Hacker News Reader

Comment by brianwawok | Hacker News Reader

It's tricky because a lot of customers really DO lock themselves out of a service, and forget their password reset code.

Fun story time. I use to play MTGO, the online Magic the Gathering game. Played it from beta for a few years say 2002-2004. Wanted to check it out in 2014 to see how it changed. Failed password reset online, had to call in to support.

The support guy was like chortle what was your security passcode? I had no idea. He tried giving some hints. I said it has literally been 10 years, I am never going to remember. So he went ahead and rest my password. He told me for the record my security code was "I am the nacho king", but I would be prompted to change it at next login.

So could I have social engineered a 10 year old MTGO account? Yes. But without it, I would have been locked out. I was NOT going to remember some stupid passcode kid me set on a game account.

And apparently I am the nacho King.

View on HN

One option is to look at when the user last logged in. I would be a lot less pissed if an account that I've never touched in 10 years got compromised... I'm probably going to remember my info for recent accounts and want it to be difficult to social engineering those

This is an excellent point.

> "You forgot the password that you've logged in with multiple times... including 20 minutes ago."

That should raise a flag.

Namecheap has security notifications that inform you of login attempts. https://www.namecheap.com/support/knowledgebase/article.aspx...

This is more about preventing the social engineering attacks. The example you're replying to is where the actual user logged in 20 minutes ago, while the attacker is trying to claim to customer service that they forgot the password. If customer service were looking at login attempts, they would see that it doesn't make sense for the user to not know their password, when clearly they provided it to the site just 20 minutes ago.

I'm aware. This is an isolated comment about other security mechanisms that are in place for the user (not for the support staff).

One of the most frustrating things for support or customer service personnel to do is respond to something other than what was said.

It actually should not.

People using a password manager might not ever know their password. Funny things happen with password managers where history is missing, changes don't save, keystrokes break things. We can't penalize users who use them.

It's unfortunately a really messy area.

Source: was a password manager in a past life

That's why it should only raise a flag rather than totally stop. Perhaps the customer service rep can ask a few more questions.

It's a similar situation to someone who only ever uses their credit card to buy small amounts from their local supermarket. Then suddenly they use it to buy a flight in another country. It might be legit, but it's often not, and should suggest that customer service need to do more investigation before approving.

> I would be a lot less pissed if an account that I've never touched in 10 years got compromised

Depends on what that account controlled.

> I would be a lot less pissed if an account that I've never touched in 10 years got compromised...

You don't need to log into your VPS provider's account or domain name provider's account very often, compared to how often you use the machine or domain. But you don't want those getting reset more easily just because you haven't logged into them in a while.

I once tried to log into a site only to discover that the security question I left for myself was "What is blue?". I never figured it out.

The sky!!!

AT&T has a security code which is "What is your favorite restaurant?" that we set a decade ago when signing up for internet service.

My wife and I have made, I don't know, 10 guesses over the years and have never been able to figure out what our response was back then.

Questions with fact-based answers are much better. But...I once had a site ask me for my best man's first name (Good! This probably won't change over time!). I filled in "Dave" ... and the site gave me an error "Your answer must be at least 6 characters."

Doh!

Security questions should be treated as secondary password fields, since they are that. Use Diceware for a good tradeoff between entropy and memorability/pronounceability or more complex random passwords and store them in a safe place.

This works well until you get to the "Our site is so secure that we need you to answer three security questions from our canned list, and they can't all be the same string" geniuses. Such an antipattern.

For every site that does this, I have a blob of text in my password manager where I write down

Q: what was your childhood best friend's last name? A: pathway-titian-slowly-quiver-kodiak-hue

etc., even for fact-based things like "what city were you born in?" or "what street did you live on in 1995?".

Ah, but the anti-pattern folks have a way around that.

Drop-downs for answers. Just got this on United.com:

http://imgur.com/84l0CdU

How about 5 random questions, 5 random answers and record all of these in your password manager?

If you have a password manager that successfully tracks the questions, then there's no reason to need to recover the password, as you'll just track the password in the same system.

The catch-22 of these systems is that recovery questions need to be obvious, memorable and unchanging enough to the user that they are useful for recovery, while also being hard for a third party to guess/research. I feel like for the most part those are more often than not mutually exclusive.

I think that the drop-downs are trying to prevent people from mistyping things and locking themselves out because "Accordien" doesn't match "accordion".

I had something along those lines tryin to log in to mojang on a new computer. "We've not seen you log into this pc before (although I had on that IP), please answer these three security questions. Of course I don't remember so I just reset them. I imagine the new answers and the old answers had a lot in common - they were composed primarily of expletives.

Favorite restaurant! What percent of the full business name did you use? Did you capitalize all the letters the same way or in a consistent predictable way? Did you add a word to meet the minimum character/word count? Did you actually have a favorite when you made this? Is your favorite restaurant public information?

This is why I set all my security question answers to a single answer for low security stuff and random pronounceable strings (in case I ever need to read them to a support person) stored in KeePass for high security stuff.

I'm always amazed at how little thought seems to go into these questions.

My wife filled one out a few weeks ago where both the questions and answers were selected from popup menus. One of the questions was "What's your favorite summer activity?" Her answer was, "Swimming." Yeah, that's going to add about one bit of entropy to most people's accounts, you idiots.

Another favorite is "middle name of your youngest child." That answer can change over time!

Best way to handle these are to use a random string for all the answers if you can, and if they let you create your own questions use more random strings; same goes for login names.

What city was my dad born in? xGU,wT&Yvcn6vr?]#,mE of course.

I did that to my payroll account to try and prevent this very issue.

Little did I know that it's one of those services you need the password (I had written that down at the time as it was temporary) AND these questions that are usually used for password resets.

I don't think that will ever get fixed until I change jobs again.

Until someone says "I know my dad was born in Minneapolis, what does it say??" and the customer service representative replies "Huh, it looks like the answer is just gibberish...", "Ah! I must have just mashed on my keyboard when I made the account, sorry about that!!", "No problem, your password is now reset to foobar".

While avoidable with training, that brings up its own issue: What if what's being asked of the people taking these calls is outside their pay range?

I think all account credentials related things should be handled by special support people, who were trained to understand the situation. Shouldn't be that big percentage of all requests when people need to change/remember password and can't use regular ways.

Then the company's decisions on how much to pay their call centre staff has just opened up a possible vector for attack. Simple as that.

I can't reply to the sister comment for some reason, so I'll piggyback on the parent.

I always fill these with awkward or absurd questions/anwers that would be amusing if a human operator ever needs to verify them. E.g.

Would you like to go on a date with me?

What color pants am I wearing?

What is the square root of insanity?

Obviously you need to store these in a password database in order to remember them, which kind of defeats the purpose. If I have to choose from predefined questions, it goes along these lines.

Q: What was your mothers maiden name?

A: Why, are you stalking her?

Q: Where were you born?

A: Oh I can't remember, it's been so long!

I've just started filling them with randomly generated strings that my password manager helpfully creates for me. Though, apparently my bank uses those answers for phone verification also, which makes answering questions like "What's your Significant Other's nickname?" awkward when the answer is "F9-#g7a2<qj"

Use a random but user friendly value

#$%&+@ is going to be hard to type or speak, just say their nickname is "the frozen one", same entropy, easier to handle

>> What's your Significant Other's nickname?

> Use a random but user friendly value

> "the frozen one"

I imagine that may make make your significant other who was previously friendly, markedly less so, if they see your "friendly value". But that may have been your point, as it may be quite a bit easier to remember. :)

My point is to use a term that is easier to type and speak rather than just a sequence of symbols. Or just modify the "right" answer in a quirky way.

But yeah, what you said might happen.

I do the same, but Correct Horse Battery Staple them.

Yep, that's the way to do it - just ignore the questions competely and let your password manager handle it.

Error: Security question answer cannot contain special characters: !@#$%^&*()';

Error: Security question answer cannot be more than 10 characters long.

Error: Security question answer must be one word.

Error: Security question answer must be unique.

Error: Security question error. Please try again.

> My wife filled one out a few weeks ago where both the questions and answers were selected from popup menus

United Airlines does this.

Their reason is incredibly depressing.

https://mobile.twitter.com/evacide/status/711853927134842880

Infosec is an unsolved problem in so many ways, especially for the majority of people that are nontechnical.

I once tried to perform an internet banking task only to find out I had to call in by phone and enable it first. So I did, and I was asked a few security questions about my data, one of them was: what's the name of your spouse?

I gave the name, was asked to repeat it, so I did, they informed me I was wrong.

I still don't know if they had a name with a typo in the records, a maidem name, or maybe they didn't even have her name (don't remember telling the bank about marital status) and it was some sort of trick question where I was supposed to answer I'm single (even though I wasn't).

Did you by-chance try substituting all "n's" with "m's" in your spouse's name?

Story time: I have been trying for 3 years to figure out what I wanted to hint at with "If it's not this one then it's the other one" as a secret question. I thought I was a clever boy not choosing the usual predetermined "what's your mother's name ?".

-1?

perhaps it's one of the two "throwaway" passwords you were using at the time?

It most certainly is but... it doesn't work. At that time I had some kind of semantic combinations for passwords but it doesn't compute for that website.

Comcast's password recovery is pretty weak. I just did it last night. They ask for your zip code and your favorite sports team. If I have a Boston zip code there are likely only 4 options for favorite sports team.

Poor Revs

I had a similar situation just recently with an old Gmail account. Despite knowing the password, Gmail wants me to answer the security question or log in from a place I logged in ten years ago or list folder names (which didn't exist the last time I used that account) or ...

The whole point of this misery was to recover my Steam account to play a few games. Fortunately, Steam lets you recover your account if you can provide proof of ownership (like CD keys of physical copies).

I don't want Google to be the safekeeper of my digital identity.

I might have the answer for you- the security question on some of my unimportant shared accounts where a question was required is "what color is my VGA cable?"

And it wasn't 'the sky'?

Maybe ... Eiffel65? :-)

I had a similar thing happen with my Battle.net account. I forgot to transfer over my authenticator backup code when I switched password managers last time. I had to send them a photo of my driver's license next to my face and another one of it next to a physical newspaper with the date on it. This seems like a much better process for recovering accounts that matter.

So what do you think happened to those photos?

Some people would be happy to pay for a leaked copy of those photos, for use with any other company that would accept only the "face/license" photo as sufficient proof.

I think having a recent date on the newspaper prevents reuse of the images. I'm not a Photoshop expert, so maybe that's trivial to change. When I look at my support ticket history on the website, the ticket attachments are gone, so hopefully they're shredded after the support person views them.

This seems very easy to bypass.

Very easy? I'd say "possible" at best. And now you've got access to a battle.net account. Took a heck of a lot more work than asking someone for username/pass in a live chat, and what you gained access to is worth a heck of a lot less. Plus Blizzard actually does keep backups and records and will be able to fix the situation for the account owner.

I'd be surprised if ever a Blizzard account was compromised by someone sending in a false picture.

I don't know what battle.net is so I was speaking generally. Since pictures don't have security features on them it wouldn't be too difficult to photocopy your own id, change the name/address, print it out and glue it on a plastic card. You now have an Id that looks good enough for photo verification. It's a lot of work but if the steaks are high then it will be done. There's also the case when these pictures get leaked, there's a lot of people who have scans of my id. Or just photoshop the pic after its taken.

There's services on the darknet where you can buy these fake Id picture/scans as well.

It seems like a general principle that the less important something is, the better the security probably is. Steam, for example, is really paranoid, constantly asking for verification whenever it thinks I'm logging in from a new computer, bugging me nonstop to set up 2FA, e-mailing me with alerts, etc. Meanwhile my bank does straightforward username/password authentication, with the bonus that the password is case insensitive and silently truncated to eight characters.

It's not that Steam is paranoid for no reason. People keep virtual items on their accounts which attackers can sell for real money, potentially yielding hundreds to thousands of dollars from one account, and so attempted Steam account hacking is rampant. Of course, that's nothing compared to the amounts stored in bank accounts...

Not to mention an account with saved billing info could be used to sell "extra copies of games I can gift you for a few bucks" since Steam allows gifting. What, you mean you didn't mean to buy 10 copies of "DARK SOULS III Deluxe Edition + Steam Controller Bundle" for $115 each to gift to all your friends and family?

>Very easy? I'd say "possible" at best.

I think you are a little confused here. There's no way for Blizzard to authenticate those pictures, you can take literally anyones passport and just swap the name on it.

> Took a heck of a lot more work than asking someone for username/pass in a live chat

This might be true in a world without photoshop, but that's not the world we live in.

>I'd be surprised if ever a Blizzard account was compromised by someone sending in a false picture.

In my personal experience, they'll very rarely insist upon receiving those photos. My battle.net account isn't even under a real name and despite that I've had the authenticator added and removed several times.

The way I fix this is to save the images that you get for 2FA and store them offline in a password manager like KeyPass.

To be fair, that's a game account. I realize some MMOs can have really real-money valuable characters/items, so this argument can break down, but the security should be different from an MMO and a VPS solution or a bank.

All of my security questions are passwords. I once had someone at a bank ask "Wait, your mother's maiden's name has a number in it?"

"Wait, you actually answer security questions that any of your friends can guess honestly?"

> To be fair, that's a game account. I realize some MMOs can have really real-money valuable characters/items, so this argument can break down

You want to know how bad it can break down? I imagine the worst case scenario, for so many reasons, actually happened and was mtgox.com. It started out as a Magic: The Gathering Online Exchange (from what I understand) before it became the now infamous Bitcoin exchange that was hacked[1] and massive amounts of money was stolen. I don't know for a fact that old accounts before the pivot to Bitcoin still existed and worked, but it's not inconceivable that they would. One hopes they adopted much better security compared to when they were a trading card exchange (if it wasn't already exceptional at that time), but there could very well have been a time when it was gaining traction for financial type services but didn't have good account safeguards.

1: Or whatever. From what I remember that's a story convoluted and with enough conspiracy theories it's worth a movie.

MTGOX was purchased as a domain name for a possible MTG exchange, but it never went further than a domain name. There was never even a site.

Are you sure? Wikipedia[1] seems to indicate it at least got into a beta, but it also implies that the domain was what was reused for the bitcoin exchange, not the code base. That said, the references on wikipedia point to the Internet Archive, which shows a placeholder page that says it's in beta, but there's little there to indicate there was ever anything working. It also says it was used to advertise another card game later, but that was just a link to another domain.

I guess that's a long-winded way of saying you are probably right.

Then again, bitcoins were worth so little in 2010 that I could imagine the account security on exchanges back then being comparable to hobbiest exchange sites, so the spirit of the comment may be valid even if the specific example falls down. :/

1: https://en.wikipedia.org/wiki/Mt._Gox#Founding

Magic Online simulates paper Magic. You buy packs to get cards, each card is its own individual digital object which can be traded and sold, card sets go out of print or have limited runs, and rare promos are released. It even has its own digital currency, "tickets", which are reasonably easily converted to cash.

Magic Online accounts can be worth tens of thousands of dollars.

And at least back when I played, if your account got compromised and all your cards were liquidated, the response from customer support was pretty much "that's too bad, shouldn't have let your account get compromised". I seriously doubt they ever added 2FA or anything either.

> Magic Online accounts can be worth tens of thousands of dollars.

It might cost 10k+ dollars to make a behemoth account, but I don't think they are worth that much. It's basically fake internet points, I can gain these for free in this very comment.

No, you can get actual money for them.

Used to be easier when you could directly trade digital cards for paper cards..

You can depending on how recent they are.

I recently changed my phone support password at work to "aaah, f*, I'm not sure is it.." after listening to all my previous support calls and realising that was what I answered with 9/10 times. I suspect its only a matter of time before someone else accidentally guesses it. Its only for my regular user account, for my admin accounts I need to get another domain admin to reset the password, there is no process for anyone to exploit, just an audit every month.

This is something we struggled with at Exoscale, I took the time to do a small write-up of how we approach reset requests here: https://www.exoscale.ch/syslog/2016/04/13/i-lost-my-2-factor...

So could I have social engineered a 10 year old MTGO account? Yes. But without it, I would have been locked out. I was NOT going to remember some stupid passcode kid me set on a game account.

And apparently I am the nacho King.

What are the chances that you'll remember it in the future? You're already two years into remembering it for the next decade after you found it out again.

Very much this. As a long-time Namecheap customer, this thread caught my attention, but my layman's conclusion is that it doesn't really sound like they did anything worse than any other host would have done.

As someone who forgets his passwords on a regular basis, I'm kind of glad that there's no such thing as perfect security...

This is why I think a manual disable is the best bet.

I backup my 2FA tokens using TiBu (encrypted locally and uploaded straight to cloud services). I'm 99.9% sure I'm never going to lose them.

I want an option in my panel that says "do not let me use support without providing a 2fa token".

I would prefer being stuck without being able to login to my server, compared to potentially having customer support allow someone else to access my server.

The answer to "I don't know my password and I don't know my security question/answer" is, "Sorry, for security reasons we can't help you access this account, you'll need to create a new account." This isn't a problem for banks, why is it a problem for tech companies?

Probably because your bank (generally) has a physical location you can visit and complete some other verification process to unlock your account.

With a bank you go into a branch, and show them your driver's license/other official ID, and don't lose access to all your money...

It's harder online when you don't have the same ability to interact face to face.

When you are locked out of AWS you must sign an affidavit and provide photo ID. Seems similar to me.

Amazon has the resources to go through intensive identity verification processes. And so do banks.

Most tech companies (especially startups) don't.

Doesn't this sound like something a startup can come in and alleviate? Anyone have any recommendations for identity verification as a service?

There are at least two such services in Germany WebID[1] and PostID[1] (not to be confused with the older PostIdent that requires identification at a post office).

I haven't used PostID yet but with WebID you basically have a Skype video call where you show them your ID.

[1]: https://www.webid-solutions.de/en/ [2]: https://www.deutschepost.de/de/p/postid.html

Oh, there's nothing new about that. Startups have identified and entered the space long ago, and the survivors have grown.

So KYC as a service is certainly a thing, and I know of two: Tracesmart & Onfido.

I have a few bank accounts with banks that don't have branches. To "verify" your Id they ask you questions from your credit report - which can be problematic. "What was the payment and term on a loan you had 5 years ago?" Fuck if I ever knew what the payment or term was, I didn't care when I took out the loan, I had my own payment schedule (I think if you can't pay back a loan [with the exception of a mortgage] in a year or two you really can't afford the loan...). Some of the stuff I just plain can't remember!

The best was when they asked me which model of car I had owned... and listed two cars that I had owned... I could only select one.

These records can be flat out wrong too. The DMV associates a car with my address that I don't own, for example. I think this happened because the owner never changed their address with the DMV. Or someone could have just fat fingered something which gets populated to other databases with data sharing.

Well you can go to the bank with your ID if everything else fails

Of course that might not be even necessary as there have been reports of people withdrawing money or wiring it somewhere with not even that (but the bank has legal responsibility)

I agree. With banks, if you need to prove identity remotely, you need to get a medallion signature and a notary. Takes time and money. I assume that web businesses would be happy to have to do that in return for robust security not easily broke via social engineering. I think it would even be a competitive advantage. If you want cheap and easy (and insecure) then you can use a competitors offering.

With MTGO above I had maybe $500 in virtual stuff on my account. As the gatekeeper I'm not sure that would go over well.

With servers a similar thing. Say my only copy of a database is on my VPS. May have a business value of $50k. Can't really just say no unconditionally. Need some process to unlock..

> This isn't a problem for banks, why is it a problem for tech companies?

Banks have the option of you physically going into the branch and identifying yourself with relevant legally backed forms of ID. That would not really work for most online companies.

Other methods which involve sending in copies of ID and/or letters signed by appropriate notaries would fail due to human engineering too because your average tech company isn't going to have people sat ready who are capable of accurately verifying this information.

The other problem is PR: due to the lack of another option the average person who is locked out of their account will instantly turn to twitter/facebook/any-where-else-they-can-post and scream as loud as they can that they've been mistreated by company X. Many other average persons will take this at face value without checking the fats and start avoiding company X, or worse bombarding them with communication in support of the inconvenienced user.

Banks don't try that hard. One of my bank is happy to resend me a password by snail mail with an account ID reset by phone.

Also, rechecking the ID of a user can be as simple as asking for a new token payment by the same credit card as used by the account. It's not infailable, the CC can be compromised as well, but it should be way better than what we have now.

> One of my bank is happy to resend me a password by snail mail with an account ID reset by phone.

This is excellent security, as long as they're not sending it to an address you provided over the phone when you requested a reset.

> Banks have the option of you physically going into the branch and identifying yourself with relevant legally backed forms of ID.

Not always true! Less than a month ago I needed to login to my Wells Fargo account. Unbeknownst to me, they had been doing some 'upgrades' and there were some glitches. After a frustrating period, I decide I'd just go to the physical branch 1/4 mile from my house and get this fixed!

On site, the bank personnel have access to exactly the same system that I did. (At least they knew there were glitches and sorta how to work around them.) I had two accounts, one for a credit card that I rarely used and my mortgage. Turns out, if you have a credit card then the new system requires a piece of information only found on the physical card - the onsite employees couldn't get around and neither could their call-in tech support!!!!

Point is - for log-in purposes - don't assume going to a physical branch will be any more helpful!

Since I didn't have the credit card with me ('cause rarely used) I canceled the rarely used credit card and was able to login shortly thereafter.

There are quite a few banks that don't have physical locations you can go to.

Actually, this could be an interesting and lucrative side business for banks, identity verification. You could have varying levels of verification, requiring varying levels of authenticating documentation and numbers of employees to review and vouch that could then be used to provide a certificate of verification for a service.

E.g. namecheap.com generates verification ticket item requiring valid identification and SSN that Bank of America then uses to verify your identity for $30, and vouched for the identity. Meanwhile Goldman Sachs generates a verification ticket requiring much more strenuous authentication, and the bank charges $200 for (with increased insurance, etc), which satisfies the much higher validation standard the Goldman Sachs requires to authenticate you for your ritrement account with over $X in it, etc.

Reply on news.ycombinator.com