Slashdot Mirror
Citing Attack, GoToMyPC Resets All Passwords (krebsonsecurity.com)
Security reporter Brian Krebs writes:GoToMyPC, a service that helps people access and control their computers remotely over the Internet, is forcing all users to change their passwords, citing a spike in attacks that target people who re-use passwords across multiple sites. Owned by Santa Clara, Calif. based networking giant Citrix, GoToMyPC is a popular software-as-a-service product that lets users access and control their PC or Mac from anywhere in the world. On June 19, the company posted a status update and began notifying users that a system-wide password update was underway.
Free demo now!!
If you haven't installed a password manager that generates a unique password for every site, now is a really good time to do it.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
It may be time for these sorts of companies to issue passwords to end users, and forcibly change them every 3-6 months.
These sorts of "hacks" have shown users are simply stupid and untrustworthy, so you remove them from being able to create passwords.
Yes most will write it down, but I challenge anyone in China to hack a post-it note.
At least this way for critical systems, password reuse can be minimised (except for the idiots who go on to use it elsewhere so they only have to remember one password....sigh)
... some of these people doing bulk password resets should collect statistics on how many people simply reuse the previous password. Perhaps they don't want to insinuate that their user base is made up mostly of idiots, so I suppose I can forgive them for not doing so.
When TeamViewer users where impacted, the initial reaction was TeamViewer itself had been hacked. They responded with the claim that users' reuse of passwords where to blame and TeamViewer security had not been breached. The fact an independent remote access software company is exhibiting the same issues seems to indicate that TeamViewer was probably correct that user behavior regarding poor handling of passwords is to blame.
While both TeamViewer and Citrix seem to now be pushing two-factor authentication, they both seem to be using solutions they created themselves rather than contribute to an industry standard method which is consistent for the user across websites. It would be nice as this problem becomes more common that more companies join the FIDO Alliance as this should provide a single method for the user to learn which them works the same across all U2F compliant sites.
I use GoToMyPC.
To access an actual PC through GoToMyPC you need a second "access code" stored on the PC or a RADIUS server.
This password is not stored by GoToMyPC and can only be reset locally. One-time tokens are permitted.
But nothing stops someone from reusing a different password for the access code. And they still could mess up your online account.
People at my company wonder why I ban all services such as these. Because you really have no idea who is in control there, and what might be going on behind the scenes. Use the VPN service we have available where we track and know who is connected when and restrict where they can go.
You can't possibly be this stupid, can you?
GoToMyPC was first released in 1998.
TeamViewer was first released sometime around 2005.
Since then there have been a number of proposed common first-level login standards (OpenID, SAML..) along with second-factor ones (Symantec VIP, U2F...). Phone-based authentication seems to be popular at the moment.
How are companies supposed to figure out if the standard they choose will last? Companies have embraced various standards, only to abandon them a year or two later.
In short: the current state of things is a mess.
Not citing.
Citation needed.
Sightation needed.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Full of exposed user information. Once the cat is out of the bad it's out of the bag and it needs to be acknowledged. You should be able to look up yourself and all your past exposed password so that you can never ever use them again. In fact you should be able to add to the list yourself.
wooooooooooooosh We want 3rd world in this piece. Gimme DRE. It was trolling. Move on to the next episode.
Owned by Santa Clara, Calif. based networking giant Citrix Err, Citrix is based in Ft. Lauderdale, and with the recent layoffs in Santa Clara, it is become clearer Citrix is circling its wagons back to South Florida (for better or worse, time will tell.)
Normally when Dropbox is mentioned and the topic is security it's referring to one of their many spectacular fuckups.
Able to download the files of others by knowing the filename and hash - that was Dropbox when people used this bug as an alternative to bittorrent for a while.
Able to login to other people's accounts without a password - Dropbox was wide open one day with that massive fuckup.
Using the interface to revoke other people's access to your files, getting told that it had worked, then those other people found they could still get the files - Dropbox again.
And that's just the stuff that has had dedicated articles about it on Slashdot.
If you don't want your worst enemy, a potential thief, or your mother to see something then don't put it on Dropbox.
SSH was first released in 1995.
SSH is now 21 years old.
Back in 1994, Telnet (released in 1969) was 25 years old.
Can you guarantee that SSH will still be around in 5 years?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
HEY WE LOOK REALLY SECURITY CONSCIOUS CHECK US OUT ON THE NEWS
Meanwhile their software sucks and nobody cares.
There are far better ways to administer client PC's. (#1 way is don't use Windows)
So let me get this straight. Some other users are fucktards who use the same passwords on multiple sites, (and I'm guessing their passwords are things like Password1, or ILoveCats or some other stupid shit like that, and now * I * have to go through the pain in the ass of changing my password, even though it was "H2$a-0ad-{u>a¥r#¥©Gp" ?!?
Oh, wait, I don't have to do that, because I don't USE GoToMyPC. I use GetTheFuckAwayFromMyMAC! which is a much better service in that in the first place, it requires a Mac, which means it's being used by an altogether better, smarter, more compassionate group of people in the first place, with not as many people trying to set the place on metaphorical FIRE by doing stupid shit like reusing passwords.
On that note, I have an idea: Instead of having stupid, arbitrary security rules for passwords, let users use whatever passwords they like, and have a password cracker CONSTANTLY working on the password hash list. When it finds a password, it immediately marks the password as expired; meaning you have to change your password when next you log in. Don't want to have to change your password every few days? Pick better passwords, ones that are harder to guess, and then you won't have to change them every few days, (or hours!)
I do not get your point. Telnet is still around in situations where it would make more sense for it not to be around. Just the other day there was an article here about EOL licence hassles with medical record software that users were connecting to using Microsoft's version of telnet.
There are plenty of old systems in use. In five years there will still be a lot of current systems in use so it's a given that SSH will still around even if something much better is available.