Comment by miles | Hacker News Reader

Comment by miles | Hacker News Reader

"Here’s the thing, in order to get into a StrongWebmail account, the account owner must receive a verification call on their phone. This means that even if your password is stolen, the thief can’t access your email because they don’t have access to your telephone."

Great. Users will love receiving calls at all hours as script kiddies in Russia try to log in to their accounts.

"Break into my email: get $10,000. Here is my username and password. Username: CEO@StrongWebmail.com Password: Mustang85"

Great! Let's give it a go:

  Error Logging In

  We could not log you into your account because of the following error(s):

  The username or password you entered is incorrect, or your account has been suspended/closed.

Guess the $10,000 is safe and sound.

The initial page log in with the filled in username/password is also a lame setup.

There is no data sent to the sever when you enter a test authentication code, it just automatically says "Invalid code"...

But look at how much free press they are getting.

Indeed! Since the username and/or password are invalid anyway, why not make it a cool million dollar contest? Or for that matter, a billion? Perhaps it would be a trifle TOO obvious.

The CEO username and password work for me. I've checked the obvious stuff and they have that covered, so it won't be an easy $10,000. But I'm sure no system is 100% infallible :)

I'm guessing that as many people as are probably trying to log into his account, he probably doesn't answer his phone any more, or even use that email account. How would he know if the access he just authorized was him, or someone else?

Maybe if they texted him a code he had to type in, it would be more secure, but then it would be simple enough to brute force all of the codes, or find the seed and generation mechanism.

Reply on news.ycombinator.com