17 ms·

Hacked Gmail Account

389 points by madewulf 15y ago

spacemanaki 15y ago
I bet signups for Gmail's 2-factor auth spikes when stories like this start circulating. It's awesome that they provide it. I fear it might be too much to ask for my mom, grandmother, etc, who are probably more vulnerable to being attacked in the first place (weaker, duplicated passwords for sure).
unshift 15y ago
tl;dr: don't give your password to anybody. we've been saying this since the mid-90s but people still seem to slip up. gmail's two-factor auth is nice and easy with the handy iPhone app. of course nobody wants to complicate something like sign-in, but email integrity is very important. facebook also has a similar two-factor auth process (though not as nice; they text you, vs a nice app). two-factor is a no-brainer at this point for managing your identity, especially given the huge volume of leaked passwords we've seen in the past month. it only takes a few minutes to set up and almost completely eliminates problems like the one in this article. if you haven't set it up yet, do it now! much easier than learning the hard way.
- kingkawn 15y ago
  FB has been requesting my phone number to complete the authentication backups for a few weeks now, and the ability to opt out is not clearly marked. I have the nagging feeling that this is much more about getting my cellphone into their system.
  - vegardx 15y ago
    Or just the fact that they are overwhelmed by users requesting to get their accounts back. A two-factor solution is the only solution to the problem with password reusing that we've been fighting since passwords were first thought of. People are dumb, you can tell them a gazillion time to never use the same password on different sites/programs/whatever, they still do it. Also, by providing it via text messages compared to an application they reach out to a much broader audience. Not just tech-savvy people like you and me, who probably already had a proper password policy.
- abraham 15y ago
  Which is a bit silly since Facebook already has one of the most popular mobile apps installed on millions of devices.
  - riffraff 15y ago
    but facebook also has many million users who don't have an iPhone nor android phone yet, who can still use two factor auth (i.e. my girlfriend)
- mattmanser 15y ago
  Given that he was sorting out his gf's account because he knew her password, that's not at all an accurate tl;dr.
muppetman 15y ago
I read a story similar to this a few weeks ago. The guy recovered his account, changed all passwords, but then it was snatched again. Rinse and repeat, I think he got it back in the end though. Very strange - he thought he'd been targetted specifically.
sorbus 15y ago
> most distressing to me is that I am still unable to explain how those guys were able to get access to the account twice after I changed the password, security questions and backup email address from my Mac that does not seem to be compromised. It sounds very much like the hackers were also using the "last chance form." Consider that all of the information it requests is available through Gmail - account registration data, names of tags, most emailed people, and verification code (which was apparently emailed to him, and therefor present in the compromised email account) (Note: I haven't used the form myself, I'm going on the information in the article). Also, the title is a bit link-baitish.
- saool 15y ago
  I think the windows xp box he says he had his wife turn off had a trojan in it.
  - sorbus 15y ago
    That doesn't make sense. He changed the passwords, as well as using Gmail's ability to end all other sessions. Unless he was giving his SO (he never calls her his wife) the password and she was logging in on that computer, there should have been no way for a trojan on it to access the account.
    - yaakov34 15y ago
      They were probably using the "last chance" form to reset the password. That form checks the IP address; if they had control of the XP machine, they could have been using it to submit the form with a reasonable IP address and get the account again. Once they lost that, no go. At least that's the only thing that I can think of.
      - sorbus 15y ago
        Ah, that makes sense. I didn't realize that the form checks IP addresses, though, in retrospect, that's an extremely obvious security feature to have.
drivebyacct2 15y ago
Not sure why any of these steps should lead you to fear about using Gmail. Hosting your email yourself is almost surely more risky. Those hosting their own email aren't going to have complex password recovery system with the abuse protection that Google's has. There isn't going to be a warning system to alert you that there have been sign-ons from foreign states/countries. There isn't going to be two-auth out of the box unless you install the PAM module. If your weak link, was, as usual, the human link... I would be inclined to trust a system more catering to (forgive me) ignorant users. I just worry that the mindset is, "I got hacked because I use Gmail, if I used something else I'd be safer." and I find that logical to be pretty flawed.
- ams6110 15y ago
  In the sense that Gmail is a big target, and a self-hosted account is a tiny one, I do understand the feeling that if for no other reason than obscurity, you are safer avoiding the "big names" in any online service.
- pavel_lishin 15y ago
  > There isn't going to be a warning system to alert you that there have been sign-ons from foreign states/countries. There isn't going to be two-auth out of the box unless you install the PAM module. Your points are valid, but why wouldn't these things exist? Doesn't code exist to do this? And if not, is it truly difficult to write? I'm not saying it's a trivial task, but someone who decides to host their own e-mail would probably be willing to work at it.
  - drivebyacct2 15y ago
    Well, they probably do exist, but not as a default install of any webmail client that I've used in the last few years.
    - deleted 15y ago
      [deleted]
  - there 15y ago
llgrrl_ 15y ago
This is exactly why I'm using two-factor authentication for gmail (heck, I even ported the two factor auth code generator to my watch so I don't have to panic when my android phone runs out of battery - http://tnhh.net/pancake/chronos-otp.xml http://tnhh.net/pancake/chronos-otp.xml :-) However, I don't use Gmail for 'everything,' it's just too dangerous and I feel doing that way Google knows more about me than they should. I think everyone should be hosting the main email address under something that they can sure control (your work/edu account, or a paid email service). My main account is hosted on fastmail (I paid something like 12 bucks for three years) and is cloaked under a dozen of other email addresses. Plus, for fastmail you get a free smtp account, and a standard IMAP account (gmail's IMAP is weird). And they will respond if you're in troubles.
- ianterrell 15y ago
  Gmail's IMAP is awesome. I remember the first time I connected my iPhone to it and wondering how to archive a message. "Well, it stays in 'All Mail,' so I'll just move it there." Presto! It worked. Naturally, you have to like the Gmail conventions to like the Gmail implementations.
  - rgrove 15y ago
    From the point of view of someone writing an IMAP client, Gmail's IMAP implementation is not awesome. It's not horrible either, but it does have quite a few quirks, some of which can be a real pain to deal with.
- ams6110 15y ago
  I also use Fastmail. I'm grandfathered into a plan they no longer offer: a one-time payment which got me a modest (16M) quota (I download and purge my email from their service so that's not an issue for me) and access to their SMTP service.
- pavel_lishin 15y ago
  So, at this point, doesn't Fastmail know more about you than they should?
chapel 15y ago
One thing you should check for if your email was compromised is the pop3 forwarding and imap. Attackers will forward your emails to their own accounts using either or both. This makes it very easy for them to retake your account.
- ianterrell 15y ago
  Another note is to check your "Reply-to" email. A friend of mine's Gmail account was compromised (say her email was iluvkittens@gmail.com) and they had subtly changed it (perhaps to iluvkitttens@gmail.com). Her oblivious contacts (including me) replied to her "cry for help," but the messages went straight to the hacker's address. This kept her contacts in conversation with the hacker even after she regained control of her account.
hzay 15y ago
I went through this two years ago. My ex was hacking into my accounts. - He used the 'last chance form' to get into my gmail by entering the password I'd given him a year before this (I'd changed the password twice after giving him that password) - He ran a dictionary attack on my college email which didn't have captcha's, then hacked gmail using the password that worked for my college email - We were using shared vnc in college, he found his way to my firefox through a mutual friend, installed a plugin that sent him all POST data and got into my gmail again I created a new gmail account after each incident. I had to abandon each gmail account once it was cracked because of the 'last chance form'. Back then, you only had to give it one or two correct past passwords, and it gave you access. On hindsight, I've been remarkably dense, but it was a good, early lesson.
- pavel_lishin 15y ago
  Sorry to focus on this (this is Hacker News after all), but did he write his own Firefox extension for this? Or is there one available?
  - hzay 15y ago
    He told me he wrote his own.
    - pavel_lishin 15y ago
      To return from nerd mode, did you consider at some point relating your story to an uncle, and then explaining the concept of "rubber hose cryptanalysis, and letting him connect a few dots?
      - hzay 15y ago
        :) No. I was playing a kind of zero-acknowledgement game, as a friend called it.
- DannoHung 15y ago
  And now we know why he's your ex.
51Cards 15y ago
I haven't set up two-factor auth yet because I don't always have my phone handy and my understanding of it is that on each log-in you need to use both factors. My comments below are based on this understanding so forgive me if I'm wrong. What I would love is if instead it asked for both factors under these circumstances: - option A - on every login like it is now. - option B - at least once every X days, with a warning that "within the next three logins you'll need to use your second auth" so I will know when it's coming without being locked out because my phone is dead. - in both of the above cases ALWAYS require two factor auth every time I change the account settings (like password, recovery addresses, etc.) Possibly even require it when I try to do things like purge a mailbox entirely or bulk email all my contacts. Having this blended option would make it a no brainer for me Edit: Thanks all for the clarifications below. I am going to give it a try.
- mathrawka 15y ago
  It has the option (on by default actually) to remember that session for the next 30-days. I turn it off everytime, because I want to be asked for my second factor regardless of the situation. In the event I don't have my phone with me, I carry the printout of backup codes in my wallet.
- RyanKearney 15y ago
  It asks on every login or you can opt to not require the second factor for 30 days on that machine via a checkbox when entering the other factor. You can also print out a list of 10 one-time use codes to log into your account if you don't have your phone handy.
- jackowayed 15y ago
  As for not always having your phone with you, you can print out one-time passwords. So you print some out, put them in your wallet (and maybe more in your home), and then if you don't have your phone/your phone breaks/whatever, you can use one from that list. But then that one off of that list is dead. Also, I'm pretty sure there's some option where it only does the 2nd factor once a month if it's on a computer it recognizes.
pavel_lishin 15y ago
So, it seems that the XP machine was the source of intrusions - I'd like to see a follow-up.
- iwwr 15y ago
  What role did the separate XP machine play? After changing the password and dropping all active sessions, what else is there to allow someone in?
  - pavel_lishin 15y ago
    I have no idea, but he mentioned that the e-mail account was accessed from it, and once it was shut down, the intrusions stopped.
RyanKearney 15y ago
> Time now for some damage evaluation. I immediately saw that all contacts had been deleted (annoying but not too bad) There's pretty much a one-click restore process now: http://i.imgur.com/1EYZ5.png http://i.imgur.com/1EYZ5.png
- Matt_Cutts 15y ago
  Please upvote Ryan's advice. Click on Contacts, then look for "More actions," then click "Restore contacts..." You can find more info about restoring contacts at https://mail.google.com/support/bin/answer.py?answer=1069522&hl=en https://mail.google.com/support/bin/answer.py?answer=1069522... or read the blog post from a few months ago at http://gmailblog.blogspot.com/2010/12/restore-your-contacts.html http://gmailblog.blogspot.com/2010/12/restore-your-contacts....
raldi 15y ago
What I'd like is one-factor for my typical "log in and check mail, write back to a few people" use case, and two-factor or a second password that kicks in when I (or a bad guy) tries to: * Log in from a computer that's never used this account before * Set up a forward * Make a mass mailing * Change the password * Do extensive searching or searching for suspicious terms ("password", "credit card", etc) * Export a large amount of mail ...and other such things. That way, I don't have to be inconvenienced by constantly having to use the second factor, but would still survive a stolen laptop, keylogged passord, or sniffed cookie with a contained amount of damage.
- plasma 15y ago
  Agreed; I got half way through setting up Google's 2 factor but then was told I had to use it for every login, instead of say when I was logging in from a different IP or doing some big change.
  - scottbessler 15y ago
    When you log in with 2 factor you have the option to validate the current machine for 30 days.
  - dlokshin 15y ago
    You don't actually have to use it on every login. There's an option to remember a computer for 30 days. I have this option ticked in a single browser on my main laptop, and I input the verification key for everything else. Not a pain at all and definitely worth the added security.
    - barrkel 15y ago
      30 days, divided by the number of computers you log in on. In my case that could be as much as 7 machines, so I'd expect to need to log in every 4 days or so. Definitely more hassle than desired.
    - ern 15y ago
      If you use more than one browser per machine, you need to reauthenticate for each one, which multiplies the inconvenience. Also the need to generate passwords for apps that don't use 2 factor authentication (IMAP, IM clients). Although, I still think it's worth the added effort.
josephcooney 15y ago
A friend of mine got his domain stolen recently. He believes his gmail was brute-forced through a known vulnerability/feature when POP is enabled http://seclists.org/fulldisclosure/2009/Jul/254 http://seclists.org/fulldisclosure/2009/Jul/254 . He did a write up http://secretgeek.net/sg_hijack_1.asp http://secretgeek.net/sg_hijack_1.asp and here http://secretgeek.net/sg_hijack_2.asp http://secretgeek.net/sg_hijack_2.asp . As soon as this happened to him I turned on 2-factor auth and it works very well.
aj700 15y ago
They should be asking for certain characters of your password now, to defeat keyloggers. If you've got tons in the cloud, you need bank-level security. If people can cope with it for banking, they can cope with it for gmail.
- r00fus 15y ago
  I sure as hell hope they can't ask for certain positions/characters of my password, as that would imply a non one-way function (ie, hash) applied to the password stored on their servers. LulzSec has proven why this might be very bad.
Matt_Cutts 15y ago
The key part of the blog post for me is this: "To mitigate the risk, Google recently launched two-factor authentication, a mechanism that requires you to input, on top of your password, a code generated by an application installed on your phone (iPhone, Android and maybe some others). I have activated this today." Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account (domain registration info, passwords/access to shopping sites, etc.) and should activate two-factor authentication: http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... Is it a little more hassle? A bit. But when someone else tries to log in from a new IP address in the Ivory Coast, or China, or wherever--they'll be prompted for a PIN and won't be able to log in. I activated two-factor authentication as soon as I could on my Gmail. I think everyone reading this comment should too.
- briguy 15y ago
  Perhaps a happy medium (between security and practicality) would be to have the option to only apply two-factor lock-down to "admin" type functions(i.e. to change cell phone, change secondary email, etc). This would allow a hacker to perhaps gain access to your email, however would not be able to completely hi-jack your account.
- kelnos 15y ago
  I would really like to activate two-factor auth for my GMail account, but I just don't trust my phone that much. The battery life is terrible, and I'd be afraid of losing access to my account if the phone breaks. Or what happens if I lose my phone? Or if someone steals it? Presumably there's a way to handle that case, but it still bothers me. On the plus side, I'm using a Google Apps account with a domain I control, so I could quickly switch to a backup mail provider, but it's of course a huge hassle, and I keep a lot of email in my GMail account. How do you deal with these kinds of issues? I really do want to use two-factor auth, but this stuff scares me about as much as the possibility of getting hacked.
  - pipeline_tux 15y ago
    They provide a list of backup codes which you're meant to print and put in your wallet.
paraschopra 15y ago
Just enabled 'Two factor authentication'. Thanks for writing this. Made me realize the loss I would incur if my account gets hacked.
namank 15y ago
I worry about this a fair bit. This is why I am in the process of cloaking my gmail with a throwaway address (ping@namank.com) And I just suggested gmail this: ----- Gmail runs my life, as it does yours! Yes, I have an alternate email but whoever has my password can change it and then I'm LOST! You need to make this hackproof (yes yes, i know. but please, atleast TRY) I suggest: -Have a backdoor password. There MUST be a 24-48 hour window between changing the backdoor password and the main password. -Must be a 24 to 48 hour window between a password change and alternate email change. -----
jdhopeunique 15y ago
It would be nice if Gmail and Facebook had two separate passwords: one for everyday login and another for administrative functions such as changing passwords, forwarding options, etc.
KingOfB 15y ago
This happened to my girlfriend and I had a similar freak out. After asking a few more questions she remembered getting an email to enter her gmail password to get more storage space.... She knows better, but just didn't think about it - it seemed legitimate. Ask your friend more questions, I bet she fell for the same scam. I've met 4 people now that fell for the same one. I'm also very concerned about the no 'restore' option from gmail. What good are google backups if you can't initiate them?
swaits 15y ago
You get what you pay for.
riffraff 15y ago
the "last chance form" (or "account recovery exam") really is a hard and impossible to find thingy. Also, I frankly have no idea about when I started using some services, and worst, no clue on how to find out.
paulnelligan 15y ago
Something i do quite regularly is google search each of my passwords, and I would advise anyone to do the same. I found several older passwords with my login up on a file-sharing website not so long ago. Luckily I didn't suffer the same fate as the writer's wife. Also, I believe that google should have 'paid support' in place for this type of situation. No doubt it would be profitable for them, and would save many people quite a lot of pain.
- ern 15y ago
  Something i do quite regularly is google search each of my passwords, and I would advise anyone to do the same. The problem with this is that your password could end up in your web history and autocomplete. The other option would be an incognito session, but I think that could still lead to it ending up on Google Suggest if you do it often enough.
  - paulnelligan 15y ago
    I'm not worried about that, since it's basically nonsensensical text, and with the amount of searching I do, it's going to be buried. By regularly, I mean about once a month.
- alexdias 15y ago
  Following your tip by curiosity, I googled one my old passwords, which was leaked in the most recent Lulzsec release (in MD5 form). And there it was, in cleartext, on the second page of the search results, along with the username that I used on battlefield heroes beta. It was on a pastebin with another 60k combinations of usernames and passwords. The password was only 6 characters in size though (along with every other on that pastebin), so I guess that made it a certainty that it would get cracked.
  - paulnelligan 15y ago
    How about the other combos, were they also all 6 characters in size?
yaakov34 15y ago
I don't understand why so few comments mention that the "last chance form" is a huge security hole. It seems like most of the information for filling it can be seen by someone over my shoulder as I use Gmail. And it's apparently completely automated and can be tried multiple times. I use a strong passphrase and two-factor authentication for a reason, and this defeats it. I already disable the "secret questions", since I don't want cracking the account to be much easier than cracking the passphrase. I would like Google to give me an option to disable the "last chance form" for my account. Or, if they inisist, I'd like the "last chance" to be to fly to Mountain View and show Google my passport or a court order. EDIT: and for extra bogusness, it seems that the information needed for the "last chance form" can't be changed if it's compromised. I mean, I can change my passphrase if I suspect it leaked, but how do I change the date when I started using Gmail? Sounds like the best thing to do the moment a Google account is compromised is to close it.
- Tichy 15y ago
  Except you can't close it anymore.
  - yaakov34 15y ago
    I meant closing it after going through the "last chance" form. Although it wouldn't surprise me if someone could go through it again and reopen it. Also, if you left a computer with a Google login where someone could access it (not smart, but people can slip up), then I guess the paranoid/high security thing to do would be to close the account, since there is no way to know when the gathered information would be used to access it. Changing the password would be worthless.
madewulf 15y ago
For the record, I don't think that Gmail security is bad, or worse than something else. I just wanted to report my story, as I thought it would be interesting. I am a bit overwhelmed by the reaction to this post, honestly.
jeggers5 15y ago
I'd say this is happening a lot more than we actually hear about. He also raises a good point about how if you gained access to a lot of people's gmail a/c, you'd also get access to a lot of other services they use via the password reset form.
eneveu 15y ago
I've also activated two-factor authentication, and I don't think the drawback he mentions are that problematic: This indeed increases security, but tends to be a bit cumbersome (I often have a depleted battery, for example, which could prevent access to my emails from a computer) and does not solve other case (like somebody stealing my laptop and using an already opened session). 1) You can print a list of one-time passwords and store it inside your wallet. If your phone's battery is depleted, you can use them to log in. You should store another copy of this list in a safe place, just in case. 2) If somebody steals his laptop, he could always log from another computer and disable his session and/or change his password. He should use a password-protected login on his laptop anyway, with an encrypted drive.
16s 15y ago
For those of us who never travel outside the continental U.S. (or wherever), it would be nice if Gmail had an option we could check that read, "Disallow international (non U.S.) access to my account." This would add a small measure of protection, though is not ideal as compromised machines (or proxies) in the U.S. could still access the account.
someone13 15y ago
A friend of mine had a similar problem with her Hotmail account. It had been hacked, but the recovery questions hadn't been changed (mainly, I think, because Hotmail makes it incredibly difficult to even find the option to do this). We reset her password, changed everything, and the account got re-hacked within 30 minutes. This happened three more times until, eventually, the recovery questions were changed and we couldn't get access. I posted on the support forums, regained access, changed EVERYTHING (this included checking for email forwarding rules, and so on). Now, through all this, I told my friend to not sign in to the account (or use MSN) from any computer except mine, to ensure that it wasn't a keylogger or Trojan that was causing this. My machine was running an up-to-date version of Ubuntu, on my home network, using HTTPS. So I'm pretty sure it wasn't a trojan. Unlike Google, Hotmail requires a human to look over your problem, so after the third time we had to wait for a day to get the account accessed, we just gave up. I signed in, copied down as many contacts as I could, then deleted all the incoming emails. We ended up having to abandon her Facebook account too, as the hacker accessed that and was spamming her friends. Her Tumblr, and a couple of other accounts were toast also. We almost her Facebook back, but the hacker deactivated the account. It was very frustrating trying to solve this, because I didn't know how the account was being accessed! I opened a ticket asking the Hotmail support staff to tell me how the password was being reset - not any more information, just the method - and they came back with the standard "we won't reveal information unless you have a search warrant or court order". I love modern technology and all, but sometimes it's REALLY frustrating.
leon_ 15y ago
> I was very glad that the "last chance form" did work twice > That's when I lost the connection again... hmmm ...
jarin 15y ago
My Gmail account recently was compromised due to the MtGox intrusion, as I had completely gotten lax with my password security practices (I noticed because I was no longer able to log in to my Google account). The worst thing about it is I knew better. I had 4 different passwords that I would use for different types of sites, and it just so happened that my MtGox and Gmail passwords were the same. Thanks to my backup email account and 1password's ability to search accounts by password, I was able to restore access and change every account password I had gotten lazy about, before any damage was done. Turn on 2-factor authentication for my Gmail and Google Apps accounts, and now I can finally feel secure with only 2 passwords I have to memorize (Gmail and 1Password).
bwooceli 15y ago
There is another layer of protection you can put in place - Google Apps. For many people, spending the $10/year on a private domain with the 10 account limit would be more than sufficient. Allocate one of those accounts to a strictly administrative role with 2 factor authentication. That way, you can self-serve on things like emergency password resets etc.
magamiako 15y ago
I think quite a few people are missing the point of this feature. This feature is not to 100% fully secure "OMFG" protect your account. This isn't like some super secret government code sort of deal. The idea is that your e-mail account does not get compromised when a company's database gets hacked. The point of the unique, application-specific passwords isn't to "lower the security of your account", but it's to prevent someone from using a database leak to logging into your g-mail because YOU SHOULD NOT USE THESE CODES FOR ANYTHING OTHER THAN THE SPECIFIC APP. Yes, someone can get that password and enter your g-mail account. But the point is that you're not using this to log in to your Paypal, your Xbox Live, your PSN, or your Hacker News account.
S_A_P 15y ago
So Im perplexed about how the gaming XP machine fits in here. I can understand that maybe that machine was used to log into the gmail account once and the auto login would have let the "hacker" in once. How then, if the user changed the password and security questions, etc did this person access the account 2 more times???

389 points by madewulf 15y ago

I bet signups for Gmail's 2-factor auth spikes when stories like this start circulating. It's awesome that they provide it. I fear it might be too much to ask for my mom, grandmother, etc, who are probably more vulnerable to being attacked in the first place (weaker, duplicated passwords for sure).

unshift 15y ago

tl;dr: don't give your password to anybody. we've been saying this since the mid-90s but people still seem to slip up. gmail's two-factor auth is nice and easy with the handy iPhone app. of course nobody wants to complicate something like sign-in, but email integrity is very important. facebook also has a similar two-factor auth process (though not as nice; they text you, vs a nice app). two-factor is a no-brainer at this point for managing your identity, especially given the huge volume of leaked passwords we've seen in the past month. it only takes a few minutes to set up and almost completely eliminates problems like the one in this article. if you haven't set it up yet, do it now! much easier than learning the hard way.

kingkawn 15y ago
FB has been requesting my phone number to complete the authentication backups for a few weeks now, and the ability to opt out is not clearly marked. I have the nagging feeling that this is much more about getting my cellphone into their system.
- vegardx 15y ago
  Or just the fact that they are overwhelmed by users requesting to get their accounts back. A two-factor solution is the only solution to the problem with password reusing that we've been fighting since passwords were first thought of. People are dumb, you can tell them a gazillion time to never use the same password on different sites/programs/whatever, they still do it. Also, by providing it via text messages compared to an application they reach out to a much broader audience. Not just tech-savvy people like you and me, who probably already had a proper password policy.
abraham 15y ago
Which is a bit silly since Facebook already has one of the most popular mobile apps installed on millions of devices.
- riffraff 15y ago
  but facebook also has many million users who don't have an iPhone nor android phone yet, who can still use two factor auth (i.e. my girlfriend)
mattmanser 15y ago
Given that he was sorting out his gf's account because he knew her password, that's not at all an accurate tl;dr.

muppetman 15y ago

I read a story similar to this a few weeks ago. The guy recovered his account, changed all passwords, but then it was snatched again. Rinse and repeat, I think he got it back in the end though. Very strange - he thought he'd been targetted specifically.

sorbus 15y ago

> most distressing to me is that I am still unable to explain how those guys were able to get access to the account twice after I changed the password, security questions and backup email address from my Mac that does not seem to be compromised. It sounds very much like the hackers were also using the "last chance form." Consider that all of the information it requests is available through Gmail - account registration data, names of tags, most emailed people, and verification code (which was apparently emailed to him, and therefor present in the compromised email account) (Note: I haven't used the form myself, I'm going on the information in the article). Also, the title is a bit link-baitish.

saool 15y ago
I think the windows xp box he says he had his wife turn off had a trojan in it.
- sorbus 15y ago
  That doesn't make sense. He changed the passwords, as well as using Gmail's ability to end all other sessions. Unless he was giving his SO (he never calls her his wife) the password and she was logging in on that computer, there should have been no way for a trojan on it to access the account.
  - yaakov34 15y ago
    They were probably using the "last chance" form to reset the password. That form checks the IP address; if they had control of the XP machine, they could have been using it to submit the form with a reasonable IP address and get the account again. Once they lost that, no go. At least that's the only thing that I can think of.
    - sorbus 15y ago
      Ah, that makes sense. I didn't realize that the form checks IP addresses, though, in retrospect, that's an extremely obvious security feature to have.

drivebyacct2 15y ago

Not sure why any of these steps should lead you to fear about using Gmail. Hosting your email yourself is almost surely more risky. Those hosting their own email aren't going to have complex password recovery system with the abuse protection that Google's has. There isn't going to be a warning system to alert you that there have been sign-ons from foreign states/countries. There isn't going to be two-auth out of the box unless you install the PAM module. If your weak link, was, as usual, the human link... I would be inclined to trust a system more catering to (forgive me) ignorant users. I just worry that the mindset is, "I got hacked because I use Gmail, if I used something else I'd be safer." and I find that logical to be pretty flawed.

ams6110 15y ago
In the sense that Gmail is a big target, and a self-hosted account is a tiny one, I do understand the feeling that if for no other reason than obscurity, you are safer avoiding the "big names" in any online service.
pavel_lishin 15y ago
> There isn't going to be a warning system to alert you that there have been sign-ons from foreign states/countries. There isn't going to be two-auth out of the box unless you install the PAM module. Your points are valid, but why wouldn't these things exist? Doesn't code exist to do this? And if not, is it truly difficult to write? I'm not saying it's a trivial task, but someone who decides to host their own e-mail would probably be willing to work at it.
- drivebyacct2 15y ago
  Well, they probably do exist, but not as a default install of any webmail client that I've used in the last few years.
  - deleted 15y ago
    [deleted]
- there 15y ago

llgrrl_ 15y ago

This is exactly why I'm using two-factor authentication for gmail (heck, I even ported the two factor auth code generator to my watch so I don't have to panic when my android phone runs out of battery - http://tnhh.net/pancake/chronos-otp.xml http://tnhh.net/pancake/chronos-otp.xml :-) However, I don't use Gmail for 'everything,' it's just too dangerous and I feel doing that way Google knows more about me than they should. I think everyone should be hosting the main email address under something that they can sure control (your work/edu account, or a paid email service). My main account is hosted on fastmail (I paid something like 12 bucks for three years) and is cloaked under a dozen of other email addresses. Plus, for fastmail you get a free smtp account, and a standard IMAP account (gmail's IMAP is weird). And they will respond if you're in troubles.

ianterrell 15y ago
Gmail's IMAP is awesome. I remember the first time I connected my iPhone to it and wondering how to archive a message. "Well, it stays in 'All Mail,' so I'll just move it there." Presto! It worked. Naturally, you have to like the Gmail conventions to like the Gmail implementations.
- rgrove 15y ago
  From the point of view of someone writing an IMAP client, Gmail's IMAP implementation is not awesome. It's not horrible either, but it does have quite a few quirks, some of which can be a real pain to deal with.
ams6110 15y ago
I also use Fastmail. I'm grandfathered into a plan they no longer offer: a one-time payment which got me a modest (16M) quota (I download and purge my email from their service so that's not an issue for me) and access to their SMTP service.
pavel_lishin 15y ago
So, at this point, doesn't Fastmail know more about you than they should?

chapel 15y ago

One thing you should check for if your email was compromised is the pop3 forwarding and imap. Attackers will forward your emails to their own accounts using either or both. This makes it very easy for them to retake your account.

ianterrell 15y ago
Another note is to check your "Reply-to" email. A friend of mine's Gmail account was compromised (say her email was iluvkittens@gmail.com) and they had subtly changed it (perhaps to iluvkitttens@gmail.com). Her oblivious contacts (including me) replied to her "cry for help," but the messages went straight to the hacker's address. This kept her contacts in conversation with the hacker even after she regained control of her account.

hzay 15y ago

I went through this two years ago. My ex was hacking into my accounts. - He used the 'last chance form' to get into my gmail by entering the password I'd given him a year before this (I'd changed the password twice after giving him that password) - He ran a dictionary attack on my college email which didn't have captcha's, then hacked gmail using the password that worked for my college email - We were using shared vnc in college, he found his way to my firefox through a mutual friend, installed a plugin that sent him all POST data and got into my gmail again I created a new gmail account after each incident. I had to abandon each gmail account once it was cracked because of the 'last chance form'. Back then, you only had to give it one or two correct past passwords, and it gave you access. On hindsight, I've been remarkably dense, but it was a good, early lesson.

pavel_lishin 15y ago
Sorry to focus on this (this is Hacker News after all), but did he write his own Firefox extension for this? Or is there one available?
- hzay 15y ago
  He told me he wrote his own.
  - pavel_lishin 15y ago
    To return from nerd mode, did you consider at some point relating your story to an uncle, and then explaining the concept of "rubber hose cryptanalysis, and letting him connect a few dots?
    - hzay 15y ago
      :) No. I was playing a kind of zero-acknowledgement game, as a friend called it.
DannoHung 15y ago
And now we know why he's your ex.

51Cards 15y ago

I haven't set up two-factor auth yet because I don't always have my phone handy and my understanding of it is that on each log-in you need to use both factors. My comments below are based on this understanding so forgive me if I'm wrong. What I would love is if instead it asked for both factors under these circumstances: - option A - on every login like it is now. - option B - at least once every X days, with a warning that "within the next three logins you'll need to use your second auth" so I will know when it's coming without being locked out because my phone is dead. - in both of the above cases ALWAYS require two factor auth every time I change the account settings (like password, recovery addresses, etc.) Possibly even require it when I try to do things like purge a mailbox entirely or bulk email all my contacts. Having this blended option would make it a no brainer for me Edit: Thanks all for the clarifications below. I am going to give it a try.

mathrawka 15y ago
It has the option (on by default actually) to remember that session for the next 30-days. I turn it off everytime, because I want to be asked for my second factor regardless of the situation. In the event I don't have my phone with me, I carry the printout of backup codes in my wallet.
RyanKearney 15y ago
It asks on every login or you can opt to not require the second factor for 30 days on that machine via a checkbox when entering the other factor. You can also print out a list of 10 one-time use codes to log into your account if you don't have your phone handy.
jackowayed 15y ago
As for not always having your phone with you, you can print out one-time passwords. So you print some out, put them in your wallet (and maybe more in your home), and then if you don't have your phone/your phone breaks/whatever, you can use one from that list. But then that one off of that list is dead. Also, I'm pretty sure there's some option where it only does the 2nd factor once a month if it's on a computer it recognizes.

pavel_lishin 15y ago

So, it seems that the XP machine was the source of intrusions - I'd like to see a follow-up.

iwwr 15y ago
What role did the separate XP machine play? After changing the password and dropping all active sessions, what else is there to allow someone in?
- pavel_lishin 15y ago
  I have no idea, but he mentioned that the e-mail account was accessed from it, and once it was shut down, the intrusions stopped.

RyanKearney 15y ago

> Time now for some damage evaluation. I immediately saw that all contacts had been deleted (annoying but not too bad) There's pretty much a one-click restore process now: http://i.imgur.com/1EYZ5.png http://i.imgur.com/1EYZ5.png

Matt_Cutts 15y ago
Please upvote Ryan's advice. Click on Contacts, then look for "More actions," then click "Restore contacts..." You can find more info about restoring contacts at https://mail.google.com/support/bin/answer.py?answer=1069522&hl=en https://mail.google.com/support/bin/answer.py?answer=1069522... or read the blog post from a few months ago at http://gmailblog.blogspot.com/2010/12/restore-your-contacts.html http://gmailblog.blogspot.com/2010/12/restore-your-contacts....

raldi 15y ago

What I'd like is one-factor for my typical "log in and check mail, write back to a few people" use case, and two-factor or a second password that kicks in when I (or a bad guy) tries to: * Log in from a computer that's never used this account before * Set up a forward * Make a mass mailing * Change the password * Do extensive searching or searching for suspicious terms ("password", "credit card", etc) * Export a large amount of mail ...and other such things. That way, I don't have to be inconvenienced by constantly having to use the second factor, but would still survive a stolen laptop, keylogged passord, or sniffed cookie with a contained amount of damage.

plasma 15y ago
Agreed; I got half way through setting up Google's 2 factor but then was told I had to use it for every login, instead of say when I was logging in from a different IP or doing some big change.
- scottbessler 15y ago
  When you log in with 2 factor you have the option to validate the current machine for 30 days.
- dlokshin 15y ago
  You don't actually have to use it on every login. There's an option to remember a computer for 30 days. I have this option ticked in a single browser on my main laptop, and I input the verification key for everything else. Not a pain at all and definitely worth the added security.
  - barrkel 15y ago
    30 days, divided by the number of computers you log in on. In my case that could be as much as 7 machines, so I'd expect to need to log in every 4 days or so. Definitely more hassle than desired.
  - ern 15y ago
    If you use more than one browser per machine, you need to reauthenticate for each one, which multiplies the inconvenience. Also the need to generate passwords for apps that don't use 2 factor authentication (IMAP, IM clients). Although, I still think it's worth the added effort.

josephcooney 15y ago

A friend of mine got his domain stolen recently. He believes his gmail was brute-forced through a known vulnerability/feature when POP is enabled http://seclists.org/fulldisclosure/2009/Jul/254 http://seclists.org/fulldisclosure/2009/Jul/254 . He did a write up http://secretgeek.net/sg_hijack_1.asp http://secretgeek.net/sg_hijack_1.asp and here http://secretgeek.net/sg_hijack_2.asp http://secretgeek.net/sg_hijack_2.asp . As soon as this happened to him I turned on 2-factor auth and it works very well.

aj700 15y ago

They should be asking for certain characters of your password now, to defeat keyloggers. If you've got tons in the cloud, you need bank-level security. If people can cope with it for banking, they can cope with it for gmail.

r00fus 15y ago
I sure as hell hope they can't ask for certain positions/characters of my password, as that would imply a non one-way function (ie, hash) applied to the password stored on their servers. LulzSec has proven why this might be very bad.

Matt_Cutts 15y ago

The key part of the blog post for me is this: "To mitigate the risk, Google recently launched two-factor authentication, a mechanism that requires you to input, on top of your password, a code generated by an application installed on your phone (iPhone, Android and maybe some others). I have activated this today." Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account (domain registration info, passwords/access to shopping sites, etc.) and should activate two-factor authentication: http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... Is it a little more hassle? A bit. But when someone else tries to log in from a new IP address in the Ivory Coast, or China, or wherever--they'll be prompted for a PIN and won't be able to log in. I activated two-factor authentication as soon as I could on my Gmail. I think everyone reading this comment should too.

briguy 15y ago
Perhaps a happy medium (between security and practicality) would be to have the option to only apply two-factor lock-down to "admin" type functions(i.e. to change cell phone, change secondary email, etc). This would allow a hacker to perhaps gain access to your email, however would not be able to completely hi-jack your account.
kelnos 15y ago
I would really like to activate two-factor auth for my GMail account, but I just don't trust my phone that much. The battery life is terrible, and I'd be afraid of losing access to my account if the phone breaks. Or what happens if I lose my phone? Or if someone steals it? Presumably there's a way to handle that case, but it still bothers me. On the plus side, I'm using a Google Apps account with a domain I control, so I could quickly switch to a backup mail provider, but it's of course a huge hassle, and I keep a lot of email in my GMail account. How do you deal with these kinds of issues? I really do want to use two-factor auth, but this stuff scares me about as much as the possibility of getting hacked.
- pipeline_tux 15y ago
  They provide a list of backup codes which you're meant to print and put in your wallet.

paraschopra 15y ago

Just enabled 'Two factor authentication'. Thanks for writing this. Made me realize the loss I would incur if my account gets hacked.

namank 15y ago

I worry about this a fair bit. This is why I am in the process of cloaking my gmail with a throwaway address (ping@namank.com) And I just suggested gmail this: ----- Gmail runs my life, as it does yours! Yes, I have an alternate email but whoever has my password can change it and then I'm LOST! You need to make this hackproof (yes yes, i know. but please, atleast TRY) I suggest: -Have a backdoor password. There MUST be a 24-48 hour window between changing the backdoor password and the main password. -Must be a 24 to 48 hour window between a password change and alternate email change. -----

jdhopeunique 15y ago

It would be nice if Gmail and Facebook had two separate passwords: one for everyday login and another for administrative functions such as changing passwords, forwarding options, etc.

KingOfB 15y ago

This happened to my girlfriend and I had a similar freak out. After asking a few more questions she remembered getting an email to enter her gmail password to get more storage space.... She knows better, but just didn't think about it - it seemed legitimate. Ask your friend more questions, I bet she fell for the same scam. I've met 4 people now that fell for the same one. I'm also very concerned about the no 'restore' option from gmail. What good are google backups if you can't initiate them?

swaits 15y ago

You get what you pay for.

riffraff 15y ago

the "last chance form" (or "account recovery exam") really is a hard and impossible to find thingy. Also, I frankly have no idea about when I started using some services, and worst, no clue on how to find out.

paulnelligan 15y ago

Something i do quite regularly is google search each of my passwords, and I would advise anyone to do the same. I found several older passwords with my login up on a file-sharing website not so long ago. Luckily I didn't suffer the same fate as the writer's wife. Also, I believe that google should have 'paid support' in place for this type of situation. No doubt it would be profitable for them, and would save many people quite a lot of pain.

ern 15y ago
Something i do quite regularly is google search each of my passwords, and I would advise anyone to do the same. The problem with this is that your password could end up in your web history and autocomplete. The other option would be an incognito session, but I think that could still lead to it ending up on Google Suggest if you do it often enough.
- paulnelligan 15y ago
  I'm not worried about that, since it's basically nonsensensical text, and with the amount of searching I do, it's going to be buried. By regularly, I mean about once a month.
alexdias 15y ago
Following your tip by curiosity, I googled one my old passwords, which was leaked in the most recent Lulzsec release (in MD5 form). And there it was, in cleartext, on the second page of the search results, along with the username that I used on battlefield heroes beta. It was on a pastebin with another 60k combinations of usernames and passwords. The password was only 6 characters in size though (along with every other on that pastebin), so I guess that made it a certainty that it would get cracked.
- paulnelligan 15y ago
  How about the other combos, were they also all 6 characters in size?

yaakov34 15y ago

I don't understand why so few comments mention that the "last chance form" is a huge security hole. It seems like most of the information for filling it can be seen by someone over my shoulder as I use Gmail. And it's apparently completely automated and can be tried multiple times. I use a strong passphrase and two-factor authentication for a reason, and this defeats it. I already disable the "secret questions", since I don't want cracking the account to be much easier than cracking the passphrase. I would like Google to give me an option to disable the "last chance form" for my account. Or, if they inisist, I'd like the "last chance" to be to fly to Mountain View and show Google my passport or a court order. EDIT: and for extra bogusness, it seems that the information needed for the "last chance form" can't be changed if it's compromised. I mean, I can change my passphrase if I suspect it leaked, but how do I change the date when I started using Gmail? Sounds like the best thing to do the moment a Google account is compromised is to close it.

Tichy 15y ago
Except you can't close it anymore.
- yaakov34 15y ago
  I meant closing it after going through the "last chance" form. Although it wouldn't surprise me if someone could go through it again and reopen it. Also, if you left a computer with a Google login where someone could access it (not smart, but people can slip up), then I guess the paranoid/high security thing to do would be to close the account, since there is no way to know when the gathered information would be used to access it. Changing the password would be worthless.

madewulf 15y ago

For the record, I don't think that Gmail security is bad, or worse than something else. I just wanted to report my story, as I thought it would be interesting. I am a bit overwhelmed by the reaction to this post, honestly.

jeggers5 15y ago

I'd say this is happening a lot more than we actually hear about. He also raises a good point about how if you gained access to a lot of people's gmail a/c, you'd also get access to a lot of other services they use via the password reset form.

eneveu 15y ago

I've also activated two-factor authentication, and I don't think the drawback he mentions are that problematic: This indeed increases security, but tends to be a bit cumbersome (I often have a depleted battery, for example, which could prevent access to my emails from a computer) and does not solve other case (like somebody stealing my laptop and using an already opened session). 1) You can print a list of one-time passwords and store it inside your wallet. If your phone's battery is depleted, you can use them to log in. You should store another copy of this list in a safe place, just in case. 2) If somebody steals his laptop, he could always log from another computer and disable his session and/or change his password. He should use a password-protected login on his laptop anyway, with an encrypted drive.

16s 15y ago

For those of us who never travel outside the continental U.S. (or wherever), it would be nice if Gmail had an option we could check that read, "Disallow international (non U.S.) access to my account." This would add a small measure of protection, though is not ideal as compromised machines (or proxies) in the U.S. could still access the account.

someone13 15y ago

A friend of mine had a similar problem with her Hotmail account. It had been hacked, but the recovery questions hadn't been changed (mainly, I think, because Hotmail makes it incredibly difficult to even find the option to do this). We reset her password, changed everything, and the account got re-hacked within 30 minutes. This happened three more times until, eventually, the recovery questions were changed and we couldn't get access. I posted on the support forums, regained access, changed EVERYTHING (this included checking for email forwarding rules, and so on). Now, through all this, I told my friend to not sign in to the account (or use MSN) from any computer except mine, to ensure that it wasn't a keylogger or Trojan that was causing this. My machine was running an up-to-date version of Ubuntu, on my home network, using HTTPS. So I'm pretty sure it wasn't a trojan. Unlike Google, Hotmail requires a human to look over your problem, so after the third time we had to wait for a day to get the account accessed, we just gave up. I signed in, copied down as many contacts as I could, then deleted all the incoming emails. We ended up having to abandon her Facebook account too, as the hacker accessed that and was spamming her friends. Her Tumblr, and a couple of other accounts were toast also. We almost her Facebook back, but the hacker deactivated the account. It was very frustrating trying to solve this, because I didn't know how the account was being accessed! I opened a ticket asking the Hotmail support staff to tell me how the password was being reset - not any more information, just the method - and they came back with the standard "we won't reveal information unless you have a search warrant or court order". I love modern technology and all, but sometimes it's REALLY frustrating.

leon_ 15y ago

> I was very glad that the "last chance form" did work twice > That's when I lost the connection again... hmmm ...

jarin 15y ago

My Gmail account recently was compromised due to the MtGox intrusion, as I had completely gotten lax with my password security practices (I noticed because I was no longer able to log in to my Google account). The worst thing about it is I knew better. I had 4 different passwords that I would use for different types of sites, and it just so happened that my MtGox and Gmail passwords were the same. Thanks to my backup email account and 1password's ability to search accounts by password, I was able to restore access and change every account password I had gotten lazy about, before any damage was done. Turn on 2-factor authentication for my Gmail and Google Apps accounts, and now I can finally feel secure with only 2 passwords I have to memorize (Gmail and 1Password).

bwooceli 15y ago

There is another layer of protection you can put in place - Google Apps. For many people, spending the $10/year on a private domain with the 10 account limit would be more than sufficient. Allocate one of those accounts to a strictly administrative role with 2 factor authentication. That way, you can self-serve on things like emergency password resets etc.

magamiako 15y ago

I think quite a few people are missing the point of this feature. This feature is not to 100% fully secure "OMFG" protect your account. This isn't like some super secret government code sort of deal. The idea is that your e-mail account does not get compromised when a company's database gets hacked. The point of the unique, application-specific passwords isn't to "lower the security of your account", but it's to prevent someone from using a database leak to logging into your g-mail because YOU SHOULD NOT USE THESE CODES FOR ANYTHING OTHER THAN THE SPECIFIC APP. Yes, someone can get that password and enter your g-mail account. But the point is that you're not using this to log in to your Paypal, your Xbox Live, your PSN, or your Hacker News account.

S_A_P 15y ago

So Im perplexed about how the gaming XP machine fits in here. I can understand that maybe that machine was used to log into the gmail account once and the auto login would have let the "hacker" in once. How then, if the user changed the password and security questions, etc did this person access the account 2 more times???