3 ms·

Why are so many people here trying to reinvent the wheel? We already invented the wheel that fixes this particular problem, it's called 2FA. If users decide no

Why are so many people here trying to reinvent the wheel? We already invented the wheel that fixes this particular problem, it's called 2FA. If users decide not to use it, then there's nobody to blame but them. Thinking up ever more complex schemes, to offload all the responsibility on the services, won't solve any of this. At the end of the day user error overrides it all and massive database breaches even affect those that should know how to properly secure their stuff [0]. 2FA is not perfect, it's not convenient but it's one of the last remaining effective defenses when massive breaches have become so normalized that known pwned accounts outnumber people alive on the planet [1]. [0] https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/ https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-... [1] https://haveibeenpwned.com/ https://haveibeenpwned.com/

thorwasdfasdf 7y ago
or how about just don't re-use passwords accross accounts. If they had used a unique password they would've been fine right? I don't understand what users want google to do: it's the house equivalent of taking your key and leaving it at the grocery store.
- rvnx 7y ago
  It's not so sure, in some cases, passwords can be compromised by other ways directly from the source, or accesses can be derived from misimplemented APIs. No matter how big the company is, this is really realistic. Facebook, Google and others all used to leave some passwords in clear-text during very long time for anyone to check in the logs. Google even got their central password system compromised and source-code stolen (Gaia). It can also be a password recovery process that can have glitches (Steam), or just not checking password properly due to deployment errors (Dropbox) or just compromised servers (my unique EA Origin password was compromised like this, my LinkedIn password as well, my Twitter password...) etc many possibilities
  - freeflight 7y ago
    At this point, I just assume that any password I have somewhere is public in some way, if something doesn't have 2FA, it might as well be compromised. Case in point: I just checked an e-mail account I haven't used in close to 20 years, even that thing has now a somewhat lengthy haveibeenpwned profile.
  - rvnx 7y ago
    Sources: Google Gaia: https://www.itnews.com.au/news/insider-reveals-details-of-google-hacks-172661 https://www.itnews.com.au/news/insider-reveals-details-of-go... LinkedIn: https://en.wikipedia.org/wiki/2012_LinkedIn_hack https://en.wikipedia.org/wiki/2012_LinkedIn_hack Facebook: https://www.theguardian.com/technology/2018/sep/28/facebook-50-million-user-accounts-security-berach https://www.theguardian.com/technology/2018/sep/28/facebook-... (fun fact, it happened TWICE) Dropbox: https://www.troyhunt.com/the-dropbox-hack-is-real/ https://www.troyhunt.com/the-dropbox-hack-is-real/ Another Dropbox: https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
  - thorwasdfasdf 7y ago
    Well, in that case, as a long term solution, we need to start teaching basic tech security in k-12, kinda like we teach kids drivers ed, home economics, shop class, etc. It doesn't have to be a whole class. Maybe just 1 or 2 hours per year, go through all the basics of security like how to 2FA, and how to pick unique passwords. Or use some kind of hashing strategy that's based on remembering a single password. It would use your psssword plus the login website name to generate a unique password.
rvnx 7y ago
Or just that current users get a confirmation prompt to allow a new device ? (like on Authy) Likely safer than SMS 2FA as well.
TheRealWatson 7y ago
Let's not blame the victim. The general consumer does not buy a device assuming it's ripe for hacking and that they have to take extra steps to configure it more securely. It's the manufacturer's fault to allow the weak configuration in the first place.
- freeflight 7y ago
  > The general consumer does not buy a device assuming it's ripe for hacking No devices were hacked here, just like nothing about this had anything to do with the device's security configuration. This was user error of first reusing passwords, and then not bothering to secure their Google account, the actual attack vector, with 2FA.

thorwasdfasdf 7y ago

or how about just don't re-use passwords accross accounts. If they had used a unique password they would've been fine right? I don't understand what users want google to do: it's the house equivalent of taking your key and leaving it at the grocery store.

rvnx 7y ago
It's not so sure, in some cases, passwords can be compromised by other ways directly from the source, or accesses can be derived from misimplemented APIs. No matter how big the company is, this is really realistic. Facebook, Google and others all used to leave some passwords in clear-text during very long time for anyone to check in the logs. Google even got their central password system compromised and source-code stolen (Gaia). It can also be a password recovery process that can have glitches (Steam), or just not checking password properly due to deployment errors (Dropbox) or just compromised servers (my unique EA Origin password was compromised like this, my LinkedIn password as well, my Twitter password...) etc many possibilities
- freeflight 7y ago
  At this point, I just assume that any password I have somewhere is public in some way, if something doesn't have 2FA, it might as well be compromised. Case in point: I just checked an e-mail account I haven't used in close to 20 years, even that thing has now a somewhat lengthy haveibeenpwned profile.
- rvnx 7y ago
  Sources: Google Gaia: https://www.itnews.com.au/news/insider-reveals-details-of-google-hacks-172661 https://www.itnews.com.au/news/insider-reveals-details-of-go... LinkedIn: https://en.wikipedia.org/wiki/2012_LinkedIn_hack https://en.wikipedia.org/wiki/2012_LinkedIn_hack Facebook: https://www.theguardian.com/technology/2018/sep/28/facebook-50-million-user-accounts-security-berach https://www.theguardian.com/technology/2018/sep/28/facebook-... (fun fact, it happened TWICE) Dropbox: https://www.troyhunt.com/the-dropbox-hack-is-real/ https://www.troyhunt.com/the-dropbox-hack-is-real/ Another Dropbox: https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
- thorwasdfasdf 7y ago
  Well, in that case, as a long term solution, we need to start teaching basic tech security in k-12, kinda like we teach kids drivers ed, home economics, shop class, etc. It doesn't have to be a whole class. Maybe just 1 or 2 hours per year, go through all the basics of security like how to 2FA, and how to pick unique passwords. Or use some kind of hashing strategy that's based on remembering a single password. It would use your psssword plus the login website name to generate a unique password.

rvnx 7y ago

Or just that current users get a confirmation prompt to allow a new device ? (like on Authy) Likely safer than SMS 2FA as well.

TheRealWatson 7y ago

Let's not blame the victim. The general consumer does not buy a device assuming it's ripe for hacking and that they have to take extra steps to configure it more securely. It's the manufacturer's fault to allow the weak configuration in the first place.

freeflight 7y ago
> The general consumer does not buy a device assuming it's ripe for hacking No devices were hacked here, just like nothing about this had anything to do with the device's security configuration. This was user error of first reusing passwords, and then not bothering to secure their Google account, the actual attack vector, with 2FA.