Hacker News Reader

Comment by flaxton | Hacker News Reader

About a month ago, a hacker guessed a weak password on one of my seldom-used Google accounts. They changed the password and the recovery email.

I attempted to get the account back, including telling them the old password, old recovery email, and the month and year I opened the account (like 10 years ago) but no, they said they “couldn’t” do it.

So I’m sunk. No recourse, no one to appeal to.

So why would I put my whole life into Google? When it can be taken away so quickly, and there is no appeal process?

On my main Google account I do have a recovery email (that I host) and 2FA. But I do not feel secure that the same thing couldn’t happen there too.

If it does, you are sunk.

I’m actually in the process of moving everything off of Google.

No thanks!

View on HN

You could be the hacker who got hold of the old recovery email. :/

There's no safe way to do these recovery processes.

Weak/lost/compromised password means that, the account is gone.

Sure it'd be nice to have a fallback that ties recovery to visiting an office, where you establish some shared secrets, biomarkers, etc. But big companies are not into that because probably too few people pay for this. (As they also don't want to depend on a 3rd party for identity management.)

>>Weak/lost/compromised password means that, the account is gone.

Not if you have 2FA enabled.

Not that SMS-based crap either. I'm talking about the _real_ stuff, such as TOTP.

What if you lose your phone?

Use Yubikeys, plural.

TOTP isn't any more real than SMS. Social engineering easily defeats both. Use FIDO2 or U2F.

[Cue usual HN discussion about loss or unavailability of physical tokens]

This is not true, SMS can be MITMd easily with sim jacking and TOTP is running fully offline.

TOTP is the one that is more trivially MITMed. SMS is also vulnerable to the Confused Deputy problem.

False. Every MITM technique for TOTP works for SMS. Not the other way round.

A TOTP-based phishing attack can start entirely from a false origin. The user can enter the offline-generated secret into that false origin and never realize the phishing even happened.

SMS MITM is harder to pull off, as the normal UX flow assumes the origin knows the user's phone number, which is a weak measure of authenticity on the part of the origin. If a user is taken to a false origin to begin with, then it must somehow either prompt the user for a phone number (which is likely to signal to the user that something is amiss), or else have an actual communication conduit to the true origin so that it can trick it into initiating the SMS challenge.

By the way, we're misusing the term MITM here, but I went with it to keep the conversation going. I believe OP meant phishing.

Edit, since we're in a reply war that HN code is properly stifling: of course we're talking about the TOTP generated secret (what you're calling the six-digit PIN), not the shared secret that's transmitted from the origin once at setup time. SMS and TOTP are both atrociously susceptible to social engineering, and SMS has the additional feature that the engineering can happen without any involvement of the user. Your downvoting suggests there's a significant difference between the two, but phishing studies show that all of us, even those of us who consider ourselves experts, are vulnerable to phishing.

> The user can enter the offline-generated secret into that false origin and never realize the phishing even happened.

That's pretty far-fetched, never heard of a phishing attack that tricked the TOTP secret from users. I bet 99.99% of TOTP users don't even have access to the secret. You can only trick the six digit code out of them, valid for 30 seconds, which you then feed into the actual login form / API.

The SMS code phishing flow is the same. You trick the username and password out of the user, feed it into the actual login form, trigger the SMS challenge, and once again trick the six digit code from the user (which is usually valid for longer than 30 seconds, btw).

Except with SMS there are many ways to intercept.

Re edit: “Your downvoting suggests there's a significant difference between the two, but phishing studies show that all of us, even those of us who consider ourselves experts, are vulnerable to phishing.” With SMS you don’t even need phishing, you can combine leaked credentials (e.g. from other breaches) and SIM jacking to hijack accounts. Plenty of high profile cases posted here before. That’s the scary part: no phishing at all. And you never backed up the “TOTP is the one that is more trivially MITMed” claim.

> There's no safe way to do these recovery processes.

Imagine if banks said the same thing. "Oh someone changed the password and email on your bank account, sorry you permanently lost access to all that money."

If you signed up with your real name, some combination of government id, proof of physical address etc should be enough for recovery. If it's good enough for banks, shouldn't it be good enough for email?

Okay, so you’re proposing that Google ask for your government ID when you sign up for a Gmail account?

Your comment seems a little aggressive, but that notwithstanding, there is the option of letting users allow it only if they wanted some extra security. 2FA and other safety-related items are optional...so why couldn't this be?

It doesn't even need to be government ID. As soon as you pay for something, like starting a Google One subscription or buying an app on the Play Store, your billing information should establish your identity. Later when you need to get your account back, you may need to present some sort of government ID and/or proof of address that matches your billing information. It's not bulletproof but it's better than losing access to a paid account forever.

A paid account, sure, I assume that might already be the case? I certainly don’t expect to lose access to my GSuite account or Google Fi account if I forget my password. However, ggp seems to be talking about a free account, as the vast majority of Gmail accounts are.

Yeah, that's unfortunate. But I wouldn't expect a free account to be recoverable. You need to have put something on file, whether government ID or billing info, in order for anyone to verify whether someone who claims to be you is actually you. Americans are weirdly averse to using government IDs, so billing info is really the only option.

I mean, for a long time that's how banks dealt with some types of fraud. They even got people calling it "identity theft".

It happens all the time and bank will tell you you have to physically step in a branch with the ID used to open the account.

Source: happened to me.

Yes and having that option is way better than losing your account forever with no recourse.

Sure. But I see some trend in comments where people assume you can't be locked out of resources in traditional banking. And that is patently false.

It's extremely easy to have a bank account you cannot access. But at least you get to talk to a (useless) person about it.

But that starts with first establishing your identity at the bank. And who knows what would really happen if someone really targeted you and/or your account at that bank.

I mean banks I have some dealings with try to match my signature (after checking my gov issued ID cards), but if it doesn't match they just let me look at the screen so I can try something similar.

So what would happen were someone walk in with fake ID cards? Probably they could just walk out with my money, and then it's up to the CCTV tapes to maybe "prove" that it wasn't me.

If there were truly properly secure and cost effective physical identity assurance services big Internet companies would probably use them.

Companies really need some sort of rollback to prior recovery email option. I had this happen with an old skype account I hadn’t put 2fa on.

I was able to get back into the account, but since the attacker had added their email, any changes had to be confirmed via that new email address! I re-entered a few times but eventually just gave it up to them. Microsoft was no help.

Outlook now has a wait period of 30 days before some certain security changes can be made - e.g. account recovery options. I've never used it though.

https://support.microsoft.com/en-my/help/4057241/microsoft-a...

That's exactly what caught me I think! Because the user changed the email, I couldn't change it back for 30 days.

I may have been an edge case: I had no email on the skype account, only a recovery email. Eg:

Account email: null

Recovery email: myemail@example.com

The hacker changed it to:

Account email: hacker@example.com

Recovery email: null

My account was old enough they hadn't required an account email on creation.

My ownership of the old recovery email was not persuasive to microsoft. I was even telling them about it while the hack was happening. They let the hacker take over fully, send spam, and shut down the account for spam.

Basically I couldn't change the account email for 30 days, and the hacker had been able to remove the recovery email.

I don't see how you could do that without opening up another risk. Suppose your recovery email account is compromised. You don't want it as a recovery email anymore because then the attacker can use it as a foothold to get into this account. If you can roll back removal, then you can't protect against that.

The only way I can see around that is if there are conditions on rolling back. But then if you're going to require authorization to roll back, you need to authenticate that request, and the whole reason you're trying to do this is because you are trying to reestablish the ability to authorize.

That's a hard problem.

Think of it the opposite way. You just changed your recovery e-mail and password because your recovery e-mail was compromised, and you also used the same password. In other words, you secured your account. Maybe you setup 2FA and a bunch of other things... good.

Now take the place of the attacker. You look at the compromised inbox, see a confirmation email from Google. Nice, you now have an account login, the creation date, and a good password candidate. If you could simply call Google, give the info you already got by reading the compromised mail, and get access, no amount of securing done by the victim could work.

There are two contradicting goals here: keeping your data secure from hackers, and allow some mistakes to be made on your side without you getting screwed (using a weak password is a mistake). Google is constantly juggling between the two and sometimes, the outcome is not what you want it to be.

The solution is not to hold on your personal data too much. Google doesn't ask for it only so that they can target you with ads, even though it is a very important reason to them. It is also used to secure your account.

If you don't want to use Google, good, however, there is no perfect solution, especially if you are not flawless yourself. Keep data on your own machine? Do you have offsite backups? End-to-end encrypted, privacy focused services provide no form of password recovery whatsoever. And services that are a bit too loose may give anyone access with a bit of social engineering. Pick your poison.

Well you are using free resources that is why. If you had paid account with them then they will of course help you get it back. Google one is different then getting free inbox.

A seamless account recovery was absolutely not the experience some people I knew had with paid Google Apps or other paid Google products accounts.

(Not to mentioned the unexplained account locking)

So, no, it's not merely an issue of "just paying".

Reply on news.ycombinator.com