Slashdot Mirror
Citing Attack, GoToMyPC Resets All Passwords (krebsonsecurity.com)
Security reporter Brian Krebs writes:GoToMyPC, a service that helps people access and control their computers remotely over the Internet, is forcing all users to change their passwords, citing a spike in attacks that target people who re-use passwords across multiple sites. Owned by Santa Clara, Calif. based networking giant Citrix, GoToMyPC is a popular software-as-a-service product that lets users access and control their PC or Mac from anywhere in the world. On June 19, the company posted a status update and began notifying users that a system-wide password update was underway.
Free demo now!!
If you haven't installed a password manager that generates a unique password for every site, now is a really good time to do it.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
When TeamViewer users where impacted, the initial reaction was TeamViewer itself had been hacked. They responded with the claim that users' reuse of passwords where to blame and TeamViewer security had not been breached. The fact an independent remote access software company is exhibiting the same issues seems to indicate that TeamViewer was probably correct that user behavior regarding poor handling of passwords is to blame.
While both TeamViewer and Citrix seem to now be pushing two-factor authentication, they both seem to be using solutions they created themselves rather than contribute to an industry standard method which is consistent for the user across websites. It would be nice as this problem becomes more common that more companies join the FIDO Alliance as this should provide a single method for the user to learn which them works the same across all U2F compliant sites.
How would the new password be communicated to the user in a secure manner every 3-6 months?
GoToMyPC was first released in 1998.
TeamViewer was first released sometime around 2005.
Since then there have been a number of proposed common first-level login standards (OpenID, SAML..) along with second-factor ones (Symantec VIP, U2F...). Phone-based authentication seems to be popular at the moment.
How are companies supposed to figure out if the standard they choose will last? Companies have embraced various standards, only to abandon them a year or two later.
In short: the current state of things is a mess.
Sightation needed.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Full of exposed user information. Once the cat is out of the bad it's out of the bag and it needs to be acknowledged. You should be able to look up yourself and all your past exposed password so that you can never ever use them again. In fact you should be able to add to the list yourself.
Owned by Santa Clara, Calif. based networking giant Citrix Err, Citrix is based in Ft. Lauderdale, and with the recent layoffs in Santa Clara, it is become clearer Citrix is circling its wagons back to South Florida (for better or worse, time will tell.)
Normally when Dropbox is mentioned and the topic is security it's referring to one of their many spectacular fuckups.
Able to download the files of others by knowing the filename and hash - that was Dropbox when people used this bug as an alternative to bittorrent for a while.
Able to login to other people's accounts without a password - Dropbox was wide open one day with that massive fuckup.
Using the interface to revoke other people's access to your files, getting told that it had worked, then those other people found they could still get the files - Dropbox again.
And that's just the stuff that has had dedicated articles about it on Slashdot.
If you don't want your worst enemy, a potential thief, or your mother to see something then don't put it on Dropbox.
SSH was first released in 1995.
SSH is now 21 years old.
Back in 1994, Telnet (released in 1969) was 25 years old.
Can you guarantee that SSH will still be around in 5 years?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
I do not get your point. Telnet is still around in situations where it would make more sense for it not to be around. Just the other day there was an article here about EOL licence hassles with medical record software that users were connecting to using Microsoft's version of telnet.
There are plenty of old systems in use. In five years there will still be a lot of current systems in use so it's a given that SSH will still around even if something much better is available.