Forgot your password?
typodupeerror
Cloud Google Security Privacy Apple

Wired Writer Hack Shows Need For Tighter Cloud Security 132

Posted by timothy
from the internet-I-think-they-mean dept.
Nerval's Lobster writes "Between 4:52 and 5:12 on August 3, attackers used Wired writer Mat Honan's Apple ID to wipe his MacBook, before seizing control of his Gmail and other online identities ('My accounts were daisy-chained together,' he wrote in an Aug. 6 postmortem on Wired), and posting a message on Twitter for all to see: 'Clan Vv3 and Phobia hacked this twitter.' In the wake of Honan's high-profile hack, there are some key takeaways. Even if a typical user can't prevent a social-engineering attack on the company hosting their cloud account, they can armor their online life in ways that make attacks more difficult. First, two-factor authentication can prevent an attacker from seizing control of those vital 'hub' accounts (such as Gmail) where users tend to store much of their most vital information. Google offers two-step verification for signing in, as does Facebook. The truly security-conscious can also uncouple their cloud accounts; for example, making sure that iCloud and iTunes use two different sets of credentials. That might rob daily life in the cloud of some of its convenience, but it could also make you a harder target." Update: 08/08 01:17 GMT by S : This high-profile security breach has had an impact already: Apple has suspended password resets through customer support, and Amazon no longer lets users call in to change account settings.
This discussion has been archived. No new comments can be posted.

Wired Writer Hack Shows Need For Tighter Cloud Security

Comments Filter:
  • So much for ... (Score:5, Insightful)

    by PPH (736903) on Tuesday August 07, 2012 @10:59AM (#40905527)

    ... single log on across the 'Net.

    • Apparently, the 'single sign-on' of the future will be practically any trivially available biographical information...

    • by Hatta (162192)

      Single sign on vs multiple sign on is irrelevant when the attacker gets control of your main PC where all your credentials are.

      • Re: (Score:3, Interesting)

        by sexconker (1179573)

        Single sign on vs multiple sign on is irrelevant when the attacker gets control of your main PC where all your credentials are.

        No one got control over his PC in this case.
        And why would anyone store credentials on their PC?

        • by Anonymous Coward

          I've known full tier 3 system admins (aka: Sr Sys Admins) store plain text passwords on their desktop in txt files labled "god_servername.txt".

          There is also a huge amount of admins that keep password safe like programs on their local machines instead of in a "safe" location.

          • by Anonymous Coward

            Storing plaintext passwords in a text or KeePass database can be decently secure... provided they are stored on something with reliable security.

            I personally like a TC volume on an IronKey [1]. This provides two layers, and in addition, some anti-brute force capability since the IronKey will zap itself after ten failed attempts.

            [1]: They are now sold by Imation. I hope the new models keep the security features of the old ones before the changeover.

        • by Hatta (162192)

          Oh, I figured they used his Apple ID to log into his Macbook, where they could harvest the rest of his credentials. But instead, he gave all his log in info to Apple who gave it to the attacker. Duh.

          Something like SSH agent would have easily prevented this attack.

          • by macshome (818789)
            How would SSH agent help here? They used social engineering at Amazon to get common account info, then further used social engineering to get the password reset on his Apple ID.

            Once they had his Apple ID they logged into the iCloud service and issued remote wipes on all his devices that he had activated the wipe option on. Since he used the same credentials everywhere they were able to get into Twitter and Google as well.

            As for loosing all his data, he should have had a backup. Apple makes this super
            • by Hatta (162192)

              How would SSH agent help here?

              People use the same credentials on multiple web sites for convenience. Something like SSH agent could provide the same convenience, while allowing people to have different keys for different systems AND keeping all those keys in one secure place.

              • by macshome (818789)
                Sure, for things that can use ssh keys it works great. This is how I connect to various git servers.

                But in the case of this hack the services that were compromised were Amazon, Gmail, and iCloud web pages. All things that authenticate with user/password and not SSH keys.
                • by Hatta (162192)

                  That's why I say "something like SSH agent". There's no technical reason we can't have a web based authentication mechanism that works the same way SSH agent does. Getting such a standard widely implemented would be the hard part.

                  • Re:So much for ... (Score:5, Interesting)

                    by tchuladdiass (174342) on Tuesday August 07, 2012 @02:58PM (#40908359) Homepage

                    For those that don't know how ssh-agent works:
                    You have two parts to your key, one part encrypts only (public key) and the other part decrypts only (private key). The remote server sends a random message encrypted with the public key; that message is sent to the ssh-agent program, which decrypts the message with your private key which it has in memory. This decrypted message is sent back to the remote server -- if it matches what it randomly generated, it know that your are in possession of the private half of the key and lets you in. The secure part is that your private key is never sent over the wire, and never leaves the memory of the ssh-agent program (unlike a regular password).

                    Now one thing I've done in the past to make this more secure (when I carried a Nokia N900 linux-based phone) is I ran the agent on my phone only, and forwarded the connection to my PC via Bluetooth. I had it set up so that it would auto pair with PCs that I trusted (and play a particular sound on the pone during pairing and key usage), and require an accept button on the phone for other machines. I've been meaning to pick up Android programming so that I could port this over to my current phone. Oh, and when the agent program gets started on the phone, it requires a symmetric decryption key (protects it if the phone is stolen). Probably security overkill, but in my case I used it more for convenience than anything else.

                  • by Jerslan (1088525) *
                    In OS X and iOS this is called the Keychain. It already exists as an encrypted database that you can only get into with the password you put on it. Ideally this is something other than your login password, but most people probably don't think about it and use the same one anyways.

                    So for them to get at the private keys and/or stored passwords he must have used the same password for both login and the Keychain...

                    He should also look into FileVault... Even if Apple resets the login password, they don't ha
          • Re: (Score:2, Insightful)

            by icebike (68054) *

            Exactly.

            As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keys
            were stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing over
            access to his account, and once one password was known, the hacker could log in everywhere.

            What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Ap

            • Exactly.

              As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keys
              were stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing over
              access to his account, and once one password was known, the hacker could log in everywhere.

              What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Apple would do such a thing. Yet Social Engineering is one of the primary methods of spectacular security breaches.

              Still one has to ask, why this guy was chosen as a target. I suspect the attacker had just that little piece of inside knowledge that gave him just enough to nudge the Apple tech over the brink.

              He was chosen as a target because he had a 3-character twitter account name that the attacker wanted.

            • by Anonymous Coward

              What? No, his passwords weren't the same. His email *addresses* followed a recognizable template, i.e. mhonan@whatever.com, and his password-recovery addresses were daisy-chained so that when they got into his Apple ID, they could reset his GMail, which could reset his Twitter.

              +5 Insightful my ass. RTFA, it's long and detailed:
              http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/

          • by milkmage (795746)

            SSH? over the phone? for social engineering? enlighten me.

            http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ [wired.com]

            "Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information."

        • by itsme1234 (199680)

          Where else would you store them? In your head?

    • Apple (Score:5, Interesting)

      by busyqth (2566075) on Tuesday August 07, 2012 @11:50AM (#40906053)
      It was Apple that coughed up his credentials to the attackers. If Apple hadn't done that, there wouldn't be a problem.
      There are some Apple employees that ought to lose their job over this and Apple ought to pay this guy something significant for screwing him over.
      • Re:Apple (Score:4, Interesting)

        by Dragonslicer (991472) on Tuesday August 07, 2012 @12:27PM (#40906493)

        There are some Apple employees that ought to lose their job over this...

        It shouldn't be the support person that answered the phone, though. Apparently they followed Apple's procedure of requiring only a billing address and the last four digits of a credit card number to gain access to the account.

        • by rmstar (114746)

          Apparently they followed Apple's procedure of requiring only a billing address and the last four digits of a credit card number to gain access to the account.

          It happens to make sense. It is so much more likely that such a call comes from a genuine customer in distress than from a hacker that, from a risk management point of view, that procedure is much better than telling a genuine customer "you should have been more careful, now you are hosed". Welcome to the real world.

          Perhaps they should require a differ

          • by sFurbo (1361249)
            The first eight are not random*, so if the last four is out, only number 9-12 are left.

            *In fact, for any one type of card from any one Danish bank, the first 8 are identical.
            • Only the fist 6 and last 1 are "not random". The first 6 are the ISO number (formerly the BIN - Bank Identification Number) and are assigned to the card issuer, and the last is a check digit calculated from the full card number excluding the last digit. However, the last 4 are commonly printed on receipts, so they're not exactly "secret". But on a 16 digit number, that leaves digits 7-12 as relatively unknown (unless you have the full card number).

              • by sFurbo (1361249)
                Not for Danish cards. Here, the first 4 are country and card type, the next 4 are the bank registration number. I would think this was the case for all non-American cards, but I could very well be wrong.
          • Re:Apple (Score:4, Insightful)

            by Anonymous Coward on Tuesday August 07, 2012 @01:27PM (#40907285)

            What procedure would you suggest to tell the genuine customer that they just gave away your account and all your information you thought was properly backed up is now deleted?

          • by icebike (68054) *

            Customer in distress?
            Forgot their mother's name?

            Come on! If you are that distressed, why do you need access to your apple account? Call 911, not Apple.

          • by tompaulco (629533)
            Perhaps they should require a different subset of digits from the credit card number. The last four is a rather weak choice.
            Better than the first four.
        • Re:Apple (Score:4, Insightful)

          by icebike (68054) * on Tuesday August 07, 2012 @01:28PM (#40907299)

          Wait, why would any credit card digits and an address be sufficient?
          You hand that over every time you buy something.

          Why would apple bypass their own security questions and open the account to someone who can't remember any of those?
          Seriously who forgets their Mother's maiden name or their first pets name?

          • I didn't say it was a good policy. In fact, I'm completely in favor of firing the people that came up with it. If the support person confirmed all of the information that Apple's policy requires, then the fault should go to the people that set the policy, not the support person that followed it.
          • by dbitter1 (411864)

            Seriously who forgets their Mother's maiden name or their first pets name?

            Any idiot that actually replaces a high-security password with a low security, common knowledge item like MMN I hope to $diety never works as any type of admin in IT. I would assume anyone that thinks about it names their pets with a high-security name (like MD0km2!#nm1, or correct-horse-battery-staple if you prefer that style).

            • by dgatwood (11270)

              I just choose random words and phrases that have nothing to do with the original question. For example:

              • Best friend's first name: Ontario, Canada.
              • Place where your mother was born: Sam Donaldson.

              And so on.

  • But first.. (Score:5, Insightful)

    by js3 (319268) on Tuesday August 07, 2012 @11:01AM (#40905537)

    we need a tighter way to detect reposts

    • by Anonymous Coward

      What? The previous article was about Gizmodo editor Matt Honans. This is about Wired writer Mat Honan. Obviously two completely different people.

  • When I try to turn on two-factor authentication at Google, it gives me a screen that asks me for a phone number, and doesn't seem to have a way to bypass this. I'd rather not give them my phone number.

    Their help pages say that you don't have to use SMS-based authentication. Apparently there is a setting, once two-factor authentication is enabled, to switch from receiving the codes via SMS, and instead either write down a batch of 10 "backup codes" at a time, or else install the Google Authenticator app, initialize it with a key, and then use it to generate tie-synchronized codes thereafter. Either of these solutions is fine with me. But how do I enable them without having to give Google my phone number on the initial screen?

    • by bobstreo (1320787)

      Sign up for a google voice (or voip or something) account?

      Maybe with a different password.

      • by icebike (68054) *

        Sign up for a google voice (or voip or something) account?

        Maybe with a different password.

        Second point in the FAQ:
        Why you shouldn’t use Google Voice to receive verification codes [google.com]

        If you use Google Voice to receive verification codes, you can easily create a situation where you’ve locked yourself out of your account.

        For example, if you are signed out of your Google Voice app, you might need a verification code to get back in. However, you won’t be able to receive this verification code because it will be sent to your Google Voice, which you can’t access.

    • by fuzzyfuzzyfungus (1223518) on Tuesday August 07, 2012 @11:08AM (#40905621) Journal

      Well, for 20-ish dollars you can set yourself up with a burner prepaid phone and a very meagre SMS allotment...

      Aside from that, though, I suspect that Team Google wants your convenient personal identifier for totally altruistic security reasons...

      • I think Google says it all in their description of their 2-factor authentication

        2-step verification drastically reduces the chances of having the personal information in your Google account stolen by someone else

        Emphasis mine but yeah, straight from their site [google.com]

    • by Terrasque (796014)

      As far as I could tell, they don't verify the number. I had no problems setting it to a landline instead of my mobile phone.

      When I last configured it I got the "10 burn codes" and an option for a phone number, where a robot would dial and read up some numbers.

      So app on my phone, plus that piece of paper hidden away, plus a stable landline to someone I trust.

    • by 0100010001010011 (652467) on Tuesday August 07, 2012 @11:42AM (#40905975)

      You have to have a phone to set it up. You can then disable the phone and re-enable it with:

      > Mobile application
      > Switch to an app to get codes even when you don't have cell coverage.

      And then remove your phone #. So at minimum it's going to cost you a burner phone.

      The awesome thing about Google Authenticator is that it's open source. You can download and compile a PAM package (and it's in the Debian repositories). http://code.google.com/p/google-authenticator/ [google.com] So anything that uses PAM can use google authenticator.

      I have it setup on my outward facing SSH server so to get into my house's server you're going to need my password and one of my devices.

    • by dell623 (2021586) on Tuesday August 07, 2012 @12:29PM (#40906519)

      You have something important enough (maybe email) on Google that you want 2-step authentication, and you're concerned about them having your phone number? What exactly are you afraid they can do with it? (I get the point of not wanting other information online)

      • by oakgrove (845019)
        This is precisely what I was wondering. If anything I want to establish more of a personal relationship with whichever cloud provider I throw my lot in with. On the off chance that Google abuses the personal contact information then you cut them off and blog to the heavens about it. I guarantee you the internet will eat it up and blog ads will more than pay for the pain and misery you suffered.
    • by icebike (68054) *

      You don't have to give them YOUR phone number, nor does the phone have to be able to receive SMS.
      Google will use a computer voice to read the digits to you. This number does not need to be your permanent number.

      You just need ANY phone number that you can answer.
      You will need it exactly twice.
      Once to set things up on your computer.
      Then again to get the Google Authentication app authorized. From then on you don't need to give them your phone number.

  • I'm sure there's people out there who are saying 'ooooh hacker skills', in that somebody managed to hack this guy's mail account (or snag his password). Bunch of amateur script kiddies who'd otherwise be huffing hair spray and smashing up bus shelters.

  • hackers grab his info from whois because he has a personal site from blogging
    they use that to hack his amazon account
    and then use the info from amazon to hack icloud

    if he had just used wordpress or blogger or some other cloud service this hack would have been A LOT harder. it's 2012, no need to reinvent the wheel by setting up your own server for email, web site photo sharing or the 20 other things that da cloud has made easier and more secure. he just wanted to be uber tech cool and show off how he can run

    • by iluvcapra (782887)

      Basically you're saying that no one should have an entry in the whois database because we can't have nice things.

      The whois was just one way of doing this, I'm sure more than a few people's mailing address can be obtained from a google search (I know mine can, I've had to post too many PDF resumes.)

      The problem is Apple and Amazon use knowledge of a mailing address as a credential, in the same way that many silly organizations use knowledge of the last four of your SSN.

      • by bingoUV (1066850)

        Basically you're saying that no one should have an entry in the whois database because we can't have nice things.

        Having a "helpful" customer service which disregards security best practices when it is "convinced" of a genuine need is also a nice thing. Publically posting your residential address on facebook and publically announcing your holiday itinerary on facebook is also a nice thing.

        And yes, we can't have nice things. "Having nice things" is the enemy of security, and even privacy. What is wrong in saying we can't have nice things? (Except that it is obvious.)

        • by iluvcapra (782887)

          Publically posting your residential address on facebook and publically announcing your holiday itinerary on facebook is also a nice thing.

          Note that a residential address is not just something you post on Facebook, but something that exists in the yellow pages, on Google, and any number of direct mail, marketing, government, and tax databases -- it is public information which, by design, must be distributed to people holding any level trust, and is specifically not administered by the owner. Proposing that

          • by bingoUV (1066850)

            It is useless to stick to publically posting residential address point. It becomes dangerous only in conjunction with associating it with facebook profile and publically posting one's vacation plans on facebook.

            No one is advocating keeping one's residential address private. But advertizing it along with other information becomes dangerous as is well studied.

  • by vlm (69642) on Tuesday August 07, 2012 @11:23AM (#40905771)

    Nothing ever changes in the eternal wheel of IT.

    You as a customer are never worth more than the cost of sales of replacing you.

    So it has always been in all previous IT fads, so it shall forever be in all future IT fads.

  • by mcelrath (8027) on Tuesday August 07, 2012 @11:41AM (#40905961) Homepage

    Hey, I have an idea. Let's stop using non-secret information as authentication credentials. Address, birthday, mother's maiden name, last 4 digits of CC or SSN, CVV, childhood pet's name are NOT AUTHENTICATION. Authentication information should never be printed, emailed, or typed in the clear.

    Personally, I've been putting random numbers in all those fields for years, and if the account contains sensitive information, recording that information in an encrypted way in the event that it is ever needed. So far, I've never needed such information (because I also record and encrypt my randomly-generated passwords).

    Get KeePass [keepass.info] and enable two factor authentication. Then, call your bank and CC company and tell them the security on your credit card is absurd. Because who cares how good your Google password is if the guy standing behind you at 7/11 can get all the info he needs to defraud you by holding out his camera-phone while you buy your Gatorade?

    • by null etc. (524767) on Tuesday August 07, 2012 @12:29PM (#40906517)

      Nothing annoys me more than "security" questions. First, so many sites share the "secret" answer that it's really not secret, is it? Second, I'd prefer to not make vulnerable even yet more personally identifying information. Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!

      • by mcelrath (8027)
        I first drove my car in YKXz93W4MSGVn93z. You know it, it's 120 miles south of KrnummZF82cB5XXn. At least with these kinds of text entry fields, they're not going to require me to use one letter, one number, 2 forms of punctuation (but not an ampersand or dash!) and put a max length limit on the stupid thing.
      • by godel_56 (1287256)

        Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!

        "This is your brain on drugs"

    • by Anonymous Coward

      You forgot "What High School did you attend?"

      (Short list of answers: Washington, Jefferson, Adams, Lincoln, Wasilla...)

    • Authentication is not the same as proof of identity. Authentication is not ID, nor is ID Authentication.

      But how does one PROVE who they are? In order to PROVE you are who you are, you need a chain of trusted Identification.

      1) Peter Knows Mary, Peter can ID Mary. But is Peter is not Trusted (yet)
      2) Paul ALSO knows Mary. Paul can also ID Mary, and Paul is trusted.
      3) Jane, Sue and Michael all know Mary. They all can ID Mary, but offer various levels of trust.

      In each of these scenarios ID can be established pro

      • by mcelrath (8027)

        For 99% of internet applications, authentication is sufficient. Google, Apple, or any vendor doesn't need to know who I am, and they damn well don't need to link that info to my bank or tax records. It's none of their damn business. I don't want to identify myself.

        All that is required is to identify that the person making the request is the same one that established the account. Pure authentication, no identification. We've all done ourselves a major disservice by muddling the two. Of course, Google

        • Trust is not linear. Identity is.

          Trust is a scale -10 ... 0 ... +10
          Identity is a scale 0 ... +10

          When you meet someone new, you start at 0 on both scales, completely neutral. What I propose is building identity through trusts (positive).

          I know Paul, Paul is a liar. You know Paul, you don't know anything except what I've told you. Do you trust me?

          Peter, Jane and Mary all claim to know me, and all say I'm a liar. They also say Paul is a good guy. Do you trust me? Do you trust them?

          Michael, Greg, Steven and Ji

          • by mcelrath (8027)

            I don't see your point. What does that have to do with TFA? And why would I ever want to identify myself on the internet? As far as I'm concerned, there are two entities that need identity: banks and the government. All others don't need it, and induce liability, crime, and fraud by retaining identity information. With fraudulent identity information, one can perpetrate new fraudulent transactions with third parties unrelated to the source of the leaked identity information. With fraudulent authentica

  • by djdavetrouble (442175) on Tuesday August 07, 2012 @11:42AM (#40905967) Homepage

    Wow did even realize icloud had the ability to Remote wipe my computer.

    Currently Turning OFF this feature !

  • by Dan667 (564390) on Tuesday August 07, 2012 @11:52AM (#40906079)
    if you put something valuable on mainframes at other companies (ie the new marketing buzzword "the cloud") then you are accepting the risk. Not worth it IMHO.
  • by retech (1228598) on Tuesday August 07, 2012 @11:53AM (#40906093)
    Seriously, why is everyone screaming security when it was not a hack but a social engineering entry? And why cry for an idiot who had NO personal backups of his own data? He's an idiot.
    • by Krneki (1192201)
      Yap and idiot. Having insecure passwords over multiple different services is moronic at best. The fact that he has no backup when using cloud services is priceless and I bet he didn't even encrypt the data before putting it on an unknown server. P.S: WTF is daisy-chained, saved passwords or same password across different accounts? Use your passwords wisely and never let the OS save them if they are for important services, yes it takes more typing to access the mail, but this is what you do to be secure.
    • by dell623 (2021586) on Tuesday August 07, 2012 @12:33PM (#40906583)

      Because he's not the only idiot. You would be surprised how many tech savvy people have no backups and are equally vulnerable. Also it's something worth highlighting as it has shown critical flaws in bot Amazon and Apple's authentication systems. And it persuaded me to go ahead and set up 2-step authentication on Google, and I am damn glad I did.

    • by Anonymous Coward

      I find that people complaining about the backup habits of other users are typically the ones with no solid backup plans themselves. Of course, I can't say if this is true in your case. You're correct in your assertion that he should've had backups, however.

      Social engineering has everything to do with security, by the way. If you're vulnerable to social engineering (either via lack of proper security policies or a failure in training of personnel that have access to sensitive data), your security is compromi

  • by Anonymous Coward on Tuesday August 07, 2012 @11:55AM (#40906107)

    When a password reset is requested, a new password is sent to your email address. So, if a hacker gains access to your primary email account, then he has access to ALL of your accounts. (In fact, since email isn't encrypted, he only has to be able to intercept the password-reset message somewhere in transit.)

    Email is the weakest link on the internet.

    • by gander666 (723553) *

      Email is the weakest link on the internet.

      This. I am amazed by the professionals in information handling who genuinely answer that Email is fine for exchanging sensitive information. I heard a hospital IT manager honestly answer that he thought that email of patient record via PDF was fine. Sigh.

    • by Vairon (17314)

      It is no longer entirely true that e-mail is not encrypted. Many SMTP servers support encryption using SSL or TLS when communicating with another SMTP server. For example here is an example of an SMTP server receiving an e-mail from one of Google's gmail SMTP servers.

      Aug 7 13:33:28 x postfix/smtpd[22642]: setting up TLS connection from mail-gh0-f182.google.com[209.85.160.182]
      Aug 7 13:33:28 x postfix/smtpd[22642]: Anonymous TLS connection established from mail-gh0-f182.google.com[209.85.160.182]: TLSv1 wit

  • My current theory on cyber security is to put all of my eggs in a few baskets rather than spreading them out. My primary email accounts are operated by Google, with Google Authenticator providing two-factor security. I have LastPass providing complex and unique passwords for every website out there, and again, I have Google Authenticator providing two-factor security for that as well. Because LastPass has essentially scrambled all of my logins, I cannot access any website--including the email--without LastP

    • by KhabaLox (1906148)

      I use LP too, though I have to confess that I don't make full use of their password generation feature. I haven't tried the mobile apps - do those make it easy to log into sites from your phone? What about when you're at a different computer (not your own) - you simply use the mobile app to retrieve your password?

      • I use LP too, though I have to confess that I don't make full use of their password generation feature. I haven't tried the mobile apps - do those make it easy to log into sites from your phone?

        Yes..

        What about when you're at a different computer (not your own) - you simply use the mobile app to retrieve your password?

        ... and yes (if by mobile app you mean log on to the web site). You could, of course, also have a mobile version of Firefox with Lastpass so there is no danger of keylogging your Lastpass sign-in.

  • So, the Apple intrusion would not have happened if Amazon had not facilitated the recovery of this guy's credit card details.

    If Amazon had not allowed the addition of a credit card number OVER THE PHONE and had not reset the password OVER THE PHONE all would have been ok.

    Both Apple and Amazon should have required email confirmation before resetting passwords.

  • there's no security either!! But we've all known this for a very long time, now haven't we??? And you're going to entrust your persoal data to "the cloud"???
  • 2-step authentication from Google still requires a cell phone. For anyone who does not own a cell phone (such as myself), it is major hurdle to upgrading the security on my account.

    It is a shame google does not sell SecurID or similar key fobs for those who want security, but don't have a cell phone.

  • by DarthVain (724186) on Tuesday August 07, 2012 @02:38PM (#40908139)

    It doesn't surprise me in the least that clouds are not secure. I mean they are fluffy white things in the sky made mostly from water vapour. How can something like that be secure! Though they are someone intangible, and pretty hard to reach without some sort of assistance from earth. But hell birds can access them, birds! Do you think anything that birds can access is really secure?

    Birds, the sky hackers!

    Also Apple tech support sucks (believe me, I used to know some), and don't use the same password for everything...

    Well I'm off, gotta go change my Apple passwords, see ya! :)

  • The people reporting data loss or other problems on the cloud

    The people with the excuses on why the cloud isn't at fault, how it's always the fault of the users.

    Cloudbois?

  • He writes for Gizmodo.

    I asked him why. Was I targeted specifically? Was this just to get to Gizmodo’s Twitter account? No, Phobia said they hadn’t even been aware that my account was linked to Gizmodo’s, that the Gizmodo linkage was just gravy. He said the hack was simply a grab for my three-character Twitter handle. That’s all they wanted. They just wanted to take it, and fuck shit up, and watch it burn. It wasn’t personal.

Don't sweat it -- it's only ones and zeros. -- P. Skelly

Working...