Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notes on the Celebrity Data Theft

nikcub.com

Post reply on HN
Print view View original

101–110 of 292 posts

Re: Notes on the Celebrity Data Theft

#101

Post by dreamfactory2 »

sbarre wrote: post #91
dreamfactory2 wrote: post #86

Earlier quoted context omitted.

I got screwed by a password manager that got deleted during upgrading a hard drive. Never again

1Password lets you store your (encrypted) password keychain on Dropbox to sync across devices. You didn't get screwed by a password manager, you got screwed by a bad backup policy.. Sorry to be pedantic - and I feel your pain for losing your data - but there you go..

It was definitely my stupid fault but the fact is that it introduced a bunch of fragility and less control into password management for me and wasn't a great solution. But it seems increasingly clear to me these days that internet-connected devices are simply unsuitable for anything which requires privacy in any case.

Re: Notes on the Celebrity Data Theft

#102

Post by [deleted] »

[deleted] wrote: post #67
karlick88 wrote: post #11

While I am complete appalled by the data breach and hope that similar things never happens to anyone again I would like to propose a purely thought experiment: The hacker reported sold the nude photos of Jennifer lawrence for a mere sum of $130 using bitcoin. If we apply game theory here, these kind of data is very difficult to monetize. If you sell one copy of the data, it is then immediately distributed online for…

[deleted]

[deleted]

Re: Notes on the Celebrity Data Theft

#103

Post by stevenh »

ahelwer wrote: post #28
stevenh wrote: post #24

Reddit should not be listed among the sites hosting the stolen images, as reddit does not support image uploads. Imgur is the primary site hosting the stolen images in that case.

Are we still unable to move past this pedantic hosting-vs-linking nitpicking? It's like you willfully ignore how content discovery works on the Internet.

I'm merely attempting to correct the author's libelous statement about reddit. Reddit has never hosted any stolen photos, period.

Imgur revealed earlier this year that they have similar image detection built into their back end. Despite the ease with which they could use this to automatically sweep 99.9% of the Jennifer Lawrence photos off of their site the instant they're uploaded and shadowban the uploaders, and despite the fact that every one of their 12+ employees knew about this leak the instant it happened and also knew that their own site would probably be one of the two most actively used to spread the images around the world, half of the Jennifer Lawrence albums I checked there still have all images intact. One album has over 30,000 views and has existed for two days. Why haven't they activated their similar image detection algorithm in this case? At best, this is neglect bordering on malice.

The damage Imgur does by actually hosting these stolen images and dragging their feet for as long as possible when responding to DMCA takedown requests has nothing whatsoever to do with a text-only discussion thread on reddit. The author should correct this accusation and lay the blame where it belongs.

Re: Notes on the Celebrity Data Theft

#104

Post by phillmv »

ANTSANTS wrote: post #68
nodata wrote: post #7

Why is nobody talking about password reset questions?

I hate those so much. They lock me out of my accounts more often than they help. I always enter bogus answers because I think I'll never need to use the feature, then I run into a situation like: "Resetting your password via email? Ok, you also have to answer these security questions that you entered 'akjhdhksdfsdf' into when you made your account!" or "You've logged in from a new computer! Please try to remember wha…

1Password can store those for you as well.

Re: Notes on the Celebrity Data Theft

#105

Post by TeMPOraL »

ddrmaxgt37 wrote: post #75
lambdasquirrel wrote: post #73

The thing that bugs me is that you could have good password practices. But if you're having a party, having a fun time (and lets face it, people are going to do shit...), and one of your friends is snapping photos of you, and they have bad password practices, then you are kind of screwed. People don't typically make friends on the basis of: do you have good password practices.

Yup. And that very reason is why many people don't have social networking accounts. You can control what you share, but you can't control what your friends share.

How not having a social networking account helps with that? Not only you still can't control what your friends (that is, the real-life ones) share, now you're the last to know if they share something about you.

Re: Notes on the Celebrity Data Theft

#106

Post by TeMPOraL »

shampine wrote: post #88
city41 wrote: post #78

> Password reset is answering the date of birth and security question challenges (often easy to break using publicly available data – birthdays and favorite sports teams, etc. are often not secrets) I really dislike this trend of "personal questions" to reset your password. The first car I owned or where I'd like to retire is easily obtained information. When are websites going to stop doing this? I answer these ques…

What about just using a basic cipher for your questions? It is what I do. So if the question is "What was your first car?" Answer could be: Ford Instead it is Enqc or droF or Gpse

Well like many such website "security" practices, if you know why they're bad, they are no longer a problem for you. But normal people don't know why security questions are a stupid idea, so when an otherwise reputable website (like an e-mail provider) asks you for your first car or favourite toy, they assume it's how things are supposed to be on the Internet.

Re: Notes on the Celebrity Data Theft

#107

Post by thom »

karlick88 wrote: post #11

While I am complete appalled by the data breach and hope that similar things never happens to anyone again I would like to propose a purely thought experiment: The hacker reported sold the nude photos of Jennifer lawrence for a mere sum of $130 using bitcoin. If we apply game theory here, these kind of data is very difficult to monetize. If you sell one copy of the data, it is then immediately distributed online for…

An almost Dawkins-esque level of tone-deafness.

Re: Notes on the Celebrity Data Theft

#108

Post by harshreality »

tlrobinson wrote: post #54
harryh wrote: post #3

Earlier quoted context omitted.

Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.

While I think using password managers with random passwords is far better than sharing the same password between every account, I've never really gotten comfortable with storing passwords in a file on my computer. What I'd really like is a password manager hardware dongle of some kind, like the Bitcoin Trezor wallet.

This is eventually going to be solved to a large degree by things like FIDO Universal 2-Factor dongles or whatever they evolve into over the next few years.

It'll basically push specialized requirements to the hardware dongle (ie deciding whether it's enough to confirm user registration/authorization with the touch of a buttom, or whether it needs to be with a 4 digit pin, or even with biometrics like voice or fingerprint or iris scan). The test device in the following presentation video only uses a button press to confirm user intent, but it could have arbitrary requirements, making the protocol usable for both trivial website logins to online banking to eventually perhaps even a replacement for defense department CACs.

Here's a good fairly in-depth video presentation of what the FIDO Alliance is working on (there are functional test devices, and a functional test branch of Chrome that works with them):

http://www.yubico.com/2014/07/future-online-authentication/

Re: Notes on the Celebrity Data Theft

#109

Post by hrabago »

lambdasquirrel wrote: post #73

The thing that bugs me is that you could have good password practices. But if you're having a party, having a fun time (and lets face it, people are going to do shit...), and one of your friends is snapping photos of you, and they have bad password practices, then you are kind of screwed. People don't typically make friends on the basis of: do you have good password practices.

Information my friends have is something I've had to accept letting go.

I once resisted signing up to Viber because it required that I upload my entire address book. However, I found out how many of my friends are already on Viber, which means the likelihood that Viber didn't already have someone's contact information was very low. It also meant Viber already had all of my contact information.

Another scenario is Facebook's tagging. Even if I don't confirm all (or any) of my friends' tags on my face, the fact that they manually tagged the face as mine likely counts a lot for FB, so that battle is already lost.

Re: Notes on the Celebrity Data Theft

#110

Post by TeMPOraL »

api wrote: post #100

Read the comments to this blog post. The misogynistic mouth breathers are out in full force as usual.

Just wait for the misandristic crowd to show up, as they always do. I'm just starting to see first articles in my Facebook feed trying to spin this celebrity leak into women oppression problem.
Post reply on HN