Hacker News Reader

Comment by kevinday | Hacker News Reader

Previously: https://news.ycombinator.com/item?id=16412541

It sounds like they distributed a tool that goes through your Chrome saved passwords database and if the installer thinks you're a pirate, it sends credentials from that database back to the author. The author is now saying they used credentials they learned from this to break into a private website to learn more about how their DRM was being bypassed.

This seems so incredibly illegal, I can't believe they admitted that this is what they're doing.

View on HN

Never trusted browser saved passwords. One of the first things I disable after I install a browser. Also disable saving form data

Why? I mean, what could ever go wrong with storing highly sensitive credentials, form data, and usage history in the same app that automatically and promiscuously downloads and executes code from the internet?

Even if you don't save passwords in Chrome, malware can still keylog you, or steal your password from whatever other password database you use.

That's what hardware-backed crypto protects against. Passwords on their own is a bad security practice.

A tiny dedicated computer like Tomu[0] that fits into your computer, that provides authentication (and similar cryptographic functionality), with inpedentent input (touch) to receive manual ACKs and output (led) to provide feedback, with no other functionality, is a cheap, reasonably safe, and convenient solution. Maybe unlock it on boot (and after timeout) with a password/PIN for good measure.

[0] https://www.crowdsupply.com/sutajio-kosagi/tomu

This sort of thing is awesome in theory, but in practice it kinda sucks, and will continue sucking until it becomes a first-class feature in the eyes of browser and desktop environment developers.

Currently I'm using Chrome backed by KWallet backed by PGP key on a YubiKey 4. Upon launching Chrome I have to authenticate with/touch the Yubikey to unlock my session, which is spiffy, but after that seemingly random pages (even in an incognito window) will prompt Chrome to unlock my keychain. The Yubikey will flash, indicating something wants access to it, but I have no indication of what that something is. If I ignore the flashing, eventually a KWallet window pops up complaining about being unable to use the GPG key.

What you are describing is a specific scenario based on specific solutions. I see multiple things going wrong there.

Chrome shouldn't access your credentials without telling you what it's used for. Chrome shouldn't expose cryptographic identities in incognito mode. The Yubikey's output is vague.

What can we learn from that?

Chrome has shortcomings in this domain. Just one monochrome LED is maybe not enough output to give reasonable feedback.

My online banking security system is called chipTAN and uses a small, monochrome, low-res display to give essential information for what is being processed which I need to acknowledge. That works well, but is also a single-purpose solution.

For identification on the internet, a solution based on GPG seems reasonable. Imagine a small display that shows the receiver you are identifiying to, the identity you are using, and for how long the identification is valid, and then you can acknowledge that.

I just discovered U2F with touch/LED is $11. https://amzn.com/B01LZO0WE9

That only works if the website you're logging into supports it. I highly doubt thewingmen.info or avolatvolavitdescendit.com support that (they don't even have https!). Also it requires your browser to support it.

And even then, malware can still just steal your cookies.

What usable alternative is there?

Train your memory.

IANAL. While the entire scheme looks to be clearly unethical, the only part that strikes me as illegal was the use of credentials to log into the online forums/services.

IANAL but AFAIK stealing data, even without using it, is illegal per se in the EU, where this company is based: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...

IANAL but, assuming taking the data happens after the user agrees to the license, there is no stealing of data.

So if I put some small text into a 100 page EULA that says I may break into your house and take whatever I can carry, then I only have to make you click-through and I'm all set? Awesome.

Unfortunately for me, things don't work that way. For most of Europe at least, you'd be perfectly justified in treating my 100 page EULA like the garbage it is and basically ignore everything in it that isn't already prescribed by law anyway.

Your example is not persuasive. There are perfectly enforceable EULAs that contain terms potentially far in excess of the value of your home and all of its contents. And there are enforceable EULAs that contain rather onerous audit provisions. And in this case, it is hard to see the comparison to physical action.

I am not familiar with the flight sim license in question, but there are a number of general terms it might contain that would allow for the collection behavior. Telemetry, anti-piracy, anti-cheat, audit, fitness of purpose, and many other provisions could cover this particular behavior.

Further, if their claims are to be believed, they only initiated this action against a someone in already in breach of contract, so the law isn't going to protect the pirate anyway.

Again, I think the company's behavior is unethical - they should have contacted law enforcement. But illegal? That is not at all clear.

EULAs are not generally enforceable nor legally binding at least in Europe. I personally have acknowledgment in a legal dispute that parts of even a signed contract were void and invalid because they were considered an EULA (AGB).

No, click through EULAs are not always enforceable. But generally, EULAs are certainly a valid and enforceable form of contract throughout Europe - how else would things work, if not through a contract describing an agreement with the end user to license the software, i.e. an EULA?

An individually negotiated agreement that fulfills all the legal requirements of a contract is a valid way to ensure enforceability.

But just repeating a part in many contracts is enough to make a court say that it is not individually negotiated and is therefore treated differently (AGB in German).

A seemingly endless text wall with non-negotiabile terms that is considered agreed to by a click on "I have read this and agree to it" might only be binding to very limited extent, if at all.

In my contract I mentioned a part was considered invalid because it was an issue that cannot be agreed to in an AGB, and the part was considered to be sufficiently AGB-like.

To give another scenario, someone offers me a proprietary software. I don't know the terms and condition but I know that I need to pay for it. I then pay and receive the software. Upon starting it, it presents me with terms and conditions I need to agree to. In this scenario, the terms and conditions in the software are entirely void because the contract was established when the software was exchanged for money and the terms were not agreed to at that point. Only what is agreed to when the contract was established counts. If the software doesn't work for the intended purpose, I am free to modify it such that it does.

Sure, that's right, and my point was pretty much the same; any EULA that the end user is forced to or has to accept automatically is invalid, such as click-though or shrink-wrap licensing. It's really just the terminology, since EULA has a much wider meaning here, I think.

IANAL but I don't think a SW license can have the provision where they say that they will take all your Chrome passwords without your consent and transmit them over a non-secured connection [1], and still be considered legal, at least in the EU. Some protections and rights can't be waived in a private contract, even if both parties agree[2].

[1] https://www.fidusinfosec.com/fslabs-flight-simulation-labs-d...

[2] https://en.wikipedia.org/wiki/Data_Protection_Directive#Prin...

Clicking a checkbox is no legally binding agreement.

Parts in a contract can be void even if agreed by both sides.

They're claiming that they're pirates, i.e. that there is no valid licence that they would've accepted.

In that scenario, the user has committed copyright infringement (i.e. it can/should result in a civil claim and a fine). If what is claimed has happened (the company used the passwords retrieved from pirates' computers to access private websites of those pirates), then the company employees who took and used their passwords have committed a crime (i.e. it can/should result in arrests and jail time). Many of the things that police can and will do in an investigation are crimes if you do try to do it yourself. The fact that your target seems to have committed a crime doesn't justify crimes against them; and they are innocent until proven guilty.

Those acts aren't comparable; what the company seems to have done is on a much higher level of illegality than software copyright infringement.

Put it this way, if Microsoft or Facebook or Google or Apple released an update which squirreled away your stored Chrome passwords and uploaded them, there'd be a torch-and-pitchfork mob out for their blood. It would be totally unacceptable for a big player to act like this and being a smaller player doesn't grant any free passes.

One illegal part is sufficient. I agree that the other parts might be debatable, but the actual use of stolen credentials has clearly crossed every line. If they had passed this information on to a police investigation that then would've used this with a warrant, then this might maybe work (the admissibility of evidence gotten this way is tricky - maybe it is, since it's not the authorities that obtained it illegally), but if they themselves used those credentials, then I hope that the employee who did it understands that "boss told me to do it" isn't a sufficient defense in criminal prosecution.

I mean, the apology seems legit and it's not that likely that anyone will press charges, but it still is a quite stupid risk that they've taken. In many cases "hack-back" may seem a practical alternative, but it's not, because it tends to be absolutely illegal (well, perhaps not if you're in NSA or something). Hopefully this case will be sufficient warning for others.

Reply on news.ycombinator.com