Source Code To Google Authentication System Stolen 306
Aardvark writes "More details are coming out about the extent of the break-in at Google a few months ago. The NY Times is reporting that one of the things stolen was the source code to Google's single sign-on authentication system, called Gaia. Though Google is making changes to the system, the theft raises the possibility that attackers could analyze the code to find new exploits to take advantage of in the future. No wonder that Eric Schmidt recently said they've become paranoid about security."
Paranoid about security? (Score:5, Insightful)
Strange - didn't you guys say if I had nothing to hide, privacy didn't matter?
Re:Paranoid about security? (Score:5, Insightful)
Strange - didn't you guys say if I had nothing to hide, privacy didn't matter?
What they meant was your privacy didn't matter to them.
Re:Paranoid about security? (Score:5, Insightful)
Really, this shouldn't matter, unless they are doing something they should not be doing.
Re: (Score:3, Insightful)
If security depends on code it is insecure. Period.
If security depends on people it is insecure. Period.
It is insecure. Period.
----
Hypertext isn't what it's marked up to be.
Re: (Score:3, Insightful)
Strange - didn't you guys say if I had nothing to hide, privacy didn't matter?
No, they said if you willingly broadcast your life all over the intarclouds they you have no grounds to complain about your privacy being violated when others (ab)use that information.
Re:Paranoid about security? (Score:5, Insightful)
Who knew they only meant that we shouldn't overreact?
Re:Paranoid about security? (Score:5, Informative)
If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place. If you really need that kind of privacy, the reality is that search engines -- including Google -- do retain this information for some time and it's important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities.
Have a nice day.
Re:Paranoid about security? (Score:5, Informative)
OK, more context:
Q: People are treating Google like their most trusted friend. Should they be?
A: I think judgement matters If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. But if you really need that kind of privacy, the reality is that search engines including Google do retain this information for some time, and it’s important, for example that we are all subject in the United States to the Patriot Act. It is possible that that information could be made available to the authorities.”
In this context, "doing it" now refers to "treating Google like their most trusted friend" because otherwise, the phrase would be "shouldn't have it."
People are too political about this issue and refuse to actually think. Screw grammar. The meaning is quite clear in context. If you don't want someone to find out about something you're doing, don't do it through Google (or any other search engine). They all keep records and can all be subpoenaed. Use some other method.
So, yeah, don't trust GOOG with your darkest secrets. Schmidt said it, himself. Also, if you're smoking pot, do it in you house and not in the public park.
Sauce? (Score:5, Funny)
tar.gz or it didn't happen
Re: (Score:2)
On the contrary, this sound like a job for
CAPTAIN PLANET!
More Eyes (Score:5, Funny)
More eyes make the bugs shallow, right? ;)
Re: (Score:2, Informative)
Re: (Score:3, Funny)
That's why you need to look at it from a 45 degree angle.
Re:More Eyes (Score:5, Funny)
But then the bugs will appear to be in IE8.
Re:More Eyes - if you publish (Score:4, Insightful)
Many eyes = problem? (Score:5, Insightful)
Re:Many eyes = problem? (Score:5, Insightful)
So, Schmidt is worried because google was relying on security through obscurity?
Whoever modded you Flamebait was dead wrong. Open disclosure is one of the major principles of security, and security through obscurity is an awful thing to trust in. It's true that openly available systems can be more susceptible to attacks, but a sufficiently robust system should be able to stand up to the scrutiny.
Re:Many eyes = problem? (Score:5, Insightful)
I can appreciate that security through obscurity is false, but I kinda got the impression that they weren't really relying on obscurity, rather the enemy now has that much better a chance of finding something they missed. Can you say with absolute certainty that any open source software is absolute bulletproof? Even OpenSSH and OpenSSL have released numerous minor revisions to fix potential security exploits. Being open source doesn't automatically mean it's more secure, but when you've got a ton riding on some piece of software I think a bit of paranoia is justified.
Re: (Score:2, Insightful)
that they weren't really relying on obscurity, rather the enemy now has that much better a chance of finding something they missed
That's called relying on obscurity. If having the source code lets you find something Google missed, that means Google missed something.
Re: (Score:3, Insightful)
that they weren't really relying on obscurity, rather the enemy now has that much better a chance of finding something they missed
That's called relying on obscurity. If having the source code lets you find something Google missed, that means Google missed something.
No, it doesn't. There's a big difference between relying on obscurity -- which google, apparently, was not -- and simply being concerned because the bad guys have more ability to search for flaws.
The latter is a pretty natural human reaction to an event like this, regardless of how well designed their security system is, because all designs, and all code, potentially contains flaws, even if designed and implemented by the most brilliant security researchers.
Re:Many eyes = problem? (Score:5, Interesting)
and simply being concerned because the bad guys have more ability to search for flaws.
Much of the world relies on security systems that are completely open and available to everyone. One of the prime examples is openSSH. Another prime example in openSSL. I don't hear too many people worried that these systems are more vulnerable because attackers have access to the code.
The latter is a pretty natural human reaction to an event like this, regardless of how well designed their security system is, because all designs, and all code, potentially contains flaws, even if designed and implemented by the most brilliant security researchers.
Panic and stupidity are also natural human reactions. Since when did something being "natural" become a justification for something? I can understand the reaction, but that doesn't mean it's right.
It's pretty stupid to rely on code remaining secret. Code is something that's very difficult to make secret as it gets copied all over the place. How many people at Google already have access to it? It seems to me that if Google really wants to be secure they should just release the damn code so "the good guys" also have access to it, since apparently "the bad guys" already do.
Re: (Score:3, Interesting)
I worked at a big portal, and I can say it was not possible to protect our apps from -everything-.
Some things are not possible - like keeping IPs of all the users ever vs every page in the portal visited ever. Too much data, simply.
We depended on obscurity - keeping the code secret - in several cases:
- make the attacker believe the attack succeeded while it didn't, to make them continue this vector instead of trying something harder which could actually succeed
- short-lived, statistical blac
Re: (Score:3, Interesting)
You seem to have never worked in 10k+ clicks per second environment.
A farm of several hundreds of servers works at between 80 and 100% load at all times. The developer costs are minor/negligible comparing to hardware, electricity and bandwidth costs. A man-month to optimize size of a single page by 1% is well worth the investment.
Increase of server load by 30% to remove another 0.1% of attacks is completely unacceptable. We don't care if 1% of users won't see the page. When the farm peaks in the rush hours
Re: (Score:2)
We already know that Google missed something. The attackers got in. Now Google has to figure out what else it missed, and fix those bugs post haste.
Open source software works best when the code is publishable; when the millions of eyes can understand it and contribute back to it. Getting the code into publishable shape takes time and manpower, and right now, Google can spare neither.
Re: (Score:3, Informative)
Yes they missed something, from TFA
The theft began with an instant message sent to a Google employee in China who was using Microsoft’s Messenger program, according to the person with knowledge of the internal inquiry, who spoke on the condition that he not be identified.
By clicking on a link and connecting to a “poisoned” Web site, the employee inadvertently permitted the intruders to gain access to his (or her) personal computer...
How google missed a stupid employee? "But" (you yell) " there had to be a flaw that let them gain access!". Yes, there was a flaw:
The attacks took advantage of a flaw in Internet Explorer 6 that was quickly patched, although the damage had been done.
So a google employee in China was using IE6 and clicking on links from someone who claimed to be another employee who wished to remain anonymous?
They missed an idiot. Pure and simple.
Re:Many eyes = problem? (Score:4, Informative)
They found Google's secret sauce.
If Request.Form("password") = "JOSHUA" Then
Response.Write("Greetings, Professor Falken")
Set Godmode=1
Re: (Score:2, Offtopic)
Last time I checked I was definitely not American [carroll.org.uk]. However you, sir, are most definitely a troll.
Re: (Score:2)
No. It is the one company that refused to turn over its user's data without the appropriate warrants.
Re: (Score:2)
Did you forget Verizon?
Don't change it, release it (Score:5, Insightful)
Seriously, the bad guys already have it, so enlist the help of the security community to improve it.
Re:Don't change it, release it (Score:5, Interesting)
Seriously, the bad guys already have it, so enlist the help of the security community to improve it.
There's probably a whole lot of stuff in that source code that is either a trade secret or gives clues to trade secrets google would rather keep private.
The most realistic course of action would be for them to hire some 3rd party pen testers and auditors to pick apart their code under a microscope.
Re: (Score:2)
Re: (Score:2)
they already have security geniuses at google. I know for a fact that they do not feel much need to hire external parties.
Re: (Score:3, Funny)
The code was stolen, so they're going to have to rewrite it from scratch. You'd think Google would have had a backup somewhere, but maybe they stole that too.
Re: (Score:2, Interesting)
Cloud security? (Score:5, Funny)
I thought the cloud was secure?
Re:Cloud security? (Score:4, Funny)
Re: (Score:2)
Now that is true security by obscurity.
I mean: ever been in an aircraft flying through the clouds? Nothing much to see, the cloud obscures it all!
Re:Cloud security? (Score:5, Insightful)
By clicking on a link and connecting to a "poisoned" Web site, the employee inadvertently permitted the intruders to gain access to his (or her) personal computer and then to the computers of a critical group of software developers at Google's headquarters in Mountain View, Calif. Ultimately, the intruders were able to gain control of a software repository used by the development team.
Unless it's a flaw directly within the messenger software rather than the user who clicked the link...Microsoft wasn't really involved...
Re: (Score:2)
Unless it's a flaw directly within the messenger software rather than the user who clicked the link...Microsoft wasn't really involved...
I wouldn't say Microsoft was directly involved, but back when I used Windows XP and Window Live Messenger, no matter what I did I could never get Windows Live Messenger to open up a link in anything other than IE. It's been a while so things might have changed, but this "feature" could make them at least indirectly involved.
Re:Cloud security? (Score:5, Interesting)
Oh, except it was microsoft's operating system, and microsoft's messenger. I don't understand this concept of computing where you can click in "the wrong link". I can click in whatever link I want, and that is not supposed to destroy my computer. I use Pidgin on GNU/Linux. I can click on ANY link that I want. Clicking on the link won't do anything besides opening it on a browser, or asking me to download it. Except I sudo su and chmod +x $file and ./$file nothing is going to happen. But we hear all the time from windows users getting randomly infected with malware by just clicking on a fucking URL, or going to the wrong site, etc. Or just connecting on the wrong LAN. Clicking on a link IS NOT supposed to give ANYTHING any kind of execute permissions. I don't browse with Flash, but I do keep a Firefox-altern dir with Flash installed in case I really really need to check out something that requires Flash. I can't believe how invasive that thing is, and how many privileges it automatically grants to random content on the web. Same thing for JS. The simple fact that 'last measure' still works is living proof of how stupidly insecure certain technologies are.
And, no, it's not the user's fault for clicking on a link.
Re: (Score:2)
Re: (Score:2)
Unless, of course, that website that opens in your browser exploits a vulnerability in Firefox to take over your user account. From there on, if you're using Ubuntu for example, they could hijack your menus and next time you open up a control panel they use a fake gksudo dialog to steal your password, and then have complete control of your computer. Which is basically what happened to this fellow.
The only reason that doesn't happen to you and it happens to Windows users is obscurity.
Re: (Score:2)
Except that Firefox's vulnerabilities are patched on average less than 24 hours after they have been discovered, that is, according to statistics, 15x faster than for micro$oft's IE.
On the other hand, I wasn't JUST complaining about "microsft software", I was complaining about insecure setups in general. Windows only allows an insecure setup. That's it. There is only one way to use it, and it's insecure by default. Any person with administrative access to any kind of important system (like this guy had), s
Re: (Score:2)
... Until they use an attack against one of the plugins that you have installed that have the same vulnerability on any platform: like, say, flash, which has insanely deep market penetration. If they were targeting you specifically (as is the case with a targeted attack against a specific company, which is what happened here), then they'll use whatever means they can to figure out what you're running.
Then they'll tailor the attack to take over flash (which on linux is no more sandboxed than it is on windows
Re: (Score:2, Insightful)
I agree with your point. The very notion of "dangerous sites" sounds to me something like "dangerous newspaper articles". There's something wrong with the concept.
That said, I will point out that it's not necessary to root the machine to leave a back door, and it's not even necessary to gain arbitrary execution as the user to gather private details, passwords to online accounts, etc.
Re:Cloud security? (Score:5, Insightful)
Your attitude of invincibility is both dangerous and stupid. Firefox, like all web browsers, is complex software that has a long history of vulnerabilities. One buffer overflow vulnerability (and Firefox has a history of such vulnerabilities) is enough to run arbitrary code on your system.
Not true. The software you use every day almost certainly has security vulnerabilities that may allow code execution. History has shown that determined hackers have little trouble finding one.
No, mostly we hear those stories from people who don't know what the hell they're talking about. If you download and run some arbitrary executable, well, yeah, you can get infected. The same could happen if you went and installed a malicious deb/rpm.
Those people who truly *were* infected by "just clicking on a fucking URL" (and not by deliberate acts of stupidity on their part) are victims of software vulnerabilities. And those vulnerabilities exist on every platform.
Neither Microsoft's OS nor their messenger software had anything to do with this hole, although Internet Explorer might. Neither the messenger software nor the OS were vulnerable; the vulnerability was most likely either in the web browser or a plugin like Flash.
Re: (Score:2)
By clicking on a link and connecting to a "poisoned" Web site, the employee inadvertently permitted the intruders to gain access to his (or her) personal computer and then to the computers of a critical group of software developers at Google's headquarters in Mountain View, Calif. Ultimately, the intruders were able to gain control of a software repository used by the development team.
Unless it's a flaw directly within the messenger software rather than the user who clicked the link...Microsoft wasn't really involved...
Messenger was just a way to launch the system default web browser to load the URL. Loading the browser independently and then typing that same URL into the address bar would have done the same thing. The browser and its vulnerability to the malicious contents of that URL are at issue here. My bet is that the OS was Windows and the browser was IE, in which case it's perfectly reasonable to say that Microsoft and its products were involved here. Unfortunately the article does not specify the browser that
Re: (Score:2)
What the google code was running on or stored in/as is not really the point.
MS consumer grade software was the hole that exposed the goggle work to the world.
"Source Code [...] Stolen" (Score:3, Interesting)
Stolen?
What.. they are no longer in possession of the source code?
Re:"Source Code [...] Stolen" (Score:4, Insightful)
Being positive today I'm going to go with maybe English isn't your first language. Here is a definition..
They took the code without Google's consent, hence they stole it.
Re:"Source Code [...] Stolen" (Score:5, Insightful)
They took the Movie without paying for MPAA consent, hence they stole it.
We like to change the meaning of the words when it's convenient for us
Re: (Score:3, Insightful)
My point exactly - no matter how much it's modded "Off-topic" currently :D /karma
Re: (Score:2)
Yes, downloading shit for free off the internet is stealing too. Also who is the "We" you're talking about.
Re: (Score:2)
The "we" would be the majority of those who bother to comment on such stories.
There's very few who argue the opposite, such as yourself.
My own take on it can be gleaned from my comment history, but my original comment was mainly aimed at those who shout the loudest that 'copyright infringement isn't theft!' in the usual story comments threads :)
Not quite as "insightful" as the mods think. (Score:5, Informative)
They took the code without Google's consent, hence they stole it.
Not quite. In most jurisdictions, the question "Is it theft?" is answered by the following tests.
1. Was the property provably taken without consent?
2. Was the property provably taken with the intent of depriving its rightful owner of said property?
If both of those tests are true, it's theft. In this case, Google still has a copy of their code, so the crime would not be considered theft in most jurisdictions.
Of course, in the USA there is no national definition of theft, since it's defined and prosecuted at the state level. Talk about confusing.
"Theft" is a concept that really varies in meaning from place to place. I guess that's why so many people jump on their high horse, wave their hands madly, and proclaim that various petty infringements are "stealing". They are probably right in the context of some banana republic somewhere.
Re: (Score:2)
Would you be so kind as to cite an example?
Re: (Score:2)
So I've looked at this some more and this is what US law states on deprive:
Since Google could quite successfully argue in
Re: (Score:3, Insightful)
Slow down there, cowboy :)
They would have to argue successfully that the major portion of its economic value or benefit is lost to him (does it really use 'him'? how quaint)
I would argue that most of the world could have the source code and there's no real economic value loss to Google unless their shares dropped for a few seconds or somesuch since this became public knowledge. I can take slashcode,
Re:Not quite as "insightful" as the mods think. (Score:4, Insightful)
Re: (Score:2)
1. Was the property provably taken without consent?
2. Was the property provably taken with the intent of depriving its rightful owner of said property?
Are you sure about the second criterion? For example, if I steal an apple from someone, the intent is not to deprive the other person of an apple, it's merely to get an apple for myself.
Re:Not quite as "insightful" as the mods think. (Score:5, Insightful)
Plagiarism isn't theft, it's just plagiarism.
Downloading a copyrighted mp3 is not theft, it's copyright infringement.
Using someone elses patented invention isn't theft, it's patent infringement.
And so on.
Re:"Source Code [...] Stolen" (Score:4, Informative)
Being positive today I'm going to go with maybe English isn't your first language. Here is a definition..
They took the code without Google's consent, hence they stole it.
hmmm. actually it sounds like you're the one with a poor grasp of what's going on here. Definition of 'take' - "to remove, capture, consume, or dispossess from someone else."
the sourcecode was not stolen. a copy of the sourcecode was stolen. and this is a crucial distinction since "steal" means to deprive from another. and while google has been violated, they most absolutely have not been deprived of any code.
a common sense analogy for you: say i break into your house and photocopy all of your books. no one would suggest that i've stolen your books. for me to have stolen you books, i would have to take then and leave you with nothing. in the google case that did not happen. hence OP's quite proper correction.
Re: (Score:3, Insightful)
Your book analogy isn't a similar situation at all. You didn't write the book, you weren't trying to keep it secret and the person possessing a copy doesn't negatively effect the original holder.
All of these things apply in Google's situation. Also my definition of steal is accurate, they broke in and copied the code without consent from Google. The copying part isn't the problem it is the without their consent part which makes it stealing.
Re: (Score:2)
Re: (Score:3, Insightful)
That's a different issue really. Copyright Infringement would be re-distributing copyright without permission of the owner, etc.
This code theft is taking copyright that they had no permission to take.
Re: (Score:3, Insightful)
I simply took the definition from Google.
http://www.google.com/search?hl=en&site=&q=define:stolen&btnG=Search [google.com]
Just because I don't conform to your world view I'm suddenly working for the music industry? Grow up.
Open source it (Score:5, Insightful)
They should open source it, since a copy is out on the loose anyway. This could work to their advantage.
I still think capability based security is the only workable long term solution..
It's all about leverage (Score:5, Insightful)
From TFA: "By clicking on a link [sent on Microsoft Messenger] and connecting to a 'poisoned' Web site, the employee inadvertently permitted the intruders to gain access to his (or her) personal computer and then to the computers of a critical group of software developers at Google’s headquarters in Mountain View, Calif. Ultimately, the intruders were able to gain control of a software repository used by the development team."
I don't know about you, but I'm quite shocked at how an innocuous thing like this can lead to the theft of "one of Google's crown jewels". Are their security practises that lax over there in Google China? And, considering that this happened to Google - a leading Tech-savvy company - how many other corporations and conglomerates have already been hit by a similar attack? Banks? Military? Oil and Gas? Heck, MSFT?? After all, TFA reported that it was a "lightning raid that lasted less than two days".
And yeah, while TFA sounds like Luddite fear-mongering, I think it's a valid concern for everyone.
Re: (Score:2)
Don't worry. When your medical records are put into databases, they will be secure.
Honestly. If you want it secure, keep it offline.
Re: (Score:2)
Cause we all know doctor's offices are impenetrable.
Two things about that:
One, someone who wants to break-and-enter into a doctor's office is going to leave behind physical evidence. It's the sort of crime likely to be solved through old-fashioned police work. It also can't be done from halfway around the world.
Two, that doesn't permit anyone to gain massive numbers of medical records. A thief who breaks into a doctor's office to obtain medical records is going to get the records for that doctor's patients only. With each break-in to each office, t
the level of interest and sophistication (Score:5, Insightful)
matched the target
that is, the economics of the attack is not a common one: your average podunk company offers what, exactly? and i'm not even talking in terms of financial possibilities, i'm talking in terms of corporate and political espionage, which the chinese government is interested in, not common robbery. because with google, if you break in, you get such a huge payoff in terms of strategic intelligence, unlike any other exploitable entity. so somewhere in china, a stable of minds are focused like a laser on you
and structurally, security wise, the problem is the same as terrorism: the good guys have to be vigilant all the time, they can't fail ever. while the bad guys: they can screw up time and again, that's ok. they learn even. they only need to get in once. so even if you are google, no, ESPECIALLY if you are google because you're such a fabled target, you are at a strategic disadvantage, even with all your resources, to be hacked. those who want to hack you are ready to invest heavily into hacking you: its a good investment, because the payoff is gargantuan, the economics of the security situation works against google
the REAL lesson is for us, the common joe blows of the world: don't put all of your eggs in one basket. have an ecosystem of interdepndent accounts with different companies. don't do EVERYTHING at google, or their exposure is your exposure
Re: (Score:3, Insightful)
Oh please! Nearly everyone tries "novel" forms of writing without capital letters, without punctuation, or of some other kind at least once. Usually when they're teenagers and they usually grow out of it when they realise it's nowhere near as "novel" as they first thought.
Capital letters are not redundant. They are incredibly useful due to the way we read. Once you're reached a certain level of proficiency in reading, you don't read one wor
Re: (Score:2, Insightful)
From what I read back when news of this first broke, usually when these attacks are successful, the infiltration lasts for years, because the goal is to quietly and relatively slowly pilfer things like that source code, not make a big mess as quickly as possible. If they are undetected, the attack is a lot more successful. The fact that Google caught this in 2 days speaks well for their security team.
Re: (Score:2)
I don't know about you, but I'm quite shocked at how an innocuous thing like this can lead to the theft of "one of Google's crown jewels".
I sincerely doubt this is anything near a "crown jewel" for Google. From TFA:
The program, code named Gaia for the Greek goddess of the earth, was attacked in a lightning raid taking less than two days last December, the person said. Described publicly only once at a technical conference four years ago, the software is intended to enable users and employees to sign in with their password just once to operate a range of services.
Yes, a useful piece of software, and it probably works better than most every other site's login system. An important trade secret of Google's worth freaking out about? No. It also doesn't really seem like Google is freaking out. If they're making changes to the program, it's probably primarily to placate the panicky masses/press (or maybe panicky managers who don't really understand what's going on).
Honestly, this whole story
Thank goodness (Score:2, Funny)
Is it time to change passwords? (Score:2)
"The intruders do not appear to have stolen passwords of Gmail users, and the company quickly started making significant changes to the security of its networks after the intrusions."
"Does not appear" falls kinda short of a satisfactory statement. Considering the intruders took two days to get the source code, one wonders what else they were up to in that period of time. I'm changing my gmail password now..
Wrong security model (Score:2)
"theft raises the possibility that attackers could analyze the code to find new exploits to take advantage of in the future"
As Bruce Schenier said, security through obscurity does not work...
Re: (Score:3, Interesting)
That has been a mantra on slashdot since it started and I have never been convinced that it's necessarily true. There are plenty of examples where a security hole was discovered in 10+ years old open source code. On the other hand, there's no way of knowing how many security holes are never exploited because the company whose systems have it keeps quiet.
Re: (Score:2)
As Bruce Schenier said, security through obscurity does not work... That has been a mantra on slashdot since it started and I have never been convinced that it's necessarily true. There are plenty of examples where a security hole was discovered in 10+ years old open source code. On the other hand, there's no way of knowing how many security holes are never exploited because the company whose systems have it keeps quiet.
If you want a more clear example, do some research on encryption algorithms and what it takes before they are considered secure enough for general use.
Re:Wrong security model (Score:4, Insightful)
"theft raises the possibility that attackers could analyze the code to find new exploits to take advantage of in the future"
As Bruce Schenier said, security through obscurity does not work...
Are you sure he said that, or did he say that it was wrong to rely on security through obscurity? Obscurity (i.e. not telling tales out of school) is one valid element of an overall security model.
Re: (Score:2)
Bruce Schneier: Secrecy, Security, and Obscurity [schneier.com]
Paranoia (Score:2, Interesting)
Re:Paranoia (Score:4, Insightful)
This sounds very very bad to me, the worst fact being that security and paranoia always lead to bad decisions and breaches of rights. Even if we believe google's do no evil policy if they are pushed far enough they will become something we don't want.
So don't use their services except perhaps for their search engine, and even then in a highly controlled fashion (NoScript, no cookies, no redirections, no HTTP Ping, no Google Analytics, etc). It's how I deal with my concerns about them.
I have to say this... (Score:2)
In Soviet Google, privacy discloses you.
I've noticed a lot of hacked accounts.... (Score:3, Interesting)
I've been sent spam recently from quite a few people who's gmail accounts have been hacked. Look at the gmail forums....
http://www.google.com/support/forum/p/gmail/label?lid=65ac3f0a8251ca2d&hl=en [google.com]
Filled with spam from hacked account messages. Coincidence?
Yes, coincidence, and much worse than spam (Score:2, Insightful)
Re: (Score:2)
The worst part is, they kept my entire address book in the To: line, so everybody could see what my address book contained.
It included the addresses of a few high-class escorts (for innocent reasons, mind you) and the email address for my department at work who also received the spam - I had some quick explaining [digit4l.net] to do on that one...
Google needs to move to two factor authentication (Score:2, Insightful)
Re: (Score:2)
Re:so? (Score:5, Funny)
http://www.slashcode.com/ [slashcode.com]
Re:so? (Score:5, Insightful)
i'd love to see /. put their source out there, money where their mouth is so to speak.
...You mean like http://www.slashcode.com/about.shtml [slashcode.com] ?
Re: (Score:2)
Ya, and have you ever tried to perform a slashcode install? It is a fucking nightmare, and there is little help. The slashcode available isn't even the current version used to power /., as far as I was able to tell. Hence why you don't see much slashdot slashcode clone sites..
If you know I'm wrong then please feel free to enlighten me..
Re: (Score:2)
How retarded do you have to be to not notice the about -> code link that's been on slashdot for years? Well just look at the parent!
Re: (Score:2)
Re:Security through obscurity (Score:4, Interesting)
there was no mention of whether their security system is buggy or not. The attack was made through a hacked internet site, with the help of an internal employee, not by someone "hacking into" the system. The weak link in the chain is always people, not software.
wasn't this same attack linked to MS internet explorer 6? had to bring that up...of course I could be wrong.
Anyone know of any large company opening up the source code to their security systems?
Re: (Score:2)
The weak link in the chain is always people, not software.
They way I heard it, a person clicked on a link in Messenger; doing so opened a browser, IE presumably; viewing the page linked to in IE triggered a security baddie in IE, letting the site pwn the local machine in question.
So people are the weak link, because they click on links? Or because they don't download all their web pages in wget and analyze them for IE exploits first?
If so, loads of spare time spent tinkering and six years at a university studying CS doesn't make me quite as computer savvy as I th
Re: (Score:2)
Well, for the record, Google's security system IS BUGGY. There has been scattered reports across the internet about how users accidentally have been able to login to other peoples accounts. The problem has been reported to google multiple times on their mailing lists, but google has never given a proper response to it. They are likely afraid of the public PR disaster that would occur if people found out how insecure their google accounts really are.
References: http://answers.yahoo.com/question/index?qid=201 [yahoo.com]
Re: (Score:2)
Would the NSA get https in real time 24/7 from day 0?
Would some local taskforces or feds get a backdoor with a court order re US porn, fraud, threats?
Did China want the same for its issues with Tibet, Xinjiang, Tiananmen Square,
CIA backed cults, officials talking to NGO's, evil journalists, local human rights workers, environmentalists ect.
Did Google play the court order game too long and something had to give.
Someone needed data fast on some issue and Ch
Re: (Score:2)
The value of a copyright lies in its exclusivity-- it is a legitimate monopoly on the right to publish. When a work is pirated, that monopoly is infringed and stolen away.