Hacker News Reader

Comment by Eric_WVGG | Hacker News Reader

> If you are using your Google Apps email address to log into various websites, I strongly suggest you stop doing so. Use an @gmail.com for logins.

This strikes me as bad advice. Getting access to a hijacked Google account is about as hopeless as everything else he got put through.

The point of failure wasn't "using a non-gmail address," it was "using an untrustworthy registrar."

And I know it's not a silver bullet, but it's unclear from the article that he was using MFA for his GoDaddy account.

View on HN

> The point of failure wasn't "using a non-gmail address," it was "using an untrustworthy registrar."

But wasn't his point that gmail.com is much less likely to have its MX record compromised than any domain you could possibly register? So using your gmail.com address removes the issue of registrar trustworthiness completely.

You're trading registrar trustworthiness for email provider trustworthiness. I'm not sure what is better.

I suppose I should start actually paying for email, and go with protonmail or somebody like that. If they have decent and competent customer service, that would reduce the chances of getting hacked.

> MFA for his GoDaddy account.

Sim Hacking is now a thing to get around MFA but it wasn't as popular in 2014. Call up the telecom provider and use the same approach. Leverage Googleable info of the target person and use that as answers to the customer support reps questions.

I should have specified "MFA with an authentication app" I suppose.

> Sim Hacking is now a thing to get around MFA

SMS is not a second factor, despite many companies pretending that it is. I am alarmed at the number of large companies (especially banks!) that just blindly and stupidly follow the outdated advice of using SMS messages as 2FA.

So, MFA is great, if it is really multi-factor: TOTP through Authy or Google Authenticator, U2F or WebAuthn through a hardware key like a YubiKey.

Multiple accounts means more work for the attacker. E.g. using unique emails for Paypal, Godaddy, and Facebook would have made this harder.

Unfortunately MFA doesn’t help in this case if an attacker can just circumvent it by calling customer service to fairly easily bypass it.

Reply on news.ycombinator.com