Wired Writer Hack Shows Need For Tighter Cloud Security 132
Nerval's Lobster writes "Between 4:52 and 5:12 on August 3, attackers used Wired writer Mat Honan's Apple ID to wipe his MacBook, before seizing control of his Gmail and other online identities ('My accounts were daisy-chained together,' he wrote in an Aug. 6 postmortem on Wired), and posting a message on Twitter for all to see: 'Clan Vv3 and Phobia hacked this twitter.' In the wake of Honan's high-profile hack, there are some key takeaways. Even if a typical user can't prevent a social-engineering attack on the company hosting their cloud account, they can armor their online life in ways that make attacks more difficult. First, two-factor authentication can prevent an attacker from seizing control of those vital 'hub' accounts (such as Gmail) where users tend to store much of their most vital information. Google offers two-step verification for signing in, as does Facebook. The truly security-conscious can also uncouple their cloud accounts; for example, making sure that iCloud and iTunes use two different sets of credentials. That might rob daily life in the cloud of some of its convenience, but it could also make you a harder target."
Update: 08/08 01:17 GMT by S : This high-profile security breach has had an impact already: Apple has suspended password resets through customer support, and Amazon no longer lets users call in to change account settings.
So much for ... (Score:5, Insightful)
Re: (Score:2)
Apparently, the 'single sign-on' of the future will be practically any trivially available biographical information...
Re: (Score:3)
Single sign on vs multiple sign on is irrelevant when the attacker gets control of your main PC where all your credentials are.
Re: (Score:3, Interesting)
Single sign on vs multiple sign on is irrelevant when the attacker gets control of your main PC where all your credentials are.
No one got control over his PC in this case.
And why would anyone store credentials on their PC?
Re: (Score:1)
I've known full tier 3 system admins (aka: Sr Sys Admins) store plain text passwords on their desktop in txt files labled "god_servername.txt".
There is also a huge amount of admins that keep password safe like programs on their local machines instead of in a "safe" location.
Re: (Score:1)
Storing plaintext passwords in a text or KeePass database can be decently secure... provided they are stored on something with reliable security.
I personally like a TC volume on an IronKey [1]. This provides two layers, and in addition, some anti-brute force capability since the IronKey will zap itself after ten failed attempts.
[1]: They are now sold by Imation. I hope the new models keep the security features of the old ones before the changeover.
Re: (Score:2)
Oh, I figured they used his Apple ID to log into his Macbook, where they could harvest the rest of his credentials. But instead, he gave all his log in info to Apple who gave it to the attacker. Duh.
Something like SSH agent would have easily prevented this attack.
Re: (Score:2)
Once they had his Apple ID they logged into the iCloud service and issued remote wipes on all his devices that he had activated the wipe option on. Since he used the same credentials everywhere they were able to get into Twitter and Google as well.
As for loosing all his data, he should have had a backup. Apple makes this super
Re: (Score:3)
How would SSH agent help here?
People use the same credentials on multiple web sites for convenience. Something like SSH agent could provide the same convenience, while allowing people to have different keys for different systems AND keeping all those keys in one secure place.
Re: (Score:2)
But in the case of this hack the services that were compromised were Amazon, Gmail, and iCloud web pages. All things that authenticate with user/password and not SSH keys.
Re: (Score:2)
That's why I say "something like SSH agent". There's no technical reason we can't have a web based authentication mechanism that works the same way SSH agent does. Getting such a standard widely implemented would be the hard part.
Re:So much for ... (Score:5, Interesting)
For those that don't know how ssh-agent works:
You have two parts to your key, one part encrypts only (public key) and the other part decrypts only (private key). The remote server sends a random message encrypted with the public key; that message is sent to the ssh-agent program, which decrypts the message with your private key which it has in memory. This decrypted message is sent back to the remote server -- if it matches what it randomly generated, it know that your are in possession of the private half of the key and lets you in. The secure part is that your private key is never sent over the wire, and never leaves the memory of the ssh-agent program (unlike a regular password).
Now one thing I've done in the past to make this more secure (when I carried a Nokia N900 linux-based phone) is I ran the agent on my phone only, and forwarded the connection to my PC via Bluetooth. I had it set up so that it would auto pair with PCs that I trusted (and play a particular sound on the pone during pairing and key usage), and require an accept button on the phone for other machines. I've been meaning to pick up Android programming so that I could port this over to my current phone. Oh, and when the agent program gets started on the phone, it requires a symmetric decryption key (protects it if the phone is stolen). Probably security overkill, but in my case I used it more for convenience than anything else.
Re: (Score:2)
So for them to get at the private keys and/or stored passwords he must have used the same password for both login and the Keychain...
He should also look into FileVault... Even if Apple resets the login password, they don't ha
Re: (Score:1)
Re: (Score:2, Insightful)
Exactly.
As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keys
were stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing over
access to his account, and once one password was known, the hacker could log in everywhere.
What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Ap
Re: (Score:1)
Exactly.
As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keys
were stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing over
access to his account, and once one password was known, the hacker could log in everywhere.
What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Apple would do such a thing. Yet Social Engineering is one of the primary methods of spectacular security breaches.
Still one has to ask, why this guy was chosen as a target. I suspect the attacker had just that little piece of inside knowledge that gave him just enough to nudge the Apple tech over the brink.
He was chosen as a target because he had a 3-character twitter account name that the attacker wanted.
Re: (Score:1)
What? No, his passwords weren't the same. His email *addresses* followed a recognizable template, i.e. mhonan@whatever.com, and his password-recovery addresses were daisy-chained so that when they got into his Apple ID, they could reset his GMail, which could reset his Twitter.
+5 Insightful my ass. RTFA, it's long and detailed:
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/
Re: (Score:2)
SSH? over the phone? for social engineering? enlighten me.
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ [wired.com]
"Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information."
Re: (Score:2)
Where else would you store them? In your head?
Apple (Score:5, Interesting)
There are some Apple employees that ought to lose their job over this and Apple ought to pay this guy something significant for screwing him over.
Re:Apple (Score:4, Interesting)
There are some Apple employees that ought to lose their job over this...
It shouldn't be the support person that answered the phone, though. Apparently they followed Apple's procedure of requiring only a billing address and the last four digits of a credit card number to gain access to the account.
Re: (Score:3)
It happens to make sense. It is so much more likely that such a call comes from a genuine customer in distress than from a hacker that, from a risk management point of view, that procedure is much better than telling a genuine customer "you should have been more careful, now you are hosed". Welcome to the real world.
Perhaps they should require a differ
Re: (Score:3)
*In fact, for any one type of card from any one Danish bank, the first 8 are identical.
Re: (Score:2)
Only the fist 6 and last 1 are "not random". The first 6 are the ISO number (formerly the BIN - Bank Identification Number) and are assigned to the card issuer, and the last is a check digit calculated from the full card number excluding the last digit. However, the last 4 are commonly printed on receipts, so they're not exactly "secret". But on a 16 digit number, that leaves digits 7-12 as relatively unknown (unless you have the full card number).
Re: (Score:2)
Re:Apple (Score:4, Insightful)
What procedure would you suggest to tell the genuine customer that they just gave away your account and all your information you thought was properly backed up is now deleted?
Re: (Score:2)
Customer in distress?
Forgot their mother's name?
Come on! If you are that distressed, why do you need access to your apple account? Call 911, not Apple.
Re: (Score:2)
Better than the first four.
Re:Apple (Score:4, Insightful)
Wait, why would any credit card digits and an address be sufficient?
You hand that over every time you buy something.
Why would apple bypass their own security questions and open the account to someone who can't remember any of those?
Seriously who forgets their Mother's maiden name or their first pets name?
Re: (Score:2)
Re: (Score:2)
Seriously who forgets their Mother's maiden name or their first pets name?
Any idiot that actually replaces a high-security password with a low security, common knowledge item like MMN I hope to $diety never works as any type of admin in IT. I would assume anyone that thinks about it names their pets with a high-security name (like MD0km2!#nm1, or correct-horse-battery-staple if you prefer that style).
Re: (Score:2)
I just choose random words and phrases that have nothing to do with the original question. For example:
And so on.
But first.. (Score:5, Insightful)
we need a tighter way to detect reposts
Re: (Score:1)
What? The previous article was about Gizmodo editor Matt Honans. This is about Wired writer Mat Honan. Obviously two completely different people.
Re: (Score:3)
What? The previous article was about Gizmodo editor Matt Honans. This is about Wired writer Mat Honan. Obviously two completely different people.
He's not fooling anyone.
Re: (Score:2)
Maybe his psychiatrist.
Re: (Score:2)
That would've been funnier if you'd said "Wired write Mat Herman".
is there a way to turn it on without a phone #? (Score:3, Informative)
When I try to turn on two-factor authentication at Google, it gives me a screen that asks me for a phone number, and doesn't seem to have a way to bypass this. I'd rather not give them my phone number.
Their help pages say that you don't have to use SMS-based authentication. Apparently there is a setting, once two-factor authentication is enabled, to switch from receiving the codes via SMS, and instead either write down a batch of 10 "backup codes" at a time, or else install the Google Authenticator app, initialize it with a key, and then use it to generate tie-synchronized codes thereafter. Either of these solutions is fine with me. But how do I enable them without having to give Google my phone number on the initial screen?
Re: (Score:1)
Sign up for a google voice (or voip or something) account?
Maybe with a different password.
Re: (Score:3)
Sign up for a google voice (or voip or something) account?
Maybe with a different password.
Second point in the FAQ:
Why you shouldn’t use Google Voice to receive verification codes [google.com]
If you use Google Voice to receive verification codes, you can easily create a situation where you’ve locked yourself out of your account.
For example, if you are signed out of your Google Voice app, you might need a verification code to get back in. However, you won’t be able to receive this verification code because it will be sent to your Google Voice, which you can’t access.
Re:is there a way to turn it on without a phone #? (Score:5, Insightful)
Well, for 20-ish dollars you can set yourself up with a burner prepaid phone and a very meagre SMS allotment...
Aside from that, though, I suspect that Team Google wants your convenient personal identifier for totally altruistic security reasons...
Re: (Score:2)
I think Google says it all in their description of their 2-factor authentication
2-step verification drastically reduces the chances of having the personal information in your Google account stolen by someone else
Emphasis mine but yeah, straight from their site [google.com]
Re: (Score:2)
Re: (Score:2)
There is no reason to turn on two factor authentication for some secondary email, or even use a Gmail account for this.
You get non-descript messages with some digits in this email, and they are use-once codes. You can paste them on the bulletin board after you use them and nobody could use them again.
Once you get the Google Authentication app on your phone, you need never use this again.
Lose your phone? [google.com]
Re: (Score:2)
As far as I could tell, they don't verify the number. I had no problems setting it to a landline instead of my mobile phone.
When I last configured it I got the "10 burn codes" and an option for a phone number, where a robot would dial and read up some numbers.
So app on my phone, plus that piece of paper hidden away, plus a stable landline to someone I trust.
Re:is there a way to turn it on without a phone #? (Score:5, Informative)
You have to have a phone to set it up. You can then disable the phone and re-enable it with:
> Mobile application
> Switch to an app to get codes even when you don't have cell coverage.
And then remove your phone #. So at minimum it's going to cost you a burner phone.
The awesome thing about Google Authenticator is that it's open source. You can download and compile a PAM package (and it's in the Debian repositories). http://code.google.com/p/google-authenticator/ [google.com] So anything that uses PAM can use google authenticator.
I have it setup on my outward facing SSH server so to get into my house's server you're going to need my password and one of my devices.
Re:is there a way to turn it on without a phone #? (Score:5, Insightful)
You have something important enough (maybe email) on Google that you want 2-step authentication, and you're concerned about them having your phone number? What exactly are you afraid they can do with it? (I get the point of not wanting other information online)
Re: (Score:2)
Re: (Score:3)
You don't have to give them YOUR phone number, nor does the phone have to be able to receive SMS.
Google will use a computer voice to read the digits to you. This number does not need to be your permanent number.
You just need ANY phone number that you can answer.
You will need it exactly twice.
Once to set things up on your computer.
Then again to get the Google Authentication app authorized. From then on you don't need to give them your phone number.
Re: (Score:2)
Re: (Score:3)
Re:Pissants (Score:5, Informative)
Unfortunately, in this case, at least on the Amazon side, it doesn't look like social engineering. It looks like a classic escalation attack in the same theme as the cuckoo egg: use weak credentials to deposit a payload that can then be used as strong credentials.
While social engineering is pernicious and relies on people violating policy in the name of being helpful or customer service (often without realizing they are doing it!), this is a straight up bug in the CS procedures.
Unfortunately, a similar bug in Apple's CS procedures allowed for further escalation.
Re: (Score:2)
"That said, social engineering is a criminal skill, not a technical one."
I know a LOT of sales people and Lawyers that will seriously disagree with you.
Sales = Social engineering.
Lawyering = Social Engineering.
Re: (Score:2)
"That said, social engineering is a criminal skill, not a technical one."
I know a LOT of sales people and Lawyers that will seriously disagree with you.
Sales = Social engineering.
Lawyering = Social Engineering.
You must be a politician, otherwise you would have had politicians at the top of your list.
Re: (Score:2)
No, politics is just plain old bold faced lying until you believe your own wild stories, if you are lucky you sucker others along with you. It's a completely different thing.
I think the technical term for it is disillusionment.
Re:Pissants (Score:5, Interesting)
No "hacker" should call himself such, by simply being able to sweet-talk a minimum wage drone over the phone.
You're being pedantic and glorifying the term 'hacker' way too much.
http://en.wikipedia.org/wiki/Kevin_mitnick [wikipedia.org] - this guy is usually referred to as a hacker, even though sweet talking minimum wage drones over the phone was his bread and butter. I get that you want to distinguish between the technologically adept and inept, using the terms 'hacker' and 'script kiddie' to do so, but the article is using the term 'hacker' in a legal sense; as in someone who commits crimes almost exclusively through the use of technology. My dad referred to himself as a hacker but he never committed a crime using his computer/phone. He just meant that he liked to hack out code.
Joe can be a man's name. Joe can be a cup of coffee. Joe can be a member of the armed services. Basically, you're arguing that your cup of coffee shouldn't be called Joe because that's your name.
the cloud would have made it more secure (Score:1, Interesting)
hackers grab his info from whois because he has a personal site from blogging
they use that to hack his amazon account
and then use the info from amazon to hack icloud
if he had just used wordpress or blogger or some other cloud service this hack would have been A LOT harder. it's 2012, no need to reinvent the wheel by setting up your own server for email, web site photo sharing or the 20 other things that da cloud has made easier and more secure. he just wanted to be uber tech cool and show off how he can run
Re: (Score:3)
Basically you're saying that no one should have an entry in the whois database because we can't have nice things.
The whois was just one way of doing this, I'm sure more than a few people's mailing address can be obtained from a google search (I know mine can, I've had to post too many PDF resumes.)
The problem is Apple and Amazon use knowledge of a mailing address as a credential, in the same way that many silly organizations use knowledge of the last four of your SSN.
Re: (Score:1)
Basically you're saying that no one should have an entry in the whois database because we can't have nice things.
Having a "helpful" customer service which disregards security best practices when it is "convinced" of a genuine need is also a nice thing. Publically posting your residential address on facebook and publically announcing your holiday itinerary on facebook is also a nice thing.
And yes, we can't have nice things. "Having nice things" is the enemy of security, and even privacy. What is wrong in saying we can't have nice things? (Except that it is obvious.)
Re: (Score:2)
Note that a residential address is not just something you post on Facebook, but something that exists in the yellow pages, on Google, and any number of direct mail, marketing, government, and tax databases -- it is public information which, by design, must be distributed to people holding any level trust, and is specifically not administered by the owner. Proposing that
Re: (Score:1)
It is useless to stick to publically posting residential address point. It becomes dangerous only in conjunction with associating it with facebook profile and publically posting one's vacation plans on facebook.
No one is advocating keeping one's residential address private. But advertizing it along with other information becomes dangerous as is well studied.
Nothing ever changes in IT (Score:3)
Nothing ever changes in the eternal wheel of IT.
You as a customer are never worth more than the cost of sales of replacing you.
So it has always been in all previous IT fads, so it shall forever be in all future IT fads.
Non-authoritative authentication (Score:5, Insightful)
Hey, I have an idea. Let's stop using non-secret information as authentication credentials. Address, birthday, mother's maiden name, last 4 digits of CC or SSN, CVV, childhood pet's name are NOT AUTHENTICATION. Authentication information should never be printed, emailed, or typed in the clear.
Personally, I've been putting random numbers in all those fields for years, and if the account contains sensitive information, recording that information in an encrypted way in the event that it is ever needed. So far, I've never needed such information (because I also record and encrypt my randomly-generated passwords).
Get KeePass [keepass.info] and enable two factor authentication. Then, call your bank and CC company and tell them the security on your credit card is absurd. Because who cares how good your Google password is if the guy standing behind you at 7/11 can get all the info he needs to defraud you by holding out his camera-phone while you buy your Gatorade?
Re:Non-authoritative authentication (Score:4, Interesting)
Nothing annoys me more than "security" questions. First, so many sites share the "secret" answer that it's really not secret, is it? Second, I'd prefer to not make vulnerable even yet more personally identifying information. Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!
Re: (Score:2)
Re: (Score:2)
Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!
"This is your brain on drugs"
Re: (Score:2)
Yes, it's a drug called "old age". I highly advise that you stay away from it.
Re: (Score:1)
You forgot "What High School did you attend?"
(Short list of answers: Washington, Jefferson, Adams, Lincoln, Wasilla...)
Re: (Score:2)
Authentication is not the same as proof of identity. Authentication is not ID, nor is ID Authentication.
But how does one PROVE who they are? In order to PROVE you are who you are, you need a chain of trusted Identification.
1) Peter Knows Mary, Peter can ID Mary. But is Peter is not Trusted (yet)
2) Paul ALSO knows Mary. Paul can also ID Mary, and Paul is trusted.
3) Jane, Sue and Michael all know Mary. They all can ID Mary, but offer various levels of trust.
In each of these scenarios ID can be established pro
Re: (Score:2)
For 99% of internet applications, authentication is sufficient. Google, Apple, or any vendor doesn't need to know who I am, and they damn well don't need to link that info to my bank or tax records. It's none of their damn business. I don't want to identify myself.
All that is required is to identify that the person making the request is the same one that established the account. Pure authentication, no identification. We've all done ourselves a major disservice by muddling the two. Of course, Google
Re: (Score:2)
Trust is not linear. Identity is.
Trust is a scale -10 ... 0 ... +10 ... +10
Identity is a scale 0
When you meet someone new, you start at 0 on both scales, completely neutral. What I propose is building identity through trusts (positive).
I know Paul, Paul is a liar. You know Paul, you don't know anything except what I've told you. Do you trust me?
Peter, Jane and Mary all claim to know me, and all say I'm a liar. They also say Paul is a good guy. Do you trust me? Do you trust them?
Michael, Greg, Steven and Ji
Re: (Score:2)
I don't see your point. What does that have to do with TFA? And why would I ever want to identify myself on the internet? As far as I'm concerned, there are two entities that need identity: banks and the government. All others don't need it, and induce liability, crime, and fraud by retaining identity information. With fraudulent identity information, one can perpetrate new fraudulent transactions with third parties unrelated to the source of the leaked identity information. With fraudulent authentica
Find My Mac / Fuckup My Mac (Score:4, Funny)
Wow did even realize icloud had the ability to Remote wipe my computer.
Currently Turning OFF this feature !
Re:Find My Mac / Fuckup My Mac (Score:4, Insightful)
The attacker can just turn it on again.
Why insightful? (Score:2, Insightful)
The attacker can just turn it on again.
Why is this modded insightful? You can't "just turn on" remote wipe, er, remotely. You have to enable it on the machine first, and you need an administrator account to enable it on the machine.
no one will care for your data like you do (Score:3)
Yet another post on this idiot? (Score:4, Informative)
Re: (Score:2)
Re:Yet another post on this idiot? (Score:5, Interesting)
Because he's not the only idiot. You would be surprised how many tech savvy people have no backups and are equally vulnerable. Also it's something worth highlighting as it has shown critical flaws in bot Amazon and Apple's authentication systems. And it persuaded me to go ahead and set up 2-step authentication on Google, and I am damn glad I did.
Re: (Score:1)
I find that people complaining about the backup habits of other users are typically the ones with no solid backup plans themselves. Of course, I can't say if this is true in your case. You're correct in your assertion that he should've had backups, however.
Social engineering has everything to do with security, by the way. If you're vulnerable to social engineering (either via lack of proper security policies or a failure in training of personnel that have access to sensitive data), your security is compromi
Email is the weakest link (Score:3, Informative)
When a password reset is requested, a new password is sent to your email address. So, if a hacker gains access to your primary email account, then he has access to ALL of your accounts. (In fact, since email isn't encrypted, he only has to be able to intercept the password-reset message somewhere in transit.)
Email is the weakest link on the internet.
Re: (Score:3)
Email is the weakest link on the internet.
This. I am amazed by the professionals in information handling who genuinely answer that Email is fine for exchanging sensitive information. I heard a hospital IT manager honestly answer that he thought that email of patient record via PDF was fine. Sigh.
Re: (Score:2)
It is no longer entirely true that e-mail is not encrypted. Many SMTP servers support encryption using SSL or TLS when communicating with another SMTP server. For example here is an example of an SMTP server receiving an e-mail from one of Google's gmail SMTP servers.
Aug 7 13:33:28 x postfix/smtpd[22642]: setting up TLS connection from mail-gh0-f182.google.com[209.85.160.182]
Aug 7 13:33:28 x postfix/smtpd[22642]: Anonymous TLS connection established from mail-gh0-f182.google.com[209.85.160.182]: TLSv1 wit
Defending in Depth? Or Eggs in All Baskets? (Score:1)
My current theory on cyber security is to put all of my eggs in a few baskets rather than spreading them out. My primary email accounts are operated by Google, with Google Authenticator providing two-factor security. I have LastPass providing complex and unique passwords for every website out there, and again, I have Google Authenticator providing two-factor security for that as well. Because LastPass has essentially scrambled all of my logins, I cannot access any website--including the email--without LastP
Re: (Score:2)
I use LP too, though I have to confess that I don't make full use of their password generation feature. I haven't tried the mobile apps - do those make it easy to log into sites from your phone? What about when you're at a different computer (not your own) - you simply use the mobile app to retrieve your password?
Re: (Score:2)
I use LP too, though I have to confess that I don't make full use of their password generation feature. I haven't tried the mobile apps - do those make it easy to log into sites from your phone?
Yes..
What about when you're at a different computer (not your own) - you simply use the mobile app to retrieve your password?
... and yes (if by mobile app you mean log on to the web site). You could, of course, also have a mobile version of Firefox with Lastpass so there is no danger of keylogging your Lastpass sign-in.
Amazon screwed up and enabled Apple screwup. (Score:1)
So, the Apple intrusion would not have happened if Amazon had not facilitated the recovery of this guy's credit card details.
If Amazon had not allowed the addition of a credit card number OVER THE PHONE and had not reset the password OVER THE PHONE all would have been ok.
Both Apple and Amazon should have required email confirmation before resetting passwords.
Gee, not only is there no privacy on the web (Score:1)
2-step authentication from google is sub-par. (Score:2)
2-step authentication from Google still requires a cell phone. For anyone who does not own a cell phone (such as myself), it is major hurdle to upgrading the security on my account.
It is a shame google does not sell SecurID or similar key fobs for those who want security, but don't have a cell phone.
Re: (Score:2)
Clouds! (Score:3)
It doesn't surprise me in the least that clouds are not secure. I mean they are fluffy white things in the sky made mostly from water vapour. How can something like that be secure! Though they are someone intangible, and pretty hard to reach without some sort of assistance from earth. But hell birds can access them, birds! Do you think anything that birds can access is really secure?
Birds, the sky hackers!
Also Apple tech support sucks (believe me, I used to know some), and don't use the same password for everything...
Well I'm off, gotta go change my Apple passwords, see ya! :)
Here we go again (Score:2)
The people with the excuses on why the cloud isn't at fault, how it's always the fault of the users.
Cloudbois?
he's not a writer for Wired (Score:2)
He writes for Gizmodo.
I asked him why. Was I targeted specifically? Was this just to get to Gizmodo’s Twitter account? No, Phobia said they hadn’t even been aware that my account was linked to Gizmodo’s, that the Gizmodo linkage was just gravy. He said the hack was simply a grab for my three-character Twitter handle. That’s all they wanted. They just wanted to take it, and fuck shit up, and watch it burn. It wasn’t personal.