Hacker News Reader

Comment by chjohasbrouck | Hacker News Reader

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it.

I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break into. If everyone knew, we'd be living in chaos right now, right?

View on HN

Could you give an example of how it is possible to take over an email account just by having an e-mail conversation with the owner?

me: Hi Mate, what is your email password?

email recipient: Pasword123

me: thanks.

JOB DONE :-)

Well, I was hoping for something at least a little bit more sophisticated.

Nah... it's brute force all the way down. Scammers aren't brilliant men in dashing suits who swindle bankers, they're assholes who prey on the weakest. The second you do something that doesn't mark you as weak in some way, they don't want you anyway. It's the human equivalent of scanning large IP blocks for basic security holes.

I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total strangers.

I think if I had a casual conversation and they started asking what was your pets name, where did you go to school etc I'd think it a bit odd. As an aside I usually have to write down the answers I've given in a word doc and look them up if I need to do that stuff as I can't remember which memorable place it was and the like.

Really? I'm sure it would seem odd if someone just ran down the list of questions, but I suspect you could easily maneuver the conversation so that a casual acquaintance answers one or two of them.

"Hey, how are you?"

"Pretty good. We're thinking about getting a dog so I went to the shelter this morning."

"Oh really?"

"It's tough to find one that's a good match though."

"Definitely"

"You ever have a dog?"

"Nah, wife's allergic. Had a snake as a kid though...called him Mr. Slithers."

You could build a chat bot that does that.

Man I hate those security questions with a passion. They are super weakly protected backdoors into your account.

Here's how I deal with sites that require them:

site: "What is your first teacher's name?"

me: "'Fx|<n8K@W8#[_,[ (1p)jqPC"

The answer is a password equivalent, so I just treat it like a password.

Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!

That's just appalling.

Yep. I believe when I created my account, I picked ones that were definitely not real answers, ie. "What's your favorite sport?" answer "lawn darts".

Even if you picked a fake answer, that doesn't stop someone from brute-forcing it, which is made very easy by the limited range of possible options.

Any social engineers reading this? :)

Just give the wrong answer and keep track in your password tracker. At least social engineers can't figure that out.

Contact their tech group and then contact their CEO and show them this article. :)

Someone pointed out that if you talk to a CS rep and try to say that off, they'd just hear gibberish- meaning if someone tried to get at your stuff, they would just have to spout off gibberish and the CS rep would probably accept it.

If you can do this, it seems weird you would ever need to contact support for help. If you can keep the security answers safe why can't you keep the original password safe in the same place?

Or is this for when the account is locked for some random reason?

To me, the scarier idea is how many of these answers are now online. Mother's maiden name and other family names can be gotten from wedding notices or obituaries. For a teenager, the first job / school / car / concert are probably all available on Facebook. Even without the Internet as a backup, I could probably answer the security questions for 2-4 of my childhood friends.

This exactly why all my e-mail passwords are at least 18 character long with random generated gibberish stored on a keychain... And to secured that keychain I use a very long login password (XKCD style + numbers) that always make people cringe.

In return I assert a well deserved facepalm when I see a friend log in on his e-mail account with a variation of "Password1".

That sounds like a very tedious thing to go through to login to your email.

Just use a strong password ( https://xkcd.com/936/ )

The funny thing with having email as a username is, how sometimes people can use social engineering to gain control of your account, non of that fancy "hoaxer" stuff are needed when your service providers put untrained people in charge of your accounts. Hacking human stupidity is a more effective way in to get in to a secure system.

( as an example, this was on reddit just yesterday https://www.youtube.com/watch?v=lc7scxvKQOo )

Nope I mean I kinda never login to my mail through unknown browser. My smartphone is just good enough when I can't access my computer, so there is only three places where my long e-mail password is stored. Keychain on my computer, keychain on my smartphone and backed up encrypted keychain in my cloud account. So it's highly unlikely that my e-mails get compromised.

Also worth mentioning my e-mails are not hosted on gmail or any big cloud player. I actually pay for my imap, when you don't pay you probably in some way are the product...

Paranoid? Maybe

Safe? More than others

"If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it."

Not if they self provide their own email (by running their own mailserver).

The same security question nonsense happens at server/VPS providers too.

You can run a email server off a raspberry pi these days.

Not if you want other people to read your email, its going to go right to their spam filter.

Why is this?

A lot of spam filters filter everything that's not a common, or is a very new, tld.

Spammers are the ultimate Sybil attackers. Setting up a useful SMTP server as an individual, and creating a new non-blacklisted identity as a spammer, are effectively the same task. The community of legitimate email providers has responded (quite effectively, and without too many false positives) by making this as expensive, difficult, and time-consuming as possible.

Emails from residential modems are not even worth scanning - they are practically guaranteed to be from botnets. Emails from commodity hosting providers are also pretty suspect, because they're very easy for spammers to get their hands on.

If you want your mail delivered, you need to send it from IP addresses that don't have those obvious red flags, don't have a reputation for sending spam any time in the distant past, and also have a long-term positive reputation for sending non-spam email.

In practical terms, you need to be in the professional mail server administration business full-time (be extremely careful to shut down abusive customers/tenants rapidly, never make a mistake that would let an attacker run an SMTP server on your network, etc.) or you need to pay someone who is, and who trusts you to cloak yourself in their reputation and not ruin it.

Because 99.99999% of the email coming out of residential IP addresses are spam so they are just blocked.

And that’s why I host all my email myself, and have my VPS with no password login (only key auth), and have 2FA enabled for the VPS control panel at the hoster, and have 2FA enabled for any change to the domain requiring a letter to be sent to me.

You should use a dedicated server instead of a VPS if you're concerned about privacy.

With a dedicated server I’d have more privacy, indeed, but already with a VPS with encrypted data that requires me to decrypt manually by entering a password upon restart via ssh to start the actual email service I gain a lot of privacy.

What type of virtualization is it? OpenVZ?

Please let this meme die. There are very few people left in the world that truly believe that hypervisors are leaking your pii all the time.

There are many different types of virtualization. Most of them use disk images, meaning someone can read (or even write to) your disk without you noticing.

Some of them are lightweight virtualizations where a priviledged outside user can run processes inside the VM without requiring authorization or without being logged.

How is this a meme that needs to die?

Reply on news.ycombinator.com