13 ms·
Show HN: My wife's email was hacked, I created an app to protect online accounts
- tomtoise 12y agoHate to be that guy, but in About Us you have a minor typo; "Having one of your online accounts hacked and loosing all your.." should read; "Having one of your online accounts hacked and losing all your.."
- tmikaeld 12y agoIs it open source? How does it work? This info is kind of important if you are posting on HN!
- urb 12y agoLogDog is not open source. It works by polling services periodically for information about user activity, establishing a baseline profile and then looking for usage anomalies.
- AdmiralAsshat 12y agoCould you elaborate a bit on some of the things you're checking for as signs of "suspicious activity"? I ask because I receive warning emails on occasion from Gmail ever since I started routing all of my data through a rotating-server VPN. I imagine LogDog might send similar emails, which is not necessarily a bad thing--I'm just curious exactly what else you're monitoring other than suspicious IP/geolocation.
- urb 12y agoLogDog monitors multiple parameters and will not send you alerts just because your VPN changes IPs. We establish a usage profile and only alert on significant anomalies.
- AdmiralAsshat 12y agoAnd, again, what would be an example of an "anomaly", other than an IP address from India suddenly signing in?
- exhilaration 12y agoWell... I think most people would agree that does seem like the kind of anomaly that would justify an alert. Just because they don't have some kind of cutting-edge AI to detect hackers doesn't mean that the service is useless.
- mobiplayer 12y agoA strange IP, signing in at early morning hours when you usually don't, using a different browser, different OS, different language config, different browser plugins, running through all your email folders... THAT would be suspicious all together, most of them are not by themselves. I understand that URB doesn't want to reveal all they do. It's the same way AV companies do not reveal how the develop all their signatures. Everyone crying "you should reveal all your secrets, otherwise you're doing security through obscurity" do not get it. It's not secret because of security concerns, but for competitive advantage against other companies in the field. Why aren't we asking FireEye, Mandiant, CloudFlare, Incapsula or any of the other supercool security company what are they parameters for behavioural detection? Do we feel we have a superior moral stance against LogDog because we don't know them?
- Khao 12y agoSo to protect myself I have to give out ALL my credentials to this new app? No thanks.
- urb 12y agoYour credentials stay on your phone (where you already have most of your passwords). They are never sent to LogDog servers.
- Khao 12y agoWell that's reassuring. It's not obvious from scanning the first page that this is how it works and will potentially scare away users. So I guess then it only works if I have a reliable internet connection and my battery doesn't run out. Do you know how battery/network heavy logdog is?
- urb 12y agoWe keep battery consumption <1% and compress all data traffic.
- 0xffff2 12y ago>We keep battery consumption <1% What does that even mean? 1% per hour? per day? 1% of your phone's battery? of my phone's battery? Meaningless statements like the one quoted do not inspire confidence in you or your product.
- urb 12y agoAndroid settings -> General -> Battery. Power consumption divided by Android into percent per app
- jbob2000 12y agoI don't know the situation with your wife's email... but if she had a poor enough password that it was easy enough to hack OR if she didn't update her password after heartbleed etc., then why do you think she will be proactive enough to use LogDog? (Obviously she will, because she's your wife, but the question is if people aren't proactive to keep their accounts safe, will they be proactive enough to use your service?)
- urb 12y agoThat's the thing... It's easier for people to download an app than to keep up-to-date on security events and proactively update to higher entropy passwords.
- jeremysmyth 12y agoIt's far, far more likely that she was phished or that she used the same password on a site that was compromised than that her email password was guessed or sniffed. (edit: of course, this is a general comment rather than any comment specific to OP's wife!)
- danielweber 12y agoIt's a passive thing.
- pzxc 12y agoI don't understand how it works or could possibly work. How is your app going to detect that someone is accessing one of my accounts from Israel, as indicated in your screenshot? Do you have software running on google's servers so that it knows what IP addresses are accessing gmail/evernote/one of the other services and can geolocate? (Obviously not). So how is this supposed to work?
- pandog 12y agoIf you scroll to the bottom in Gmail you can see a "Last account activity: 1 hour ago: Details" link. If you click that you can see everyone who logged on.
- minimaxir 12y agoAs far as I know, there's no official API to access this data. And that data definitely isn't available for all the services regardless.
- exhilaration 12y agoGood point. So they're repeatedly logging into your Gmail account and scraping the text from the page? Not a very elegant solution but I guess it works.
- kefs 12y agoThis shows sessions across all Google products: https://security.google.com/settings/security/activity?pli=1 https://security.google.com/settings/security/activity?pli=1
- monkey_slap 12y agoThanks for this. I actually found 2 devices that I didn't recognize.
- talles 12y agoSorry if I'm going to sound a little childish but... What if my LogDog is hacked? What kind of thing will the attacker be able to do with whatever LogDog has about my accounts everywhere?
- urb 12y agoLogDog does not save account credentials. They are kept only on the device and are never sent to our servers. The servers only keep anonymous data. There is nothing to hack.
- mtbcoder 12y agoIn another comment, you mentioned your system works by polling for user activity, creating "baseline" profiles and monitoring usage activity. That certainly does not appear to be anonymous data to me.
- talles 12y agoHundreds of parameters are used to identify unauthorized access to your accounts. I would love to know how. Seriously, no sarcasm here, I'm actually curious about those hundreds of parameters.
- urb 12y agoObviously I can't go into too much detail, but we cross reference data from the different services we monitor and thus create a fairly robust usage profile.
- personZ 12y agoObviously I can't go into too much detail That isn't obvious at all. Quite contrary, I'd say a refusal to go into detail puts the whole thing under a pretty dark cloud, making the entire thing sound entirely scammy. Even if we assume that you have all of the data you need (as an external service, with the limited information the various services provide) to create such a usage profile, there is no credible reason why you can't detail the mechanisms.
- urb 12y agoThere are various reasons why a cybersecurity company can't disclose the methods and mechanisms it uses in detail. We have our users' interest in mind.
- personZ 12y agoThere is also a reason why shysters and charlatans can't disclose their methods and mechanisms as well. This isn't to say that such is your tactic, but to be honest when I've heard your type of pitch before it has generally been because someone knows that one day they'll figure out how to make sense of the data, but for now they can just see potential so it's all kind of fuzzy. We aren't an ignorant crowd. There is limited information that you can monitor. Password reset emails. Sure. Access suddenly being revoked. Right. Weird posts at odd times of night. I guess. Outside of that, there is little belief that you're circumventing any sort of mechanisms at any of these providers.
- nerdy 12y ago"Don't get hacked, get a LogDog" From what I can tell this service does absolutely nothing to protect you from being hacked. It's more like a "you might've been hacked" notification.
- urb 12y agoIf you know something suspicious is happening you can change your password (from the app) and throw the hacker out. You can also avoid rolling-hacks (ex: when your email is used to reset passwords on other services)
- nerdy 12y agoI'm not saying the service has no potential value, rather that it doesn't fulfill the "don't get hacked" reprise by notifying you after the fact. The notification could allow you to fix the problem once it has happened but any hacker with reasonable sophistication can download data and change passwords in an automated fashion long before you can finish reading the notification.
- tamagokun 12y agowhat if the hacker resets the password before you get a chance to?
- dewey 12y agoWouldn't a third party service repeatedly logging into my services from a LogDog IP raise some flag on it's own at the service's own intrusion detection?
- urb 12y agoVery good point. It took us a while to get around that :-)
- jpatel3 12y agoAre you keeping log of those services possible address as well? I am not sure what other way you can identify.
- organsnyder 12y agoPerhaps it's simply a poor choice of words on your part, but "get around that" raises red flags for me. It makes it sound like you've found a loophole in their intrusion detection systems, that will (hopefully) be closed when it is detected—which will become ever more likely if your system becomes more popular.
- dewey 12y agoAre you working directly with the providers? If you are not you are basically saying you get around their intrusion detection system in some way? I think that's a point you should be a bit more transparent about because I'm not sure there are a lot of people who want to risk their google account being locked because of your app. We are all aware of the customer support horror stories dealing with getting your accounts re-enabled after they've been flagged.
- mralvar 12y agoFirst Show HN where I've seen someone have a phone number listed. Not sure if smart, or brave.
- 72deluxe 12y agoLooks interesting. Does anyone else use Two-Factor authentication for their emails? I do. I also use that SMS service for PayPal. Does nobody else?
- organsnyder 12y agoI use two-factor auth whenever it is available. I've also mandated it for all user accounts (on Google Apps) at my organization. For a while, I was trying to encourage adoption by expounding on its benefits, but then one of our users (without two-factor auth) had her account hacked, and I was able to employ the panic around the office to justify making it mandatory for everyone. This caused some pain for a little while (when two-factor auth enforcement is enabled for a Google Apps domain, users without two-factor auth enabled must use a temporary code, which can only be retrieved by a domain admin), and I wouldn't recommend this approach for more than a dozen users or so.
- 72deluxe 12y agoGreat idea. I am surprised so few use two-factor authentication. My bank requires it for logging in, sending money, even for going into the branch (thanks Barclays); RSA fobs or Quest Defender fobs were also used in a company I used to work for, for their VPN. With Google, the list of massive passwords they provide for logging in via POP3 is a useful thing to print off and have secreted at your house somewhere in case your phone gets pinched. And periodically/regularly tidying up old emails from your inbox (archiving them offline somewhere) is a way to keep the email account a bit safer, as there isn't any info in the mailbox.
- jj00 12y agoI use it, but I have to admit I'm not much of a fan. All it has done is annoy me by forcing me to stop my flow and look-up a secondary field. I think there should be a 3rd option of just having a second password. Better yet, add a few other options as well.
- 0xffff2 12y agoWhat additional security would be derived from a second password?
- discardorama 12y agoDoes it run client-side (device), or server-side? I ask, because if you're without a net connection, will LogDog still monitor your accounts (if it's server-side, it will, I guess)?
- rbxs 12y agoRefusing to explain how LogDog works, how should you trust them with your precious accounts?
- Mauricio_ 12y agoDo I have to believe the reddit-like story in the title? Looking at the website it looks way too professional to be something suddenly made out of the blue one day after your wife got hacked.
- RockyMcNuts 12y agoYes. Also, you are required to believe eBay was founded to help Pierre Omidyar's fiancée collect Pez dispensers. And Sara Blakely got Spanx off the ground by dragging Bergdorf buyers into dressing rooms and demonstrating control-top girdle underwear. If you can't invent a believable meet-cute creation myth, how can you create a good company? According to Wikipedia "The frequently repeated story that eBay was founded to help Omidyar's fiancée trade Pez candy dispensers was fabricated by a public relations manager in 1997 to interest the media. This was revealed in Adam Cohen's 2002 book,[14] and confirmed by eBay." http://en.wikipedia.org/wiki/Pierre_Omidyar http://en.wikipedia.org/wiki/Pierre_Omidyar
- jdalgetty 12y agoI love the skepticism!
- 64mb 12y agoHow does this protect me any more than 2FA does?
- mobiplayer 12y agoSeems that in the same way a house alarm protects you, loosely compared to your house keys.
- PeterWhittaker 12y agoInteresting. Potentially useful. Love it when people create new products. Very scary to put yourself out there like that. Especially in the security space. From reading the site and URB's comments on this page, LogDog appears to be a host intrusion detection (HID) package that works first in "learning mode" to establish a baseline set of acceptable or normal behaviours for any given user then eventually moves into notification mode in which it signals to the user that unusual activity has taken place. Unusual, in this context, means anything outside the thresholds established during learning mode. Presumably, learning mode continues over time and the system becomes more refined. So far, so good. What's not so good: 1. The basic premise is "trust us, we know what to look for, but won't tell you because we don't want the bad guys to know". This is security through obscurity and I'm afraid I can characterize this only as "charmingly naive". A) The bad guys already know, guaranteed. B) Unless you are truly expert in this area (see below), you don't and are only guessing. I don't want to harsh anyone's mellow, but you need to be able to back up your claims - especially when you claim your product will make someone's life more secure. We will consider believing your claims after we have read the research papers you are going to publish, the papers that provide enough information for thems of us who know this area to guess at your bona fides but not so much as to reveal all your secrets. 2. All data sent to servers is anonymized. So you say. I will take you at your word. But it means nothing, unless you have done the extremely hard work necessary to show that the data you maintain cannot in any way be used to establish identity after the fact, whether it be by patterns of behaviour or other means. This is an area of active security research and active attacks, and is not for the faint of heart. I invite you to research super cookies, click profiling, etc., etc. 3. Re #2: Your servers are now known to attackers who want that juicy high value data that they can probably do more with than you - unless you are as large and as well funded (they are both). Please describe, at least at a high level, how you are protecting this high value asset you have created. If you cannot, we cannot expect our data to be safe. Regardless of claims of anonymization. Convince us you understand defense in depth, prevent-detect-respond-recover, etc. 4. No offense, but this is a security product from someone with no documented (as far as we can tell) expertise or experience in this area. Everyone who has ever developed a security product from scratch has gotten the first release wrong. Every single time. This stuff is complex and complicated, it takes tremendous experience in the field to design a tool properly, let alone implement one, experience gained either from starting from scratch and surviving to release 4 or 5 or from working on other products developed by experts/survivors. URB, you may find comments herein and on this page to be assertive, even aggressive. None of us will apologize for this. You are making BOLD claims and providing no reasons for anyone to believe you know what you are doing. You need to do that work before the security community will accept this product. Try to get hold of Bruce Schneier or another well-known, respected commenter in the field. If you can convince a few such people by giving them a privileged, behind the scenes view (they won't sign your NDA, there is nothing for them in that), that will a) provide real marketing bumpf and b) go a long way to silencing many critics. But note that you still need to address 2 and 3, even if you convince the best of the best of 1 and 4. Good luck, those are hard problems to solve.
- jpetersonmn 12y ago"1 in 4 online accounts gets hacked." I've got hundreds of online accounts and so far none have been hacked. Where you getting this number from? I think for you to be successful in this venture you're going to have to be very transparent in how everything works, based on comments so far that's not the case.
- ada1981 12y agoYour press kit was not accessible as of the time of this post via the link you provide: https://getlogdog.com/wp-content/uploads/2014/08/Logdog.zip https://getlogdog.com/wp-content/uploads/2014/08/Logdog.zip
- darkarmani 12y agoTypo: > "loosing all your data"
- Derbasti 12y agoSo I prevent getting hacked by giving some random app the login details to all the services that could be used to fake my identity. Makes sense.
- MrQuincle 12y agoFrom what I can see he crawls the website as a user would do. He logs in to Google just via https://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/ https://accounts.google.com/ServiceLogin?service=mail&contin..., two-factor authentication might involve user interaction. Session information (about other sessions) from for example Facebook can be obtained through https://www.facebook.com/ajax/settings/security/sessions.php https://www.facebook.com/ajax/settings/security/sessions.php
- ganga98 12y agotwo comments -- 1. Since your app is free what's in it for you ? You mentioned in other comments that passwords are never shared with your app, however, you do continuous polling and create profile. Are you going to sell this data to advertising for behavior targeting and advertising ? Amount of information you know what a particular user is using and how they are using it ( due to continuous monitoring ) is way too much intruding in my opinion. 2. What if , my account gets hacked due to logdog ? You approach is not too convincing since you even did not answer other users question on what parameters you are monitoring. Sophisticated hackers might take advantage of your service and hack into my account. Do you assume liability and loss that would occur because of your service ? I don't want to sound rude but putting cheesy story in headline might get you temporary attention but this service is no better than saying "we will watch out who will rob your bank and then directly or indirectly responsible for lost money"