starting to feel a bit more sympathy for those who give up on good practices and start using the same password/pin everywhere and pray that ill will never befall them.

toothbrush 10y ago

Yeah so about that 2FA. I have a local email client, which uses IMAP and hence cannot do 2FA. What now? I've always thought this is rather a gaping hole. Of course i use app-specific passwords which presumably won't allow access to webmail or changing the account password, but still, if someone got my app password for IMAP, they could still siphon out password reset emails for all my other services. What do the rest of you do? Only use webmail with 2FA, disable all other access? That seems onerous.

tobyjsullivan 10y ago
Depends on your underlying email service provider. If it is gmail, for example, then they provide one-time use passwords for exactly his purpose. What this means is if you enable 2FA for your gmail account, you can generate a one-time password to authorize any client which does not support a 2FA auth flow. This password is then destroyed by both parties. If you run your own email server, I think you are at low risk of being attacked in a more general phishing net. An attacker targeting you personally still has many options but that is much less likely.
- sly010 10y ago
  > This password is then destroyed by both parties. I don't quite understand this. Won't the email client need the need the password every time to auth with IMAP?
  - zeroxfe 10y ago
    Some IMAP providers like Gmail use a more sophisticated auth mechanism where a secret token is shared over the encrypted link after the first password auth. This token typically has a long lifetime and is used for future sessions.
    - BrandoElFollito 10y ago
      I have never heard of that, do you have any sources?
tedunangst 10y ago
If you simply don't use webmail, you're about 99% less likely to accidentally type your password into a website that happens to look like your webmail login page (which doesn't exist).
- toothbrush 10y ago
  Sure. FWIW i avoid using webmail as much as i can, but that's just because i love my mu4e. Still though, i wonder about what would happen in the (admittedly very unlikely) event that someone compromised my secrets file. (example off the top of my head: seized backup disk at border control)

x0x0 10y ago

Except 2fa doesn't work in practice unless you're an expert. See eg gmail: you can't set up 2fa without supplying a cell (you will be allowed to remove it later, but how many know to do this?) Your phone number is trivially stealable -- see eg youtube video of people just stealing phone numbers with a crying baby and a sob story. https://youtu.be/F78UdORll-Q?t=133 https://youtu.be/F78UdORll-Q?t=133 Also, lots and lots of places have trivial routes around 2fa because people losing their password and/or 2fa is an order of magnitude more common than theft.

skylark 10y ago
Google actually lets you use a physical key to protect your account. https://support.google.com/accounts/answer/6103534?hl=en&ref_topic=6103521 https://support.google.com/accounts/answer/6103534?hl=en&ref...
striking 10y ago
2FA works in practice against people who don't have physical contact with you. For most people, that's the only threat vector they're worried about. It hardly makes your life more difficult, and it does help at least a little bit. So it's worth setting up.
- x0x0 10y ago
  Not really; sms as 2fa has regularly enabled people to steal accounts they otherwise couldn't have gotten by allowing password resets by stealing your phone number. See eg @deray getting hacked.
  - erroneousfunk 10y ago
    If a password reset is allowed by pin that's not two factor authentication, that's SINGLE factor authentication. I know we tend to think of 2FA as anything involving a pin sent to your phone, but it does require two factors. GMail, for instance, will not allow a password reset with just a phone pin.
whyagaindavid 10y ago

id122015 10y ago

Your preaching but some ears cant hear you. I want to turn on 2FA but I dont know when will that day will come. It also happened to me to loose a smartphone without PIN, and I never thought it would happen and I kept postponing that simple step. Maybe this time I should listen.

striking 10y ago
2FA isn't hard to use, and is barely inconvenient. How often do you log into your email, anyway? Also, if you lose your phone, you can make use of your recovery code.
- id122015 10y ago
  The reason I mentioned about loosing phone was not related to email recovery but the fact that I did not learn the security lesson of not using a PIN to protect my data. After I have read this post I wanted to actually enable 2FA right now, but then I discovered that breaking news, terror attack, and again I postponed, the same like I postponed securing my phone with a PIN.
  - Gigablah 10y ago
    Have you enabled 2FA yet?
erroneousfunk 10y ago
I keep backup codes for my account in two places: My wallet (which I always have on me, so I won't be locked out if I'm traveling), and at home. If you're really paranoid, you could also give backup codes to a friend or relative, or put them in a bank safe or something like that.