Hacker News Reader

Comment by Pyxl101 | Hacker News Reader

Why state-sponsored hacking specifically, as opposed to any (likely) unauthorized access?

it's quite obvious, really. Regular unauthorized access means: batten down the hatches, man battle stations, i.e. change password State-sponsored hacking means: delete social media profile, move residence, change phones, start praying, etc ;-)

James Mickens' "Mossad/not-Mossad" threat model comes to mind: https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Thanks for that, it had honestly never occurred to me that murder for the purpose of buying someone's stuff at an estate sale might be a thing. I have updated my will accordingly.

Seriously? I got through the first page and a half of smarmy pop-culture references and couldn't figure out what the heck the author was talking about, so I just stopped reading. More power to you if you understood it!

I think it's because of the context it was linked in. Mickens is a pretty smart guy and is known for the series of articles like this one; it's something you read to reflect on in between crying out of laughter.

That is an incredible essay. Thanks for posting

I think they do, they're just being extra helpful here and specifying that they think whoever owned you was a state actor.

They already notify you about likely unauthorized access. This is just additional notification for state-sponsored attacks.

If they have the information, the heads-up could save a life/personal freedom?

There are many non-state actors who can threaten life/personal-freedom.

Not in the same way a state actor can. Especially if it's your own state. An FBI agent won't go to jail for ending your life/personal freedom; he can act in the open.

Yes, but the majority of hacking attempts against Facebook accounts are probably just trying to post ads for knock-off Ray-Bans.

Also, how will sending a new password to your cell phone help? If you are dealing with state sponsored actors, why not assume they can see all text and email?

A two-factor authentication token to sent via text, not the actual password.

That said, I find SMS-based 2FA to be pretty dodgy as well. Cloudflare was hacked once by somebody who managed gain access to an admin's mobile phone by social engineering their telco. If a site does not offer TOTP based 2FA I usually don't bother using it.

I didn't say the actual password. The page wasn't very forthcoming on all the details, but a 2FAT is typically just a very short, temporary password.

How does TOTP compare to HOTP?

HOTP tokens does not expire with time, so there is a bigger risk of them being stolen from transit/storage and successfully used.

If the actor is not sponsored by a state that would have easy access to your telecom (e.g. you live in the US but the attack is from a hacker sponsored by China) this is still very helpful.

Reply on news.ycombinator.com