Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #2348 > unrolled thread

When two-factor authentication isn't enough

Back to article view | Back to comp.misc

Contents

  When two-factor authentication isn't enough RS Wood <rsw@therandymon.com> - 2014-04-10 11:46 +0000
    Re: When two-factor authentication isn't enough "tdk" <forum.tdk@squte.com> - 2014-04-11 12:05 -0500
      Re: When two-factor authentication isn't enough Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-04-12 08:51 +0100

#2348 — When two-factor authentication isn't enough

Saw this on news.ycombinator.com: a great blog post at Fastmail.fm.
It's an interesting story, well-told.

http://blog.fastmail.fm/2014/04/10/when-two-factor-authentication-is-not-enough/

TL;DR: This is the story of a failed attempt to steal FastMail’s
domains.

We don’t publish all attempts on our security, but this one stands out
for how much effort was put into the attack, and how far it went.

We’ve had a handful of minor attack attempts recently. Targetted
phishing emails to staff trying to steal credentials. An NTP-based DDOS
which was quickly mitigated by NYI, our excellent hosting service.

These sorts of attacks are the “background radiation” of the internet.
Along with port scans and entries in the web server logs from malware
trying us out to see if we’re vulnerable to old PHP bugs (hint, we’re
not). It’s the reality of being on the internet.

This blog post was first drafted before the Heartbleed fiasco.
Sometimes, no matter how careful you are, you get a nasty surprise. We
responded very quickly, as always. Anyway, on with this story.

About a month ago, our hostmaster@fastmail.fm account suddenly wound up
subscribed to hundreds of mailing lists. All these mailing lists failed
to use double or confirmed opt-in, so someone was simply able to enter
the email address into a form and sign us up, no confirmation required.
This really is poor practice, but it’s still pretty common out there. A
special shout-out goes to government and emergency response agencies in
the USA for their non-confirmation signup on mailing lists. Thanks guys.
-- 
RS Wood <rsw@therandymon.com>

[toc] | [next] | [standalone]

#2362

 
> All these mailing lists failed to use double or confirmed opt-in, so someone was 
> simply able to enter the email address into a form and sign us up, no confirmation 
> required. This really is poor practice, but it�s still pretty common out there. 

Oops. I do this on my site, you can just enter an email to sign up for updates. 
Luckily I've avoided the trap here http://theoatmeal.com/comics/email (eighth panel) 
and you can unsubscribe without logging in. 
What's the best way of handling this? Is using a captcha enough or do you need 
to have a challenge/response. 
P.S. look at the page source in the link. 
-- 
regards
~tdk
View this thread at http://squte.com/node/5784#comment-23848

[toc] | [prev] | [next] | [standalone]

#2366

tdk wrote:

>> All these mailing lists failed to use double or confirmed opt-in, so someone was
>> simply able to enter the email address into a form and sign us up, no confirmation
>> required. This really is poor practice
>
> Oops. I do this on my site, you can just enter an email to sign up for updates.
> What's the best way of handling this?

Send a single email "Do you want to subscribe? If so click here" ...

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web