Hacker News Reader

Comment by tobyjsullivan | Hacker News Reader

It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.).

So the #1 step to reducing your risk of an attack like this would be setting up 2FA on your email account. The industry standard is password resets via email. If an attacker has access to your email, they have access to every online account you own.

Stealing email passwords is easy. So easy. No matter how complicated your password is or how often you change it. 2FA is an easy, reliable way to make it orders of magnitude harder for any attacker to breach your account.

I know I'm preaching to the choir here on HN but I'm just flabbergasted this didn't make it into the article.

View on HN

Yeah so about that 2FA. I have a local email client, which uses IMAP and hence cannot do 2FA. What now? I've always thought this is rather a gaping hole. Of course i use app-specific passwords which presumably won't allow access to webmail or changing the account password, but still, if someone got my app password for IMAP, they could still siphon out password reset emails for all my other services.

What do the rest of you do? Only use webmail with 2FA, disable all other access? That seems onerous.

Depends on your underlying email service provider. If it is gmail, for example, then they provide one-time use passwords for exactly his purpose.

What this means is if you enable 2FA for your gmail account, you can generate a one-time password to authorize any client which does not support a 2FA auth flow. This password is then destroyed by both parties.

If you run your own email server, I think you are at low risk of being attacked in a more general phishing net. An attacker targeting you personally still has many options but that is much less likely.

> This password is then destroyed by both parties.

I don't quite understand this. Won't the email client need the need the password every time to auth with IMAP?

Some IMAP providers like Gmail use a more sophisticated auth mechanism where a secret token is shared over the encrypted link after the first password auth. This token typically has a long lifetime and is used for future sessions.

I have never heard of that, do you have any sources?

If you simply don't use webmail, you're about 99% less likely to accidentally type your password into a website that happens to look like your webmail login page (which doesn't exist).

Sure. FWIW i avoid using webmail as much as i can, but that's just because i love my mu4e. Still though, i wonder about what would happen in the (admittedly very unlikely) event that someone compromised my secrets file. (example off the top of my head: seized backup disk at border control)

Yeah, depends on what your threat model is. You'll go crazy treating every possible threat as "guaranteed to happen; must defend" though. If you're worried about border control, at least you'll know if they search your stuff and can revoke access after the fact, which puts it in a slightly different category than day to day surreptitious password theft.

Step #2 is to use unique passwords for your main email addresses. These passwords should be unique in the universe. You must not use them with another account or to encrypt a file etc. Nowhere!

And step #3 is to keep all your softwares up to date; OS, antivirus, browser, your WordPress, its plugins, your Notepad++, WinRAR, firmware of your ADSL modem, other computers on the network, BIOS, smart TV etc. Everything should be updated to the latest version.

And step #4 is to throw up your hands and shout "Fuck it!" the Nth time you lost everything because you can't find your master copy of your password manager, your back up has drifted out of sync, and you just accidentally spilled your coffee on the flash drive that holds your backup-backup--destroying it.

Hyperbolic sarcasm aside, keeping on top of security is starting to feel like Alice and the Red Queen -- it takes as fast as you can run just to remain in place. I'm starting to feel a bit more sympathy for those who give up on good practices and start using the same password/pin everywhere and pray that ill will never befall them.

Except 2fa doesn't work in practice unless you're an expert.

See eg gmail: you can't set up 2fa without supplying a cell (you will be allowed to remove it later, but how many know to do this?) Your phone number is trivially stealable -- see eg youtube video of people just stealing phone numbers with a crying baby and a sob story. https://youtu.be/F78UdORll-Q?t=133

Also, lots and lots of places have trivial routes around 2fa because people losing their password and/or 2fa is an order of magnitude more common than theft.

Google actually lets you use a physical key to protect your account.

https://support.google.com/accounts/answer/6103534?hl=en&ref...

2FA works in practice against people who don't have physical contact with you. For most people, that's the only threat vector they're worried about.

It hardly makes your life more difficult, and it does help at least a little bit. So it's worth setting up.

Not really; sms as 2fa has regularly enabled people to steal accounts they otherwise couldn't have gotten by allowing password resets by stealing your phone number.

See eg @deray getting hacked.

If a password reset is allowed by pin that's not two factor authentication, that's SINGLE factor authentication. I know we tend to think of 2FA as anything involving a pin sent to your phone, but it does require two factors.

GMail, for instance, will not allow a password reset with just a phone pin.

I wonder why you cant get a pre-paid at a kiosk. Use a burner phone. Yes, you need some time and effort but if you need good security you will suffer some inconvenience. BTW register the SIM with your spouse or parents name so that there cannot be an easy connection to _any_ of you accounts. Remember also to top-up your prepaid SIM occasionally.

An non-contracted burner phone in your spouses name that is used to send cryptic looking messages.

That seems like the kind of thing that'd get you on an intelligence agencies watch-list..though these days it's rather hard to find something that wouldn't.

Your preaching but some ears cant hear you. I want to turn on 2FA but I dont know when will that day will come.

It also happened to me to loose a smartphone without PIN, and I never thought it would happen and I kept postponing that simple step.

Maybe this time I should listen.

2FA isn't hard to use, and is barely inconvenient. How often do you log into your email, anyway?

Also, if you lose your phone, you can make use of your recovery code.

The reason I mentioned about loosing phone was not related to email recovery but the fact that I did not learn the security lesson of not using a PIN to protect my data.

After I have read this post I wanted to actually enable 2FA right now, but then I discovered that breaking news, terror attack, and again I postponed, the same like I postponed securing my phone with a PIN.

Have you enabled 2FA yet?

I keep backup codes for my account in two places: My wallet (which I always have on me, so I won't be locked out if I'm traveling), and at home. If you're really paranoid, you could also give backup codes to a friend or relative, or put them in a bank safe or something like that.

Reply on news.ycombinator.com