A Data Leak Exposed the Personal Information of over 3k Ring Users

Re:A Data Leak Exposed the Personal Information of over 3k R... by roywiggins on Thursday December 19, 2019 @05:36PM (#21840008)

This seems important:

"Ring does not alert users of attempted log-in from an unknown IP address, or tell users how many others are logged into an account at one time. Because of this, there is no obvious way to know whether any bad actors have logged into people’s compromised Ring accounts without their consent."

I can understand not having 2FA turned on by default, but a bare minimum for this kind of service would be to alert users when someone successfully logs in from a new device.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by spamizbad on Thursday December 19, 2019 @05:44PM (#21840064)

My home security system, which is really... uh... crappy... manages to do this (provide both 2 factor and letting you know when someone logs in + changes the alarm state)

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by BelleOfTheBall on Thursday December 19, 2019 @08:31PM (#21841032)

I've recently had a similar problem with Spotify. My account was stolen. In part because I did not have 2FA turned on... because the app doesn't offer it for some reason. And, in part, because whoever logged into my account from a different IP and device supposedly didn't trip any of their security measures. So I was never even told that someone took hold of my account until I tried to get on.

It's baffling to me that any popular app wouldn't have 2FA (or any app, for that matter.)

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by zerkla on Friday December 20, 2019 @11:14AM (#21845184)

Same thing happened to me... I just noticed one day that my recent music was a bit odd, completely different to what I usually listen to. I changed my password, but 2FA should be a given at this stage.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by caf on Friday December 20, 2019 @04:48AM (#21842858)

I'm curious as to how stolen Spotify accounts are monetised? What's the value of them?

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by dylz on Friday December 20, 2019 @01:33PM (#21846370)

https://www.ebay.com/sch/i.html?_&_nkw=spotify+warranty&_sac...

All keylogged/phished/etc.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by caf on Saturday December 28, 2019 @01:46AM (#21897548)

This is fascinating - the individual prices are so low that they really must be moving a great number to turn a worthwhile profit.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by scohesc on Friday December 20, 2019 @11:14AM (#21845179)

Sell them on the black market to other people for dirt cheap like Netflix accounts used to (may still be?) done with.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by SideburnsOfDoom on Friday December 20, 2019 @04:55AM (#21842885)

Free music.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by choward on Friday December 20, 2019 @12:02AM (#21841824)

2FA for spotify? I'm curious where you draw the line for 2FA. Should every app (and web app) have 2FA?

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by lighthazard on Friday December 20, 2019 @12:05AM (#21841837)

I'd argue, in 2019, every app/service that requires a login should offer a 2FA option to add an additional layer of security - the person logging in most likely is the owner of the 2FA device.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by BelleOfTheBall on Friday December 20, 2019 @01:35AM (#21842124)

Maybe not every app but definitely one through which I make any type of payment. Spotify wants me to buy Premium, Spotify should offer me security.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by close04 on Friday December 20, 2019 @08:21AM (#21843910)

If it involves money (paid service, even if the hijacker never gets access to your actual card data and can't make any payments) or private data (name, address, etc.) then it really should.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by choward on Friday December 20, 2019 @12:47PM (#21845919)

I agree for the most part about the money part. I would still want the option for them to not allow me to upgrade plans without re-entering my credit card info. But with regards to personal information, that is almost everything I log into. And those companies share your personal info anyway, so it just gives you a false sense of privacy/security.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by buran77 on Monday December 23, 2019 @08:00AM (#21863323)

> it just gives you a false sense of privacy/security

No more that the password already does. 2FA isn't supposed to protect you from the company you already have the data too. And it's not really for the "privacy" of that personal data but for securing it.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by walrus01 on Thursday December 19, 2019 @06:19PM (#21840305)

Due to the overwhelmingly high amount of attempted fraud in grey/black market VoIP stuff, it's pretty common for wholesale SIP trunking providers to now alert the account owner whenever the web account control panel is logged into from a new, unknown ISP and/or useragent.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by dvtrn on Thursday December 19, 2019 @09:22PM (#21841259)

These “boutique” SIP providers (as I call them, Telnyx, Voipo, VoIP.ms etc) could really learn from their larger telecom counterpoints by allowing users to whitelist what IP ranges users can even authenticate from. Heck, even Linode offers this.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by mmmarnell on Friday December 20, 2019 @03:38PM (#21847197)

Telnyx offers IP whitelisting for inbound and outbound dialing on its platform as well.

https://sip.telnyx.com/

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by dvtrn on Friday December 20, 2019 @06:39PM (#21848365)

Correct, though the commenter above and I were referring specifically to user interfaces where sensitive accounting details are stored and configured and would allow access to privileged systems and user controls.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by dboreham on Thursday December 19, 2019 @11:17PM (#21841681)

Vitelity has supported this for probably a decade.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by dvtrn on Thursday December 19, 2019 @11:40PM (#21841752)

Good! It’s been a long while since I’ve managed anything clients using Vitelity trunks, but recall having a generally positive experience, glad to hear they still run a good ship to have at least this mechanism.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by pdonis on Friday December 20, 2019 @12:00AM (#21841808)

How does this work if you're traveling? Logging in from a mobile phone?

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by dvtrn on Friday December 20, 2019 @12:06AM (#21841838)

Self-Managed VPN, in our case.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by walrus01 on Friday December 20, 2019 @01:13AM (#21842047)

Typically you have your own IP pbx such as an asterisk system which lives in one place on static v4/v6 IPs, it connects to your upstream sip trunk. Your own clients such as zoiper on Android connect to that.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by Zod666 on Friday December 20, 2019 @02:42AM (#21842337)

I thought about using asterisk or something but does that noticeable latency when connecting remotely? Right now I connect directly to my sip provider on the go via an android sip client whereas running my own PBX would add another hop and was concerned how much this impacts latency.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by dvtrn on Friday December 20, 2019 @02:49AM (#21842375)

I'll open myself up for correction on the matter, but it's been my experience that these days Asterisk is more useful as and often more commonly deployed as a feature server (hunt-groups, ring-groups, call trees etc), at least for a broad majority of use cases where SIP is even a part of the conversation. Personally I'd not recommend one try rolling their own Ast based phone system for production/enterprise unless you just really want to and have literally no other projects to deliver back to the org.

Otherwise, what you're doing is perfectly fine and well enough: connect to your SIP trunk via credentials using a local client and you've more or less got a working, accessible phone number. Unless you truly have a need for Asterisk features, don't bother.

I happen to know first hand of a "voice company" that has a pretty sizeable footprint in the travel/hospitality industry making several million dollars a year and one of their products amounts to nothing more than configuring IVRs and charging through the nose to host them using what is (in my opinion alone) a thoroughly overly-complicated Asterisk infrastructure and similarly overly-complicated dial plans.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by hanniabu on Friday December 20, 2019 @12:28AM (#21841920)

Tin foil hat theory: They purposely don't show you this stuff because their security is garbage and it'd alert too many people of their shortcomings and negligence.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by swsieber on Friday December 20, 2019 @12:31AM (#21841932)

Well, if we want to tin foil hat theory it, then it's because the device can't differentiate between user access, police access and other hacker access.

[ Parent | on HN ]

Re:A Data Leak Exposed the Personal Information of over 3k R... by hanniabu on Friday December 20, 2019 @12:34AM (#21841937)

Damn, you just took it to a whole other level, that's a good one

[ Parent | on HN ]