4 ms·

> If you are using your Google Apps email address to log into various websites, I strongly suggest you stop doing so. Use an @gmail.com for logins. This strike

> If you are using your Google Apps email address to log into various websites, I strongly suggest you stop doing so. Use an @gmail.com for logins. This strikes me as bad advice. Getting access to a hijacked Google account is about as hopeless as everything else he got put through. The point of failure wasn't "using a non-gmail address," it was "using an untrustworthy registrar." And I know it's not a silver bullet, but it's unclear from the article that he was using MFA for his GoDaddy account.

golover721 7y ago
Unfortunately MFA doesn’t help in this case if an attacker can just circumvent it by calling customer service to fairly easily bypass it.
deleted 7y ago
[deleted]
Mathnerd314 7y ago
Multiple accounts means more work for the attacker. E.g. using unique emails for Paypal, Godaddy, and Facebook would have made this harder.
brianmcd 7y ago
> The point of failure wasn't "using a non-gmail address," it was "using an untrustworthy registrar." But wasn't his point that gmail.com is much less likely to have its MX record compromised than any domain you could possibly register? So using your gmail.com address removes the issue of registrar trustworthiness completely.
- ansible 7y ago
  You're trading registrar trustworthiness for email provider trustworthiness. I'm not sure what is better. I suppose I should start actually paying for email, and go with protonmail or somebody like that. If they have decent and competent customer service, that would reduce the chances of getting hacked.
s_dev 7y ago
> MFA for his GoDaddy account. Sim Hacking is now a thing to get around MFA but it wasn't as popular in 2014. Call up the telecom provider and use the same approach. Leverage Googleable info of the target person and use that as answers to the customer support reps questions.
- Eric_WVGG 7y ago
  I should have specified "MFA with an authentication app" I suppose.
- jwr 7y ago
  > Sim Hacking is now a thing to get around MFA SMS is not a second factor, despite many companies pretending that it is. I am alarmed at the number of large companies (especially banks!) that just blindly and stupidly follow the outdated advice of using SMS messages as 2FA. So, MFA is great, if it is really multi-factor: TOTP through Authy or Google Authenticator, U2F or WebAuthn through a hardware key like a YubiKey.

golover721 7y ago

Unfortunately MFA doesn’t help in this case if an attacker can just circumvent it by calling customer service to fairly easily bypass it.

deleted 7y ago

[deleted]

Mathnerd314 7y ago

Multiple accounts means more work for the attacker. E.g. using unique emails for Paypal, Godaddy, and Facebook would have made this harder.

brianmcd 7y ago

> The point of failure wasn't "using a non-gmail address," it was "using an untrustworthy registrar." But wasn't his point that gmail.com is much less likely to have its MX record compromised than any domain you could possibly register? So using your gmail.com address removes the issue of registrar trustworthiness completely.

ansible 7y ago
You're trading registrar trustworthiness for email provider trustworthiness. I'm not sure what is better. I suppose I should start actually paying for email, and go with protonmail or somebody like that. If they have decent and competent customer service, that would reduce the chances of getting hacked.

s_dev 7y ago

> MFA for his GoDaddy account. Sim Hacking is now a thing to get around MFA but it wasn't as popular in 2014. Call up the telecom provider and use the same approach. Leverage Googleable info of the target person and use that as answers to the customer support reps questions.

Eric_WVGG 7y ago
I should have specified "MFA with an authentication app" I suppose.
jwr 7y ago
> Sim Hacking is now a thing to get around MFA SMS is not a second factor, despite many companies pretending that it is. I am alarmed at the number of large companies (especially banks!) that just blindly and stupidly follow the outdated advice of using SMS messages as 2FA. So, MFA is great, if it is really multi-factor: TOTP through Authy or Google Authenticator, U2F or WebAuthn through a hardware key like a YubiKey.