7

Internet accounts nearly always use email addresses as the way to logon. If you forget your password, it is often easy for anybody to just request a way to reset the password. So assuming you have one email address with many common website accounts, once someone hacked into your email address account, they would be able to control many other accounts.

Is this something we have to just be careful about by being cautious with where we login and using good passwords, or are there common tactics from user and website perspectives to combat this?

Improve this question
4

Two factor authentication solves most issues.

Ideally we would be using more than two, but that is what the web is currently built around. Enforcing the use of not only a password, but that with something the user has (a smartphone/tablet), security for the respective account is increased. Not only does the attacker have to breach the account, but also the portable device.

Steam, a gaming platform, allows users to tie their account to a mobile token. This generates a one time series of characters and numbers that must be entered when logging in.

Google uses it's own system, the Google Authenticator, which is leveraged off a Time/HMAC based One-Time password system.

While most attacks on the internet are done from a very remote location compared to the user, a hardware token does not solve the problem that a local attacker could simply enter the code. This is where biometrics come into play, but aren't integrated into the public internet as of yet.

Web Links:

https://support.steampowered.com/kb_article.php?ref=8625-WRAH-9030

http://www.techrepublic.com/blog/google-in-the-enterprise/use-google-authenticator-to-securely-login-to-non-google-sites/

Improve this answer
6
  • Agreed. This is why 2FA was invented. Whenever available, enable it. If not available, consider switching to a service that offers it. Else, use the strongest possible passwords. Which means you also need to do the same thing on your email accounts. – schroeder♦ Jan 22 '17 at 8:26
  • 1
    I should also mention, do a search for a respective website using plaintextoffenders.com as there is a surprising list of sites that can somehow "magically" email you back your original password. – dark_st3alth Jan 22 '17 at 8:30
  • Well, you could also mention that 2FA is much less reliable than many people think for one reason: phone companies are not careful enough! In the last years there was (is?) a guy in the US targeting specifically big youtubers. He was able to access their accounts by simply going to the phone company, impersonate the guy in question and telling them that he had lost the phone and obtained a new sim for the same number, and used it to obtain access to the email accounts and all other accounts. The same can happen to you... I'd much rather be able to use a yubikey instead of a phone as 2FA. – Bakuriu Jan 22 '17 at 12:53
  • @Bakuriu that's only relevant of the 2nd factor is an SMS code. This vector is known to be weak (and NIST advises against it). The idea now is to not include SMS as a 2FA option. – schroeder♦ Jan 22 '17 at 12:59
  • @schroeder Unfortunately most websites provide only SMS as possible 2FA... – Bakuriu Jan 25 '17 at 7:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.