Hacker News Reader

Comment by Aachen | Hacker News Reader

If someone registers on my website with the same password as in LinkedIn, then LinkedIn gets hacked overmorrow, and the attacker then logs in with the correct password on my website, what should I have done to prevent that successful login to this user's account?

We can get angry and make jokes about 23&Me but I don't know what people would expect of me here; what solution I ought to implement as someone who runs several websites as hobby projects

This problem is also one of the reasons why I'd not recommend doing such a DNA test with a web service...

Edit: could I know why a moderator pinned this comment to the bottom? It got votes and was at the top for a few minutes, but now sorts below literally every other comment, also greyed-out ones and downvotes are starting to appear (maybe by association because it's at the bottom?). What should I have written differently to not get moderated away?

View on HN

23-and-me could implement something like Troy Hunt's K-Anonymity API. The password is hashed, then the first n characters are sent to the API. The API then returns the count of times that password has appeared in data breaches. If the result is >0, the user's account is blocked until they've gone through a forgot password journey.

23-and-me could probably check if large numbers of people have all tried to sign in from common IP addresses within the space of a few hours. Even checking their login APIs for enormous spikes in unexpected traffic too.

The requirements for your hobby projects are different to that of 23-and-me, but you could potentially implement a similar feature too.

The password may not be known to HIBP at the time it is registered. This will very likely be a large enough fraction (>0.2%) that you can still get into sufficient accounts to access plenty of relatives' data.

> could probably check if large numbers of people have all tried to sign in from common IP addresses within the space of a few hours

That doesn't work, see my sibling comment where I did the math on what authentication rate you'd need to trigger at https://news.ycombinator.com/item?id=39116531

>The password may not be known to HIBP at the time it is registered. This will very likely be a large enough fraction (>0.2%) that you can still get into sufficient accounts to access plenty of relatives' data.

To be clear, the password can be checked at login-time, rather than registration-time, at which point the service should send the user through an account recovery process. There's still scope for passwords not appearing in the HIBP dataset, but it's massively reduced.

Do you mean this link: https://news.ycombinator.com/item?id=39116531 ? I'm not sure I agree with your conclusion. You should be able to successfully highlight a unique IP address making ~4,400 discrete login attempts across a month as suspicious - and further highlight that there are 1,000 other IP addresses behaving in the same way. Most users login from a handfull of predictable IP addresses, and most IP addresses login with only a couple of predictable accounts.

These types of login analytics aren't beyond the ken of man, and a service like 23-and-me should definitely not be able to allow 4.4m attempts and 14k successes from a small set of IP addresses without it raising some internal alerts.

With CGNAT as in Italy or daily forced IP changes as in Germany, I'm not sure that it's true that most people log in from a predictable set of IP addresses. Perhaps one could indeed establish such a pattern in some countries like the Netherlands, and establish a set of ISPs per account for customers in other countries.

I must agree, though, about your point that 4k different logins from the same address in one month would be rather high for their customer base, so the limit could be lower if you allow enough bursting. What do you do after that, though, block them outright if you suspect a bot? That's going to block real users also. Give it captchas? Besides people also hating those, one can have someone in Bangladesh solve them if modern neural nets don't get the desired solve rate.

I guess the overall solution will have to be 2FA and, indeed, some long-term rate limit beyond which they'll have to give users captchas (to at least increase the cost of an attack), and some upper bound beyond which it gets outright blocked.

"You're logging in from a new device. Please check your email for a verification code."

"You're logging in from an unusual location. Please answer your security questions to continue."

"We've sent you a text message with a code which is valid for the next 10 minutes."

"Press OK on the 23andme app to continue."

"Please enter the code shown on your 2-factor device."

As a user, you can be blamed for poor password practices, but if you're running a service, it's basically a given that some percentage of your users are going to re-use passwords and it's your reponsibility to mitigate the fallout from that. If you don't enforce 2FA then you can check for unusual things about the login, such as change of IP address, browser, or device. Yes, it's not foolproof like 2FA, but it doesn't need to be foolproof to be useful.

All of these quotes are saying to use 2FA (besides security questions, which are a horrible security measure: https://security.stackexchange.com/a/224271/10863). That sounds like a good suggestion, though it costs business because it adds friction. Maybe now that they need to save their reputation, and they're an established business with plenty of customers already, it makes sense for them to add, but a new entrant to the market would simply not do it and I'm not sure whether they can be fully blamed in a competitive market

I'm sure people would complain about most of those on privacy and/or antitrust grounds.

> "You're logging in from a new device. Please check your email for a verification code."

This site is keeping track of all the devices I use, which is not necessary to provide their service.

> "You're logging in from an unusual location. Please answer your security questions to continue."

They are also tracking my location, which is not necessary to provide their service.

> "We've sent you a text message with a code which is valid for the next 10 minutes."

They make me provide a phone number, which is not necessary to provide their service.

> "Press OK on the 23andme app to continue."

They have a perfectly good web site, yet they require me to use their proprietary app (which requires me to have an Apple or Android phone or tablet). This is not necessary to provide their service. They are probably getting paid by Apple and Google to try to force people to have they devices.

Forced 2 factor authentication for critical biometric data.

How critical is this data, really? What could an attacker really do with my genetic profile?

The genetic data could be sold to a third-party that exists outside of any regulations. 23andme allows download of raw data. So its not just genetic profile.

Assume everyone breached now has their dna linked forever with their marketing data graph.

It will be sold and resold so eventually your TikTok feed will be influenced by your genes.

Tiktok know what videos you have watched and liked which is all the targeting data they ever need. They don't need or want your genetics. And even if they did, better Tiktok targeting isn't something that would make me worry enough to not make my password "abcdef".

Advertisers need your dna to sell products that are applicable only to certain dna. Or for higher probability (ie, Alzheimer’s genes).

1. Find relatives you didn't know you had and inform them of the fact, perhaps destroying families by revealing long-concealed/previously unknown secrets

2. Identify DNA sequences and genes associated with various diseases, then contact you AND your relatives to advise seeing a doctor and consider using drugs made by the new owners of your genetic data

3. Sell your data to insurance companies who would pay plenty for early evidence of breast cancer likelihood or Huntington's Disease so they can avoid insuring you

Thinking that large companies are going to buy black market genetic data and deny your insurance is completely unhinged. Not only would they never do it because they would instantly get caught and sued into oblivion, the health insurance industry is actually incentivized against cutting medical costs because of the statutory maximum of 20% gross profit on premiums in the ACA.

>Private equity wants to own your DNA

https://www.cbsnews.com/news/blackstone-private-equity-ances...

This is an acquisition of a company and has nothing in common with a data breach or purchasing stolen data on the black market.

>Theoretically your insurance companies or employers won’t be buying this information off the black market.

"Theoretically" is the operative word here.

https://www.yourdnaguide.com/ydgblog/dna-data

How would you do this for historical accounts? 2FA needs to be set up by users. It has gone through multiple iterations over the past 2 decades and was not always standard practice. 23andme was founded in 2006.

Force them to change their password, prevent use of the account? If it’s a dormant account, force a password reset using email?

Doesn’t feel like an unsolvable problem, certainly not one without edge cases but surely we can hit 80/20 without too big a hassle.

The thing is, attackers don't need 20%. The article says they used 14k accounts with previously cracked passwords to uncover data of 7 million customers: that's 0.2%

Doing low-hanging fruit isn't enough here. Honestly I just don't feel like the time is right to build such big DNA databases yet. Maybe one day with quantum encryption (can't observe the state without modifying it) or whatever else we may figure out, but today it just seems like you're taking a risk for yourself and half a dozen layers of relatives

You show popup "are you hacker?". If somebody lies, it's not your problem, right?

I’ve had sites that do forced password resets and other annoying things when I come back after years.

23andme bears responsibility more than users like banks bear more responsibility for customers choosing stupid pins. DNA info is valuable they need to design good safeguards.

Yahoo for one: I didn't mind.

Send out increasingly loud notices ahead of time, and try to come up with a secure recovery procedure for the many customers who will fail to react to them. It's not going to be cheap. But losing some kinds of data should be even more expensive.

1. Disable the account from further access.

2. Send a postcard to the billing address where you signed up (verified against credit reports) with a one time verification code, upon which some second factor is set up. Maybe put 20 "rescue codes" on the postcard too, if you like.

3. Force user to enable some sort of second factor authentication on their next login.

Imagine a service you paid for locking your account and sent a postcard to an address you haven't lived at in a decade. What a great user experience!

if you paid for a service, the onus is on you to keep your information updated with that service.

Do you actually update all your address in every service the moment you move?

Ones I care about, yes.

We don't have satisfactory 2fa solutions for consumers yet.

Sure we do. Mail a postcard with codes. Problem solved.

We have different bars for satisfactory.

Why should someone who is able to choose a strong, distinct password for each service (and keep it safe) be forced into an additional inconvenience.

I think this is a more broad issue, how do you give the same service for all users, regardless of their level of experience.

Because I have no way to verify that you never reused or leaked your own password anywhere. And because your genetic data isn’t just your own. It is shared by your kids, your parents, your extended family.

I’ve never used 23andMe and yet I’m involved in this breach. How is that a fair shake?

“I’ve never used 23andMe and yet I’m involved in this breach.”

How were you notified? I’ve never used the service but wondered what shadow profiles they may hold.

If you have any blood relatives who signed up with 23andMe then you are automatically involved, even if you've never heard of 23andMe.

I hate this. I hate that 2fa is becoming mandatory for more and more services because people can't be arsed to keep their passwords secure. I hate having to look at my mail to copy a stupid code every time I log into a website. Please don't do this.

Use passkeys then. Works great for me.

1) Is it free?

2) Is it supported by all websites and apps I use?

3) Is it supported by all devices I use?

Until the answer to all of those is "yes", passwords will remain superior.

To try to answer my own question, I suppose they could try detecting elevated login rates. Let's do the math:

Getting a few thousand IP addresses for a month is cost-effective for any serious business (criminal or otherwise, but especially criminals that can buy botnet access). Spreading it out over a month, you could do 0.1 logins per minute to stay under the radar and get:

0.1 × 60 minutes × 24 hours × 30.4 days/month × 1000 IP addresses = 4.4 million login attempts

> The [attackers logged in] to around 14,000 accounts using previously compromised login credentials

14k is well below 4.4M. To get that number lower than 14k (assuming they only ever use 1000 IPs), you need to ensure each IP address stays below 0.07 logins per day. Even allowing some bursting (3 attempts on some of the days), that's going to block paying customers from logging in.

- They could have used HIBP to prevent people using exposed passwords

- They could have detected elevated authorizations

- They could have forced 2FA

- They could have implemented password stuffing protection

Any security assessment would have pointed that out. In fact, when I had my own site pentested the very first time, this was exactly what was pointed out and I promptly fixed it.

But it's all moot, since the attacker used a feature of 23andme to access data on other people whose account info they did not have. And that is squarely on 23andme.

- The password may not be exposed at the time it is registered

- That doesn't work, see my sibling comment where I did the math on what authentication rate you'd need to trigger at https://news.ycombinator.com/item?id=39116531

- 2FA sounds like a good suggestion, but is bad for business so they'll never do it voluntarily (maybe now that they need to save their reputation)

- Isn't that the three above points combined? Or what does "credential stuffing protection" amount to?

---

> Any security assessment would have pointed that out.

I don't think you're familiar with security assessments

That's what I do for a living and we'd have recommended only the first one because it's a simple thing you can implement on the server. About 1 in 10 customers actually follows through on that hardening advice to some extent (e.g. by downloading a top 10k passwords list or adding zxcvbn), even fewer use a huge database like HIBP even though we recommend that.

We don't recommend 2FA for all users (only for administrative accounts) because clients never implement it. Adding suggestions that are seen as unrealistically paranoid makes the rest not being taken seriously anymore

We also don't buy a botnet and simulate credential stuffing attacks. Maybe we should, but then we'd need the customer to deploy not one staging system with two test accounts per permission level but thousands of accounts, and some way to simulate having thousands of residential IP addresses.

These things are not standard procedure and I haven't heard of any other pentest company requesting such a test setup (based on working together with other companies on one scope, chats at conferences, or looking at public pentest reports to see their setup or if they ever reported this finding)

> - Isn't that the three above points combined? Or what does "credential stuffing protection" amount to?

In our case, we track authentication attempts by IP, even successful authentications. If too many authentications come from the same IP in a short time, even over multiple accounts, we start throttling them first, then denying them. I'm in the B2B SaaS space. We know our customers, our typical load, and we have carved out exceptions for certain large clients with known IPs.

Thanks, that's actually valuable to hear from someone who actually implements this!

They have to know what normal access patterns look like, and if it looks unusual send confirmation magic links as well as look into what’s causing the unusual pattern, if anything.

The data they guard is up there with banking information except it’s impossible to restore privacy, unlike funds in a bank.

What features would you include in "look like"? Saying to just look at "normal behavior" is a bit like Intel saying they solved a problem with "algorithms and code" as an explanation

Reply on news.ycombinator.com