So is there anything truly damning here or is it just a publicity stunt?
Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
51–60 of 78 posts
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#52Earlier quoted context omitted.
Third -- How was the system breached? Dunno, I just went and quickly braved 4chan (I know... I feel so dirty) to see if anyone was linking anything. They had some rapidshare links up (a 1.4 mb and 1.1mb one). Am grabbing now just to see what they are... I'm curious if there is anymore info on this.
It was a straighforward dictionary hack--her password was "popcorn".
No, it wasn't. "popcorn" is the password after the reset that was posted on /b/. If you look at the screenshots, you'll see that her password was reset using the "Forgot Your ID or Password?" feature.
To reset a Yahoo! Mail password, you need the person's birthdate, zip code, and answer to their "secret question". That information is easily accessible for public figures like Palin. Try it sometime with your friend's email/screenname and Facebook; it's quite easy.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#53Earlier quoted context omitted.
A startup that does no-frills, genuinely secure mail on hardened servers might in fact do pretty well. I've wanted one a lot lately. It's not an easy problem though; you're going to deliberately sacrifice features for security, a tradeoff most customers won't get. It won't solve this problem though; funnelling mail through Yahoo comes with plausible deniability. Funneling it through the email security vault, not so m…
doesn't change the vector of this attack one bit: weak password
Weak password wasn't the vector. Weak password reset feature was.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#54Gov. Palin is under the protection of the Secret Service, and it is a crime committed in the context of disrupting a U.S. election, so the full investigative power of the federal government will be brought to bear. Plus I suspect Yahoo will be very cooperative.
yes, the long arm of the arm will have its day on this one.
However, it is important to remember that most/all revolutionary behavior involves breaking the law. I'm not saying this was an appropriate thing to do. But obviously, whoever did this thought it worth the almost certain chance they would go to jail for what they did.
So, who's the better American? The ones who violate the law and try to effect change or the peanut gallery that kick back and do nothing? Sure, you can say, "I vote". That is something. Its just that others obviously feel more action (even illegal actions) is required to effect change.
Note: I am a member of the peanut gallery. I just bitch and vote. But it is key hacker news that we are at a point in our history where others are deciding to take alternative action.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#55As an aside, I'm coming to this story 18 hours late, but every single link posted on this page, is down. Wikileaks is even down. All of it.
I feel bad for the script kiddies that did this. They are going to get Mitnicked on this one: http://en.wikipedia.org/wiki/Kevin_Mitnick
General law enforcement in the US is crap when it comes to computer crime, but if you get the boys at the NSA, the FBI or at Secret Service interested, you're going to be spending a lot of quality time exercising in a little room with metal bars for a wall. And, if you have any sort of "ideological" basis for your acts, I wouldn't be surprised to hear the word "terrorism" creep into the DA's vocabulary at some point during your legal proceedings.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#56I'm no fan of Palin, but I think it's pretty low of Gawker to gain page views by posting the contents of her personal emails, as well as the personal photos. Apparently privacy rights don't matter anymore.
If it was just personal emails you'd be right, but she broke the law and conducted state business with her Yahoo account. While it was reported before, this confirms it. I'd say since she routinely used her Yahoo account for state business it should be public, just like her main account.
Please provide:
1) legal citations to the Alaska and/or Federal laws that say an elected official may not use a personal email account to conduct business.
2) links to the email(s) showing evidence that she broke a law.
3) an explanation as to why you are angry about a claim, stated without any evidence, that she broke the law, but quite happy about an ideological friend who has clearly broken the law and violated someone's privacy; and how you justify the difference.
4) an explanation as to why those people you agree with are innocent even when they've obviously committed a crime, but those you disagree with are guilty until proven innocent.
5) the name of a good civil defense attorney. Public accusations of the criminality of the unconvicted are legally actionable.
6) an explanation as to why murderers should be able to walk free if evidence was illictly obtained, but for the most smeared Presidential-ticket candidate in the last century no accusation is too baseless or low.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#57As an aside, I'm coming to this story 18 hours late, but every single link posted on this page, is down. Wikileaks is even down. All of it. I feel bad for the script kiddies that did this. They are going to get Mitnicked on this one: http://en.wikipedia.org/wiki/Kevin_Mitnick General law enforcement in the US is crap when it comes to computer crime, but if you get the boys at the NSA, the FBI or at Secret Service int…
Funny, I really don't feel bad for people who break into other people's accounts and steal their information.
Whom I feel bad for is all the regular folks that had the same thing happen and are not running for office.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#58Earlier quoted context omitted.
It was a straighforward dictionary hack--her password was "popcorn".
No, it wasn't. "popcorn" is the password after the reset that was posted on /b/. If you look at the screenshots, you'll see that her password was reset using the "Forgot Your ID or Password?" feature. To reset a Yahoo! Mail password, you need the person's birthdate, zip code, and answer to their "secret question". That information is easily accessible for public figures like Palin. Try it sometime with your friend's…
If that's true, I think it's very interesting. I wonder if the security community will step up and take advantage of this opportunity to discuss the inherent security issues with the "secret question" method of account recovery.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#59Earlier quoted context omitted.
A startup that does no-frills, genuinely secure mail on hardened servers might in fact do pretty well. I've wanted one a lot lately. It's not an easy problem though; you're going to deliberately sacrifice features for security, a tradeoff most customers won't get. It won't solve this problem though; funnelling mail through Yahoo comes with plausible deniability. Funneling it through the email security vault, not so m…
doesn't change the vector of this attack one bit: weak password
Yes it does change that vector. I'm talking about the physical tokens which generate a new key every 30 seconds, like:
http://www.rsa.com/node.aspx?id=1156
This way you need to know the password _and_ have the physical token in your hand to know the current key. On the downside, it's also a hassle to carry it around and use it (I have a couple of 'em for access to various supercomputers), so I wouldn't bother doing it for my own email, but if you're a public figure or otherwise sufficiently paranoid it might be worthwhile.
Re: Anonymous hacks one of Gov. Sarah Palin's yahoo email accounts
#60Earlier quoted context omitted.
No, it wasn't. "popcorn" is the password after the reset that was posted on /b/. If you look at the screenshots, you'll see that her password was reset using the "Forgot Your ID or Password?" feature. To reset a Yahoo! Mail password, you need the person's birthdate, zip code, and answer to their "secret question". That information is easily accessible for public figures like Palin. Try it sometime with your friend's…
If that's true, I think it's very interesting. I wonder if the security community will step up and take advantage of this opportunity to discuss the inherent security issues with the "secret question" method of account recovery.
Bruce Schneier's one of the more prominent security writers around, and he covered that one over three years ago: http://www.schneier.com/blog/archives/2005/02/the_curse_of_t...
Where I work, all webmail is blocked, so the IA department is grateful to Palin for the object lesson supporting the policy.