14 ms·

I was a very happy FastMail customer until a hacker asked them to reset my password. After _incorrectly_ answering a handful of questions asked by the FastMail

• samat 9y ago
  Dear Fastmal, I am a happy customer, but very concerned by this report. Would you mind to comment?
  • deleted 9y ago
    [deleted]
  • samat 9y ago
    I just forwarded this comment to their customer support. Let’s see what would be their comment.
    • terraforming 9y ago
      Please tag me when they answer. (does HN have tags/notifications?)
      • Stratoscope 9y ago
        > does HN have tags/notifications? No, but if you visit your Threads page (link at the top of every page) you can see any replies to any of your comments. There's nothing special that marks a new reply, though. I have a habit of upvoting nearly every reply anyone makes to any comment of mine, as a way of thanking them for the comment. This also happens to help when I skim my Threads page, since it's easy to spot comments that still have the voting button(s).
        • callahad 9y ago
          Dan Grossman's http://www.hnreplies.com/ http://www.hnreplies.com/ works wonders
  • Osmium 9y ago
    Likewise. Social engineering is a big concern. I understand the risks of getting locked out of my account, but would much prefer a stricter system -- along with published guidelines on Fastmail's process for handling these cases. Being able to persuade a customer service rep to provide access to an account (even if indirectly by changing a recovery email) should never be possible.
• nvarsj 9y ago
  Did you also have 2fa?
  • ghouse 9y ago
    No, I did not. And I certainly should have. However, 2fa would not have prevented the problem. The problem is twofold -- 1) account recovery (using email, SMS, or anything other than a secret key) is an effective attack vector. Especially SMS. 2) a human who will change the account recovery settings (in my case, FM changing the account recovery email address).
    • nvarsj 9y ago
      Hmm you think they would have bypassed your 2fa as well? I wonder if FM can comment on that - it would be concerning. The "sms backdoor" is the same with gmail, etc. unless you explicitly disable it.
      • soufron 9y ago
        What is the sms backdoor?
        • rbritton 9y ago
          Probably this [0]. They can get phone companies to issue a SIM for your number, which will then receive the SMS reset or 2FA code. [0]: https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto...
        • snowpanda 9y ago
          Sim swapping: http://www.fraud.org/sim_swapping_alert http://www.fraud.org/sim_swapping_alert
      • deleted 9y ago
        [deleted]
      • brongondwana 9y ago
• terraforming 9y ago
  That is a very weird thing to do, and easily fixed. Just do an average of log-ins per day/week, and do not accept any reset passwords (from customer support) before that avg time has elapsed (+ an uncertainty) since the last time you checked the email. How come they accepted the reset? Were you not logging in your account?
  • ghouse 9y ago
    I was logging into my account. I discovered and reported the incident within 45 minutes of the compromise.
• ilikepi 9y ago
  Just curious...was this incident before or after they re-architected their authentication system? I believe that was done last July[1]. The new system is really nice, now implementing separate app-specific passwords as well as new emergency recovery mechanisms. I wonder if they updated their internal support policies with respect to assisted account recovery when they implemented the new system...seems like they should have made the bar higher... [1]: https://blog.fastmail.com/2016/07/25/two-step-verification-and-other-new-security-features/ https://blog.fastmail.com/2016/07/25/two-step-verification-a...
  • ghouse 9y ago
    The incident was late July, 2016, but before the date on that blog post.
    • ilikepi 9y ago
      I don't actually recall when the new system went live for all users, but the old system was live simultaneously for at least a couple months to ease the transition. I wonder if customer support actually lowered the bar during the transition because of a perceived or actual increase in customers locking themselves out.
• deleted 9y ago
  [deleted]
• tptacek 9y ago
  This is death. Your email provider absolutely cannot under any circumstances have this vulnerability. Wow. Just the idea that there's a human in the process making subjective decisions about security questions and answers that can, on their own recognizance, change a recovery email address. Forget the immediate mistake that one rep made, and go down a couple levels deeper into the company policy design mistakes at play here. Thank you for relating this.
  • ZoF 9y ago
    You're aware this is how the vast majority of email providers legacy operated right? (And sadly a few still do) E.g. in this case likely a 2 point auth system (security question and e.g. payment details (last four of latest payment meth/etc)) Seems you're shocked that a lower tier support agent can auth this kind of request when the reality for most email hosts is that they can. They(likely a new employee) got socialed. Yes, they should have systems in place to prevent this from being possible in the first place; no, I do not find your incredulity genuine, albeit rational.
    • lvh 9y ago
      FastMail isn't some random legacy email provider. It's a premium one that bills itself as secure. It's not some free mailbox you got with your budget domain registrar. Hence, it's reasonable to hold them to a higher standard rather than fatalistically observing that the median email provider sucks.
      • ZoF 9y ago
        I know, still don't buy his outrage. I think the response would be far less exaggerated for a HN sponsored company. By legacy provider I don't mean a 2010 cpanel reseller, I mean the majority of current providers outside of the big four. Especially anything with concurrent web hosting. Again this isn't excusing their incompetence, just disagreeing with the severity of his response, especially given theirs.
  • forapurpose 9y ago
• ptomato 9y ago
  That's very unacceptable, and enough to make me consider leaving Fastmail - I've used them happily for over 7 years and have recommended them to many people, but their support having the ability to do that is giving me pause.
• Chaebixi 9y ago
  > I was a very happy FastMail customer until a hacker asked them to reset my password. After _incorrectly_ answering a handful of questions asked by the FastMail support, the recovery email address was changed and a password reset link sent. From there, the hacker attempted password resets on other services. When did this happen?
  • ghouse 9y ago
    July 2016
• brongondwana 9y ago
  Good morning. I'm going to be here to answer specific questions, and I owe you a personal response to this as well, which I'm about to start working on! There is no doubt that in this specific case our human factor screwed up, and I'm really sorry about that. First I'm going to post the standard response that our team has written for any new support tickets that come in about this today, then write my own personal apology and response here. --- Thanks for getting in touch with us about the report on Hacker News about our security procedures. As we say in our recent post about security at https://blog.fastmail.com/2017/12/05/the-fastmail-security-mindset/ https://blog.fastmail.com/2017/12/05/the-fastmail-security-m..., security is a process, not a checkbox. We do our best to be continually improving and upgrading our security procedures, and offering our security-minded customers the most robust, industry-standard options possible. However, we have been less diligent about forcing older accounts to upgrade their security settings. With a range of possible security option states, customer support is occasionally placed in a position to make a judgement call. As the post indicates, the incident in question happened immediately after a major round of security changes. There’s no way around it; someone made an exception they shouldn't have. Social engineering is always one of our biggest concerns. As any number of well-known break-ins have demonstrated, the "best" security hack is often to sidestep it. Since that incident, we have taken substantially more aggressive steps to close off avenues of attack and human review. We are constantly trying to narrow the number of accounts that even can go to a human for review, and for those that must go to a human to provide as much notice as possible to the account owner before possibly allowing the attacker to have access. For instance, some cases take 24 hours before the reset password goes into effect. If you are a legitimate account owner, this has the often frustrating side effect of locking you out of your account for 24 hours. But, if you have been attacked, this gives you the opportunity to keep the attacker out. Thank you for sharing your concern with us, and I hope we’ve addressed yours.
  • dannysu 9y ago
    This can be enough for me to consider leaving depending on how it's fixed. This response says absolutely nothing about how the vulnerability is prevented in the future. It's just a bunch of vague promises and mumbo jumbo. What specific procedures are in place to prevent it? At a minimum, I expect to see something specific like when you guys almost lost your domain because of Gandi [1]. And even then, can I have an option to select absolutely no human intervention possible? Having any human intervention is simply not acceptable. I already have multiple ways of recovering my account, and I never, ever want human assistance on this. I use a password manager, and I will never, ever need FastMail assistance on login. [1]: https://blog.fastmail.com/2014/04/10/when-two-factor-authentication-is-not-enough/ https://blog.fastmail.com/2014/04/10/when-two-factor-authent...
• dannysu 9y ago
  Just wondering, is your FastMail login email the same email as what you typically use?
• brongondwana 9y ago
  Now to write a more detailed response. If this winds up out of order later, I first posted: https://news.ycombinator.com/item?id=15856609 https://news.ycombinator.com/item?id=15856609 Again, ghouse, I'm really really sorry about what happened to your account. It was wrong and we screwed up. As other comments have already noted, it was during the transition to a new security system which was designed precisely to remove the human factor from decision making. I'm an Australian, and I'm a great fan of our "100 points of ID" system, which is designed to remove the human factor from identifying people. https://en.wikipedia.org/wiki/100_point_check https://en.wikipedia.org/wiki/100_point_check While I wasn't aware of your account's issue at the time (and we'll be having some discussions internally about why not!), FastMail management were all aware that we needed to get the human factor out of decision making about account access, particularly since somebody tried to pull a similar swindle on our domains! https://blog.fastmail.com/2014/04/10/when-two-factor-authentication-is-not-enough/ https://blog.fastmail.com/2014/04/10/when-two-factor-authent... We spent a lot of 2016 and 2017 working on an automated account recovery system which allows recovery of locked accounts via a carefully audited set of automated steps, which includes a 24 hour lockout to allow the owner to notice an attempt on their account. If this had existed in 2016 then we would have sent you there rather than having a human make a (poor in this case) judgement call! https://www.fastmail.com/help/account/icantlogin.html https://www.fastmail.com/help/account/icantlogin.html
  • tptacek 9y ago
    I don't understand this response. I'm glad you're working to minimize human factors. Can you explain how exactly you're doing that? I asked some specific questions here: https://news.ycombinator.com/item?id=15856755 https://news.ycombinator.com/item?id=15856755
  • ghouse 9y ago
    Thank you. I appreciate your response and understand that you've made improvements since this incident in 2016.
  • xmodem 9y ago
    > a 24 hour lockout to allow the owner to notice an attempt on their account. I've been pretty careful to ensure that I don't lock myself out of my account (multiple U2F keys, strong password saved in password manager with backups) But if a determined attacker kicks this off just as I'm stepping on a flight from Sydney to London, 24 hours isn't going to be enough. (I should add also - I'm a mostly happy Fastmail customer)
• blahshaw 9y ago
  How recently was this?
• kome 9y ago
  "FastMail has always been an engineering-focused company, from the top down. As such there is a strong culture of no-bullshit, and an intense dislike of security theatre." After OP comment, that's hilarious. And yes, I am a fastmail user as well. How long will it take to an "engineering-focused company" to understand that humans are humans?
• deleted 9y ago
  [deleted]
• deleted 9y ago
  [deleted]
• delhanty 9y ago
  I've been a long-term customer of them, but I'm continually under-whelmed by them. They admit, if you push them, that they economize on front-line support. I think what you relate is a consequence of that. In a previous thread, I went on a massive whinge-fest about how they had "sun-setted" the one-time $15 payment member account that I set up for my father and that they had previously advertised using the words "never expires". I stand by that because they were in breach of contract. On the other hand, I don't think they are charging enough really. I would probably be prepared to pay more than I do if I had confidence that they weren't using low-skilled labor for front-line support.