11 ms·

Urgent security warning that may affect all internet users

207 points by mazsa 12y ago

diafygi 12y ago
> The group behind this is using the stored usernames and passwords to simulate a web browser login through fake browser software. This software simulates the actual login process a user would use if they are using Firefox/Safari/Chrome to access their Namecheap account. So basically PhantomJS? Or is it more sophisticated than that? Also, this might actually let me see if I'm in the list, since I will get an unsolicited 2FA text if they try my account.
- cbhl 12y ago
  My guess would be Selenium.
  - jtheory 12y ago
    Doubt it -- that's using real browser software, and I imagine it would also be way too slow for effective large-scale brute force attempts.
- Mandatum 12y ago
  It's likely just a multi-instance setup of Hydra or wfuzz, PhantomJS would have too much overhead.
AdamGibbins 12y ago
I get a 404?
- sandis 12y ago
  Permalink results in 404, but the post is still viewable on the blog homepage: http://community.namecheap.com/blog/ http://community.namecheap.com/blog/
  - matthewdrussell 12y ago
    Direct link http://community.namecheap.com/blog/2014/09/01/urgent-security-warning-may-affect-internet-users/ http://community.namecheap.com/blog/2014/09/01/urgent-securi...
randunel 12y ago
google cache: http://webcache.googleusercontent.com/search?output=search&sclient=psy-ab&q=cache%3Ahttp%3A%2F%2Fcommunity.namecheap.com%2Fblog%2F2014%2F09%2F01%2Furgent-security-warning-may-affect-internet-users%2F&oq=cache%3Ahttp%3A%2F%2Fcommunity.namecheap.com%2Fblog%2F2014%2F09%2F01%2Furgent-security-warning-may-affect-internet-users%2F&gs_l=hp.3..0l4.1863.2917.0.3062.8.8.0.0.0.0.327.1155.0j3j2j1.6.0....2...1c.1.52.psy-ab..3.5.985.0.4xL6TNZG-bs&pbx=1 http://webcache.googleusercontent.com/search?output=search&s...
- terravion 12y ago
  Thanks for pointing to a cached version. ...strange that the original is unavailable.
  - tamar 12y ago
    The original should be available without issue. Can you please let me know what happens when you try to access it? What ISP are you using? Thanks, Tamar from Namecheap
    - snorrah 12y ago
      Fwiw I had no problems loading the original article URL just now
    - pyre 12y ago
      I just got a: 504 Gateway Time-out (nginx)
    - davidu 12y ago
      Your server is not handling the load.
      - tamar 12y ago
        Thanks. Getting a mix of results here - server issues (should be fine), and 404s - but the page wasn't deleted. Not sure what it is but we'll keep an eye on it. Thanks!
ted0 12y ago
Hey all, Teddy from Namecheap here. Happy to answer any questions here or at ted@namecheap.com. As always, we advise turning on 2-factor authentication on your account.
- stevenh 12y ago
  To save time for those hunting for this on Namecheap: 1. Log in 2. Click "Menu" (in the top right portion of the page) 3. Expand the "My Account" submenu (if it didn't already automatically expand when the menu appeared) 4. Click "Manage Profile" (5th from the bottom of the "My Account" submenu) 5. On the next page that appears, look for "Two Factor Authentication" on the left side under "Personal Settings"
  - ted0 12y ago
    Thanks! Also, a direct link if you're already logged in: https://www.namecheap.com/myaccount/TwoFA/TwoFAProfileManagement.aspx https://www.namecheap.com/myaccount/TwoFA/TwoFAProfileManage...
    - reledi 12y ago
      My phone often has no service, which would make 2FA with you a roadblock. Please consider using Google Authenticator for generating the code, instead of sending a text or voice call.
- antr 12y ago
  Teddy, I'm a Namecheap user (over 30 domains and a bunch of SSLs) and what really concerns me is that I find out about this security issue via hacker news, instead of being sent an email. This is not how you communicate with customers when these types of security issues arise.
  - ted0 12y ago
    We take these issues very seriously and always try to get the word out about as quickly as possible. We emailed everyone that was affected this morning and continue to update our customers through our blog and social media.
Negitivefrags 12y ago
As someone who runs an online game we find that a huge percentage of our users arrive pre-compromised. Vast quantities of people wander around from site to site using the same email/password combo that has been compromised a long time ago. We do a GeoIP check now and send an email with an unlock code any time someone logs in from a different city than last time. This reduced the account compromise problem significantly. Most of these pre-compromised people have a different password on their email at least.
- SomeCallMeTim 12y ago
  As someone who plays online games, I get really, really annoyed when I'm forced to create a password to log in. ALL non-secure online sites that need to identify users should allow for Google or Facebook authentication, or I will never try to access the game from my phone or tablet. I refuse to use the same password everywhere, but that means I have a password vault on my computer. If I need to create a password and I'm on my phone, I simply click "close" (and uninstall if necessary). I sympathize with those "precompromised accounts," given that it's such a user interface failure (not to mention arrogant) to require a new password for every single little service/game/whatever. OTOH, if I can "login with Google" and/or Facebook, both of those are already authenticated on my phone, and through the magic of OAUTH I can securely connect to your game without needing to generate a password. Certainly having the OPTION to create a password is fine; there will be people who hate Google/Facebook/whatever and who won't use them. But not having the option is an instant fail for me. Not saying you're doing it wrong, since I don't know what game you're talking about, but I've certainly encountered many games that have no OAUTH options.
  - blazespin 12y ago
    I (and probably the vast majority of the world) have a single separate password for sites I couldn't care less about being compromised or really serve no purpose for anyone to compromise.
  - jwr 12y ago
    Some of us use password managers like 1Password and get really, really annoyed when we're forced to use Google or Facebook to log in. There are two sides to this - some prefer convenience and are happy to give up some control. Others do not want to depend on a third party and want to have control themselves.
yuvadam 12y ago
Hyperbole much? WTF is this "urgent"? How might this affect "all internet users"? A hacker group is trying dictionary attacks. Wow. Flagged.
- SomeCallMeTim 12y ago
  What you're saying is factually incorrect. A hacker group has accumulated thousands (millions?) of email+password pairs. Anyone who uses the same password on all sites could be compromised, even if their password is 16 characters and random (i.e., immune to dictionary attacks).
  - ted0 12y ago
    Tim is right. The group has actually acquired ~1.2 billion passwords, which is a obviously a widespread beach.
    - 97s 12y ago
      Does anyone know a list of the sites they got this data from?
      - nwh 12y ago
        There's been stories for a while of massive malware infections sniffing usernames and passwords of infected users. Simply because there's little to give away that such an activity is going on (ie, if you were spamming or mining bitcoin there would be a real-world impact shown immediately) it's extremely hard to confirm or deny if this is happening and at what scale. In my mind it doesn't seem unlikely that would be happening though. Combined with large websites like LinkedIn being compromised, you're looking at a very, very big problem.
- zrm 12y ago
  > WTF is this "urgent"? How might this affect "all internet users"? Suppose you have a domain registered with Namecheap (or really anyone). You've reused your password and the attackers get into your account at the registrar. What does that get them? First they change the MX record for your domain. Immediately they're receiving all your email. Now that they control your email they can get a domain-validated certificate for your domain. Then they can change all your other DNS records to point at their servers and operate them with valid TLS certificates and MITM all the connections to your real servers. Then they can collect all the credentials of users using your website including the administrative credentials that allow them to compromise your real servers. Now they have all your data and your users' data and your password database and your website is hosting malware. There are very few things more compromising to large numbers of people than attackers quietly getting control of multiple legitimate active domains.
supercoder 12y ago
"504 Gateway Time-out" Seems we were all too late....
- oliverdavenport 12y ago
  Google's cache: http://webcache.googleusercontent.com/search?q=cache:http://community.namecheap.com/blog/2014/09/01/urgent-security-warning-may-affect-internet-users/&ion=1&espv=2 http://webcache.googleusercontent.com/search?q=cache:http://...
le_meta 12y ago
Wow, what a completely vague and useless warning. It should just say "be secure, but not too secure, you know just don't buy Russian stuff, would probably be a good start. Change your password, but make sure you use no special characters and keep it under 16 symbols in length, use only approved SSL cert authorities and don't look behind that curtain!!!" "We'd love to tell you more, but that would compromise our position of compromising positions, so stay compromised but if ur compromised don't do anything important unless you know, you have to or be safe while you do it by not being too secure but being unsecure enough, you know?"
MarkMc 12y ago
For sensitive sites like this, users should not be given the option to use the same username/password as other websites: The username should be issued by the site in the form Sally379687 or Fred965912
- foxylad 12y ago
  What Namecheap do is better - two-factor authentication. usernames are not meant to be secret, and forcing users to look up a username as well as a password is going to be annoying. Off-topic, I switched to Namecheap (from GoDaddy) a couple of years ago, and have been impressed. Things like two-factor auth and being aware of and publicising this attack are all signs of a good corporate citizen doing things right.
  - MarkMc 12y ago
    It would only be better if namecheap mandated two factor authentication. Giving the user the option to use poor security is like a bank that lets its customers decide what bank vault to install, then blames its customers when they are robbed.
- elithrar 12y ago
  Then people are just likely to write it down, or forget it, etc. Need to provide for humans too :)
  - MarkMc 12y ago
    But that's fine: having users write it down and/or forgetting it is better than having them compromise their security.
- lotsofcows 12y ago
  Define "sensitive site". Any email provider, if it's your main email account would qualify as very sensitive. However, people also have myriad junk accounts. As soon as you start to enforce this sort of thing you limit who's going to sign up. I've got accounts with two brokers. One has good tools which I can use with simulated ledgers but won't manage SIPPs. It has a crap password which I can remember and bang in whenever I want to check performance. The other's password is in KeePass and requires a small but significant effort to access. You could argue that the former doesn't want my "business" but if they started handling SIPPs or if I start doing some speculation I'd convert instantly. Is my low level leeching worth an instant convert?
orofino 12y ago
The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use password managers (they're complicated and then centralize everything into a single point of failure). Forcing people to use crazy passwords just results in weaker passwords. I was hopeful that something like persona from Mozilla would catch on, but that has failed. Where are we with replacing the password? It is flawed technology. On top of this we have the compounding factor that our systems are more complicated than ever and it appears that they're simply impossible to secure. Too many layers exist with too much code. Many sites just don't both with even hashing password, meaning those of us that care, are just kind of throwing our hands up and saying "well it wasn't my site that was compromised, so it isn't my fault". All the while, bad guys walk in the front door because we've decided to ignore the reality of the situation. I know I'm not providing a constructive alternative here, but I'm a bit ashamed that we've even let it get this far. We're failing those that rely on our systems. I don't have the answer, but would love to hear some ideas about what can be done.
- nevir 12y ago
  We need to move past passwords.
  - prawn 12y ago
    Whatever the solution is, it needs to allow remote permits. e.g., I need to be able to grant an employee access to my NameCheap account for client work purposes.
  - CamperBob2 12y ago
    True, and whoever pulls it off is the next Mark Shuttleworth, if not the next Bill Gates.
- droopyEyelids 12y ago
  I advocate for the use of password managers. I've bought 1Password for everyone in my family, and nagged them into using it. I console people online to do the same, or use keepassx, or last pass. It's not effortless security, that's for sure. In a perfect world we would have a better system than passwords. But we live in a world of compromises, and I feel it's presently the wisest course of action. https://lastpass.com https://lastpass.com https://agilebytes.com https://agilebytes.com keepass or keepassx should be googled.
scoot 12y ago
It seems like an API to check compromised account / password combinations against a database of breached accounts could be useful. Websites could check users aren't reusing a compromised password either at account creation, or as a one-time check as existing user log in.
- scoot 12y ago
  If you disagree, please reply with why. Save the downvotes for spam, trolls, jokes, memes and genuinely off-topic comments. The concept of securely checking the hash of a chosen password against a database of known compromised credentials hosted by a trusted 3rd seems like a reasonable addition layer of security to me. I'd love to hear counter-arguments.
Gustomaximus 12y ago
The way I have organised is to have 5 varying levels. This limits the volume of passwords I have to recall whilst maintaining variety. While there is still opportunity for cross-use if one is hacked it does create breakage points from areas more likely to be hacked and avoids a single point of failure. It's structured something like this; 1) Random sign-ups. 2) Slightly personal information e.g. Hackernews 3) Personal or slightly financial: e.g. mail accounts 4) Financial: e.g. Banking/Share trading 5) Work accounts I've been wondering if I should expand this to have the same as above but bring in a component of the URL into the password to create variance for all but keeping it easy to remember. Does that seem a good method or do people have better systems?
- elbenshira 12y ago
  Why not just use: https://lastpass.com/ https://lastpass.com/ https://agilebits.com/onepassword https://agilebits.com/onepassword http://keepass.info/ http://keepass.info/
  - Gustomaximus 12y ago
    Isn't there greater risk in using these than my method? My logic: If one of these solutions e.g. LastPass is compromised then I am compromised across all sites. They may even bypass 2 factor authentication that goes via my email/messaging. Whereas using my method if one website gets hacked then I only give access to a segment. If it is worst case and a financial site is compromised they still don't have the password for accounts where they could see any 2-factor authentication messages. Does that make sense or am I missing something?
    - mhaymo 12y ago
      KeePass is just an encrypted database stored on your machine. If it's compromised, your machine is compromised, so you're screwed either way. Meanwhile, if any of many online services you use are compromised (and some inevitably will be), you have minimised the cost of that.
    - voxic11 12y ago
saosebastiao 12y ago
I've seen a huge uptick in spam email the last few days, and although I have no indication that I've been hacked, I feel as though I should probably fear for the worst and aggressively change all my passwords from their current kindergarten security levels. Is there a widely accessible, secure, multi platform, free/libre password manager that is recommendable as easy to use? I reuse passwords because its easy to remember, and I'm hoping there is something out there that is light years better than those I found the last time I tried (2007).
- reitanqild 12y ago
  I've used Keepass for a few years. Takes a little setup (2 plugins I think) to get form flling on web pages. I also use lastpass.com for most of my stuff. While not libre it is free and multiplatform. (I still pay to get mobile sync.)
- coldpie 12y ago
  Keepass is what you want.
- quoiquoi 12y ago
  Why not use your browsers' password manager?
morgante 12y ago
This is a good reminder that we all need to encourage our friends, family, and colleagues to not use the same password everywhere. Almost all of them currently do. The best solution I've found thus far is getting them to use 1Password or the like. They still only have to remember 1 password, and the browser extensions make it trivial to log in different places. If necessary, buy them the software.
junto 12y ago
Funnily enough there was a HN post yesterday that looked like a phishing attempt on namecheap accounts: Gift HN: Unused domain 'appstores.io' with ~11 months registration left Post your namecheap username and I'll pick someone at random in 24 hours and push it to the winner. https://news.ycombinator.com/item?id=8250981 https://news.ycombinator.com/item?id=8250981 Maybe it was genuine, but if I had posted my name cheap account name there, I think I'd want it deleted now.
deleted 12y ago
[deleted]

207 points by mazsa 12y ago

> The group behind this is using the stored usernames and passwords to simulate a web browser login through fake browser software. This software simulates the actual login process a user would use if they are using Firefox/Safari/Chrome to access their Namecheap account. So basically PhantomJS? Or is it more sophisticated than that? Also, this might actually let me see if I'm in the list, since I will get an unsolicited 2FA text if they try my account.

cbhl 12y ago
My guess would be Selenium.
- jtheory 12y ago
  Doubt it -- that's using real browser software, and I imagine it would also be way too slow for effective large-scale brute force attempts.
Mandatum 12y ago
It's likely just a multi-instance setup of Hydra or wfuzz, PhantomJS would have too much overhead.

AdamGibbins 12y ago

I get a 404?

sandis 12y ago
Permalink results in 404, but the post is still viewable on the blog homepage: http://community.namecheap.com/blog/ http://community.namecheap.com/blog/
- matthewdrussell 12y ago
  Direct link http://community.namecheap.com/blog/2014/09/01/urgent-security-warning-may-affect-internet-users/ http://community.namecheap.com/blog/2014/09/01/urgent-securi...

randunel 12y ago

google cache: http://webcache.googleusercontent.com/search?output=search&sclient=psy-ab&q=cache%3Ahttp%3A%2F%2Fcommunity.namecheap.com%2Fblog%2F2014%2F09%2F01%2Furgent-security-warning-may-affect-internet-users%2F&oq=cache%3Ahttp%3A%2F%2Fcommunity.namecheap.com%2Fblog%2F2014%2F09%2F01%2Furgent-security-warning-may-affect-internet-users%2F&gs_l=hp.3..0l4.1863.2917.0.3062.8.8.0.0.0.0.327.1155.0j3j2j1.6.0....2...1c.1.52.psy-ab..3.5.985.0.4xL6TNZG-bs&pbx=1 http://webcache.googleusercontent.com/search?output=search&s...

terravion 12y ago
Thanks for pointing to a cached version. ...strange that the original is unavailable.
- tamar 12y ago
  The original should be available without issue. Can you please let me know what happens when you try to access it? What ISP are you using? Thanks, Tamar from Namecheap
  - snorrah 12y ago
    Fwiw I had no problems loading the original article URL just now
  - pyre 12y ago
    I just got a: 504 Gateway Time-out (nginx)
  - davidu 12y ago
    Your server is not handling the load.
    - tamar 12y ago
      Thanks. Getting a mix of results here - server issues (should be fine), and 404s - but the page wasn't deleted. Not sure what it is but we'll keep an eye on it. Thanks!

ted0 12y ago

Hey all, Teddy from Namecheap here. Happy to answer any questions here or at ted@namecheap.com. As always, we advise turning on 2-factor authentication on your account.

stevenh 12y ago
To save time for those hunting for this on Namecheap: 1. Log in 2. Click "Menu" (in the top right portion of the page) 3. Expand the "My Account" submenu (if it didn't already automatically expand when the menu appeared) 4. Click "Manage Profile" (5th from the bottom of the "My Account" submenu) 5. On the next page that appears, look for "Two Factor Authentication" on the left side under "Personal Settings"
- ted0 12y ago
  Thanks! Also, a direct link if you're already logged in: https://www.namecheap.com/myaccount/TwoFA/TwoFAProfileManagement.aspx https://www.namecheap.com/myaccount/TwoFA/TwoFAProfileManage...
  - reledi 12y ago
    My phone often has no service, which would make 2FA with you a roadblock. Please consider using Google Authenticator for generating the code, instead of sending a text or voice call.
antr 12y ago
Teddy, I'm a Namecheap user (over 30 domains and a bunch of SSLs) and what really concerns me is that I find out about this security issue via hacker news, instead of being sent an email. This is not how you communicate with customers when these types of security issues arise.
- ted0 12y ago
  We take these issues very seriously and always try to get the word out about as quickly as possible. We emailed everyone that was affected this morning and continue to update our customers through our blog and social media.

Negitivefrags 12y ago

As someone who runs an online game we find that a huge percentage of our users arrive pre-compromised. Vast quantities of people wander around from site to site using the same email/password combo that has been compromised a long time ago. We do a GeoIP check now and send an email with an unlock code any time someone logs in from a different city than last time. This reduced the account compromise problem significantly. Most of these pre-compromised people have a different password on their email at least.

SomeCallMeTim 12y ago
As someone who plays online games, I get really, really annoyed when I'm forced to create a password to log in. ALL non-secure online sites that need to identify users should allow for Google or Facebook authentication, or I will never try to access the game from my phone or tablet. I refuse to use the same password everywhere, but that means I have a password vault on my computer. If I need to create a password and I'm on my phone, I simply click "close" (and uninstall if necessary). I sympathize with those "precompromised accounts," given that it's such a user interface failure (not to mention arrogant) to require a new password for every single little service/game/whatever. OTOH, if I can "login with Google" and/or Facebook, both of those are already authenticated on my phone, and through the magic of OAUTH I can securely connect to your game without needing to generate a password. Certainly having the OPTION to create a password is fine; there will be people who hate Google/Facebook/whatever and who won't use them. But not having the option is an instant fail for me. Not saying you're doing it wrong, since I don't know what game you're talking about, but I've certainly encountered many games that have no OAUTH options.
- blazespin 12y ago
  I (and probably the vast majority of the world) have a single separate password for sites I couldn't care less about being compromised or really serve no purpose for anyone to compromise.
- jwr 12y ago
  Some of us use password managers like 1Password and get really, really annoyed when we're forced to use Google or Facebook to log in. There are two sides to this - some prefer convenience and are happy to give up some control. Others do not want to depend on a third party and want to have control themselves.

yuvadam 12y ago

Hyperbole much? WTF is this "urgent"? How might this affect "all internet users"? A hacker group is trying dictionary attacks. Wow. Flagged.

SomeCallMeTim 12y ago
What you're saying is factually incorrect. A hacker group has accumulated thousands (millions?) of email+password pairs. Anyone who uses the same password on all sites could be compromised, even if their password is 16 characters and random (i.e., immune to dictionary attacks).
- ted0 12y ago
  Tim is right. The group has actually acquired ~1.2 billion passwords, which is a obviously a widespread beach.
  - 97s 12y ago
    Does anyone know a list of the sites they got this data from?
    - nwh 12y ago
      There's been stories for a while of massive malware infections sniffing usernames and passwords of infected users. Simply because there's little to give away that such an activity is going on (ie, if you were spamming or mining bitcoin there would be a real-world impact shown immediately) it's extremely hard to confirm or deny if this is happening and at what scale. In my mind it doesn't seem unlikely that would be happening though. Combined with large websites like LinkedIn being compromised, you're looking at a very, very big problem.
zrm 12y ago
> WTF is this "urgent"? How might this affect "all internet users"? Suppose you have a domain registered with Namecheap (or really anyone). You've reused your password and the attackers get into your account at the registrar. What does that get them? First they change the MX record for your domain. Immediately they're receiving all your email. Now that they control your email they can get a domain-validated certificate for your domain. Then they can change all your other DNS records to point at their servers and operate them with valid TLS certificates and MITM all the connections to your real servers. Then they can collect all the credentials of users using your website including the administrative credentials that allow them to compromise your real servers. Now they have all your data and your users' data and your password database and your website is hosting malware. There are very few things more compromising to large numbers of people than attackers quietly getting control of multiple legitimate active domains.

supercoder 12y ago

"504 Gateway Time-out" Seems we were all too late....

oliverdavenport 12y ago
Google's cache: http://webcache.googleusercontent.com/search?q=cache:http://community.namecheap.com/blog/2014/09/01/urgent-security-warning-may-affect-internet-users/&ion=1&espv=2 http://webcache.googleusercontent.com/search?q=cache:http://...

le_meta 12y ago

Wow, what a completely vague and useless warning. It should just say "be secure, but not too secure, you know just don't buy Russian stuff, would probably be a good start. Change your password, but make sure you use no special characters and keep it under 16 symbols in length, use only approved SSL cert authorities and don't look behind that curtain!!!" "We'd love to tell you more, but that would compromise our position of compromising positions, so stay compromised but if ur compromised don't do anything important unless you know, you have to or be safe while you do it by not being too secure but being unsecure enough, you know?"

MarkMc 12y ago

For sensitive sites like this, users should not be given the option to use the same username/password as other websites: The username should be issued by the site in the form Sally379687 or Fred965912

foxylad 12y ago
What Namecheap do is better - two-factor authentication. usernames are not meant to be secret, and forcing users to look up a username as well as a password is going to be annoying. Off-topic, I switched to Namecheap (from GoDaddy) a couple of years ago, and have been impressed. Things like two-factor auth and being aware of and publicising this attack are all signs of a good corporate citizen doing things right.
- MarkMc 12y ago
  It would only be better if namecheap mandated two factor authentication. Giving the user the option to use poor security is like a bank that lets its customers decide what bank vault to install, then blames its customers when they are robbed.
elithrar 12y ago
Then people are just likely to write it down, or forget it, etc. Need to provide for humans too :)
- MarkMc 12y ago
  But that's fine: having users write it down and/or forgetting it is better than having them compromise their security.
lotsofcows 12y ago
Define "sensitive site". Any email provider, if it's your main email account would qualify as very sensitive. However, people also have myriad junk accounts. As soon as you start to enforce this sort of thing you limit who's going to sign up. I've got accounts with two brokers. One has good tools which I can use with simulated ledgers but won't manage SIPPs. It has a crap password which I can remember and bang in whenever I want to check performance. The other's password is in KeePass and requires a small but significant effort to access. You could argue that the former doesn't want my "business" but if they started handling SIPPs or if I start doing some speculation I'd convert instantly. Is my low level leeching worth an instant convert?

orofino 12y ago

The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use password managers (they're complicated and then centralize everything into a single point of failure). Forcing people to use crazy passwords just results in weaker passwords. I was hopeful that something like persona from Mozilla would catch on, but that has failed. Where are we with replacing the password? It is flawed technology. On top of this we have the compounding factor that our systems are more complicated than ever and it appears that they're simply impossible to secure. Too many layers exist with too much code. Many sites just don't both with even hashing password, meaning those of us that care, are just kind of throwing our hands up and saying "well it wasn't my site that was compromised, so it isn't my fault". All the while, bad guys walk in the front door because we've decided to ignore the reality of the situation. I know I'm not providing a constructive alternative here, but I'm a bit ashamed that we've even let it get this far. We're failing those that rely on our systems. I don't have the answer, but would love to hear some ideas about what can be done.

nevir 12y ago
We need to move past passwords.
- prawn 12y ago
  Whatever the solution is, it needs to allow remote permits. e.g., I need to be able to grant an employee access to my NameCheap account for client work purposes.
- CamperBob2 12y ago
  True, and whoever pulls it off is the next Mark Shuttleworth, if not the next Bill Gates.
droopyEyelids 12y ago
I advocate for the use of password managers. I've bought 1Password for everyone in my family, and nagged them into using it. I console people online to do the same, or use keepassx, or last pass. It's not effortless security, that's for sure. In a perfect world we would have a better system than passwords. But we live in a world of compromises, and I feel it's presently the wisest course of action. https://lastpass.com https://lastpass.com https://agilebytes.com https://agilebytes.com keepass or keepassx should be googled.

scoot 12y ago

It seems like an API to check compromised account / password combinations against a database of breached accounts could be useful. Websites could check users aren't reusing a compromised password either at account creation, or as a one-time check as existing user log in.

scoot 12y ago
If you disagree, please reply with why. Save the downvotes for spam, trolls, jokes, memes and genuinely off-topic comments. The concept of securely checking the hash of a chosen password against a database of known compromised credentials hosted by a trusted 3rd seems like a reasonable addition layer of security to me. I'd love to hear counter-arguments.

Gustomaximus 12y ago

The way I have organised is to have 5 varying levels. This limits the volume of passwords I have to recall whilst maintaining variety. While there is still opportunity for cross-use if one is hacked it does create breakage points from areas more likely to be hacked and avoids a single point of failure. It's structured something like this; 1) Random sign-ups. 2) Slightly personal information e.g. Hackernews 3) Personal or slightly financial: e.g. mail accounts 4) Financial: e.g. Banking/Share trading 5) Work accounts I've been wondering if I should expand this to have the same as above but bring in a component of the URL into the password to create variance for all but keeping it easy to remember. Does that seem a good method or do people have better systems?

elbenshira 12y ago
Why not just use: https://lastpass.com/ https://lastpass.com/ https://agilebits.com/onepassword https://agilebits.com/onepassword http://keepass.info/ http://keepass.info/
- Gustomaximus 12y ago
  Isn't there greater risk in using these than my method? My logic: If one of these solutions e.g. LastPass is compromised then I am compromised across all sites. They may even bypass 2 factor authentication that goes via my email/messaging. Whereas using my method if one website gets hacked then I only give access to a segment. If it is worst case and a financial site is compromised they still don't have the password for accounts where they could see any 2-factor authentication messages. Does that make sense or am I missing something?
  - mhaymo 12y ago
    KeePass is just an encrypted database stored on your machine. If it's compromised, your machine is compromised, so you're screwed either way. Meanwhile, if any of many online services you use are compromised (and some inevitably will be), you have minimised the cost of that.
  - voxic11 12y ago

saosebastiao 12y ago

I've seen a huge uptick in spam email the last few days, and although I have no indication that I've been hacked, I feel as though I should probably fear for the worst and aggressively change all my passwords from their current kindergarten security levels. Is there a widely accessible, secure, multi platform, free/libre password manager that is recommendable as easy to use? I reuse passwords because its easy to remember, and I'm hoping there is something out there that is light years better than those I found the last time I tried (2007).

reitanqild 12y ago
I've used Keepass for a few years. Takes a little setup (2 plugins I think) to get form flling on web pages. I also use lastpass.com for most of my stuff. While not libre it is free and multiplatform. (I still pay to get mobile sync.)
coldpie 12y ago
Keepass is what you want.
quoiquoi 12y ago
Why not use your browsers' password manager?

morgante 12y ago

This is a good reminder that we all need to encourage our friends, family, and colleagues to not use the same password everywhere. Almost all of them currently do. The best solution I've found thus far is getting them to use 1Password or the like. They still only have to remember 1 password, and the browser extensions make it trivial to log in different places. If necessary, buy them the software.

junto 12y ago

Funnily enough there was a HN post yesterday that looked like a phishing attempt on namecheap accounts: Gift HN: Unused domain 'appstores.io' with ~11 months registration left Post your namecheap username and I'll pick someone at random in 24 hours and push it to the winner. https://news.ycombinator.com/item?id=8250981 https://news.ycombinator.com/item?id=8250981 Maybe it was genuine, but if I had posted my name cheap account name there, I think I'd want it deleted now.

deleted 12y ago

[deleted]