Slashdot Mirror
Google Says Hackers Steal Almost 250,000 Logins Each Week (cnn.com)
Google is digging into the dark corners of the web to better secure people's accounts. From a report: For one year, Google researchers investigated the different ways hackers steal personal information and take over Google accounts. Google published its research, conducted between March 2016 and March 2017, on Thursday. Focusing exclusively on Google accounts and in partnership with the University of California, Berkeley, researchers created an automated system to scan public websites and criminal forums for stolen credentials. The group also investigated over 25,000 criminal hacking tools, which it received from undisclosed sources. Google said it is the first study taking a long term and comprehensive look at how criminals steal your data, and what tools are most popular. [...] Google researchers identified 788,000 potential victims of keylogging and 12.4 million potential victims of phishing. These types of attacks happen all the time. For example on average, the phishing tools Google studied collect 234,887 potentially valid login credentials, and the keylogging tools collected 14,879 credentials, each week.
Networks matter.
These types of attacks will keep working partially based on Social Engineering as well as an already compromised system, such as a key logger.
...until they offer us the solution of total account security through total surveillance. They can then assure us that no one is using our accounts besides ourselves and every single paying Google customer, any one of whom can watch our individual surveillance feeds for a fee.
Cloudiot: A person who does not see offsite storage as a way to lose control over access to his or her own data.
"Rusty" is not a unit of measurement. I suggest that you repeat preschool!
Google has a good selection of 2FA tools, be it the app (which lets you tap "yes" on your phone), their authenticator, SMS fallback, etc. I'm surprised why more people are not enabling authentication. That way, a revealed password isn't the end of the world, although stealing auth tokens can be still a valid attack, but that is a lot harder to do than a passive keylogger.
Summary doesn't link to any proper citation that hackers are actually stealing 250k logins per week.
All I see is a hyperbolic CNN article and separately a google ad.
Sad!
Quit being so critical. You don't like it? You go to Ars, son!
It is good security practice to always use a commercial (paid) VPN at all times, but especially when using public wifi to prevent incidents like that.
Private Internet Access, ExpressVPN and NordVPN are all industry leaders with great prices, easy to use and outstanding privacy policies.
Also use a password manager like KeePassX or LastPass so you can easily have unique, secure passwords for every login. And always enable Two Factor Authentication.
Google has a good selection of 2FA tools, be it the app (which lets you tap "yes" on your phone), their authenticator, SMS fallback, etc. I'm surprised why more people are not enabling authentication. That way, a revealed password isn't the end of the world, although stealing auth tokens can be still a valid attack, but that is a lot harder to do than a passive keylogger.
If it's that good then why isn't it on by default?
Seriously, what the fuck is wrong with technology firms? They sell these consumer electronics items and leave them wide open?
What a bunch of morons - THEY are the morons!
And if "hackers" can break into Google, I guess those Google "engineers" aren't such hot shits after all.
Says the newcomer younger than my shoes who's too busy feeling important (<blink>top editor</blink>) to even try.
>"Rusty" is not a unit of measurement
In Soviet USA anything can be a unit of measurement
Except international standards like metre
BTW I also don't have an account with Google
2FA is too damn inconvenient to be on by default. I, like most users, will absolutely not put up with any hassle like this to login. My password is in the password manager and I should never have to type it. Any login should thus be completely automatic, handled by the computer, and I will do everything I can to keep it that way. 2FA? NO WAY!
I'm surprised why more people are not enabling authentication.
It's in part because these providers insist on using SMS as the preferred second factor despite its disadvantages compared to U2F or TOTP. SMS has two problems:
SMS is expensive Cellular carriers in Slashdot's home country charge 10 cents per received text message unless a subscriber pays hundreds of dollars per year for a cellular plan including unmetered text messaging. I doubt that most people would want to pay their cellular carrier 10 cents every time they check their email. SMS is insecure SMS messages can be intercepted, such as by social engineering a replacement SIM out of the victim's carrier or by exploiting SS7 flaws. U.S. National Institute of Science and Technology has warned firms about this, but firms haven't been listening.This wouldn't be a problem if services like Google, Twitter, and Steam offered a way to set up TOTP without first setting up SMS. But they don't. Google says "first you need to complete SMS/Voice setup", and the instructions for Twitter include "set up your personal account with the service on your phone" as part of the first step. Nor do they offer a way for someone who has set up TOTP to disable SMS without also disabling TOTP. Twitter in particular sends SMS on every 2-factor login attempt, in effect treating TOTP as a backup for SMS rather than vice versa.
Powwwwwww, got em.
Just do not send the plain text password to the server. Use a nonce base hashing scheme instead.
TLS is almost worthless because it relies on the user to validate the URLs. Might as well not use it at all.
And the Secure Remote Password (SRP) algorithm has been around for a long, long time. It avoids offline John-the-ripper attacks.
The idea is that users only type in passwords in an area of the browser like the URL line which JavaScript cannot access.
Problem solved. Once and for all.
Unfortunately, neither I nor anyone else can see how to make money out of plugging this hole, while there is plenty of money to be made by working around it. So I at least will not invest any time into it. Will you?
Just do not send passwords in the clear to the server. Kill phishing, which is the main issue. Use a nonce base hashing scheme instead.
TLS is almost worthless because it relies on the user to validate the URLs. Might as well not use it at all.
And the Secure Remote Password (SRP) algorithm has been around for a long, long time. It avoids offline John-the-ripper attacks.
The idea is that users only type in passwords in an area of the browser like the URL line which JavaScript cannot access.
Problem solved. Once and for all.
Unfortunately, neither I nor anyone else can see how to make money out of plugging this hole, while there is plenty of money to be made by working around it. So I at least will not invest any time into it. Will you?
is all the logins belonged to this guy
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
This is great post and i am happy to find this informative topic shared here. looking forward for more information..
I get multiple emails every year from someone trying to "hack" my gmail account by linking it to their own. If I click and say "Yes", they win.
Why can't I just turn this off so that it is never a risk?
Or Google, get rid of this feature?
And were modded down for it. You should know better than to say RUSSIANS ! round these here parts because everyone knows they only exist in the minds of SJW leftist homosexuals.
Just thought I'd get the party started...