Hacker News Reader

Comment by kabdib | Hacker News Reader

Google's response _The attack presupposes a compromised password, and the actual vulnerability appears to lie in the fact that the Telcos provide inadequate protection of their voicemail system. Please report this to the telcos directly._

... is reprehensible. It's a problem with the design as a whole, Google's customers are going to experience the flaw, and just passing the buck doesn't make the problem go away. I'm really disappointed in Google.

View on HN

You cherry-picked one line that is not representative of Google's response.

Google's final response was: "[we] have filed a bug [and] will [...] take a look", see my coworker (Jeremy)'s reply from May 6 at http://static.shubh.am/2fadisclosure/google.pdf

Clearly there was initially a simple misunderstanding/miscommunication. The reporter, on April 30, gave Google a few Australian telcos presumably vulnerable. But then he clarified on May 3 that it is actually at least "a large majority of telco's in Australia and UK" that are vulnerable. So, based on this new information, Google replied "Thanks for explaining the potential scope of this issue... [we] have filed a bug".

I mean, compare this to the way it was reported to Facebook: the reporter told them right away that 2 of the top 3 telcos in Australia are vulnerable(!) Now if it had been worded like this when first reported to Google, the misunderstanding would probably not have happened.

Vodafone is the world's second largest mobile telecommunication company behind China Mobile. It is sloppy of Google to not recognise this name, as you suggest happened.

"I have filed a bug" sure sounds like a brush-off to me, especially when combined with the tone of the rest of the reply (which basically reads "Not our problem" -- while it might not be Google's own defect, it's definitely a problem for Google, and one that requires mediation).

All security reports receive a "I filled a bug" after a bug is filled.

https://www.google.com/search?q=%22Nice%20catch!%20I%27ve%20...

Not a brush-off.

The entire point of 2FA is to make password compromise insufficient to gain access to an account. Which makes this response just baffling.

I initially thought that the lack of any technical countermeasure might be a legitimate reason for Google to do nothing, but after I thought about it for a moment, I realized that when the 2FA system calls the user, it could simply prompt the user to do something before sending the verification code -- that way, the 2FA provider knows they aren't sending the code to voicemail.

Simple and effective, and later in the post I found the author and multiple companies came up with that idea on their own.

Better yet make them repeat something (a nonce in the form of dialtones) back to prevent replay attacks in the form of recorded responses (as was also pointed out in the comments there).

Why? How is that a Google problem, when you use voice as your backup password system and you're not securing it properly?

Most people are not aware of the attack vector (spoofing the phone number to reach the voice mail).

As a large company that serves millions of users in many of their most sensitive online endeavors, is it more responsible to throw your hands up and hope that many of the hundreds of telcos out there will fix their own security, or implement a relatively easy fix that will automatically secure all of your customers from this issue regardless of third-party security?

Reply on news.ycombinator.com