Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notes on the Celebrity Data Theft

nikcub.com

Post reply on HN
Print view View original

201–210 of 292 posts

Re: Notes on the Celebrity Data Theft

#201

Post by tripzilch »

atmosx wrote: post #52
rayiner wrote: post #2

I wrote this in the other thread on the leak before it died: > Even if the leaks result from one at a time social engineering, it still really calls into question the practical security of the cloud. I doubt it's much harder to steal, e.g. confidential business documents from executives' cloud accounts than it is to steal pictures from celebrities' cloud accounts. > If I were a big organization with confidential info…

> The policy at my previous employer (we handled a lot of extremely sensitive information), was pretty draconian: data never leaves a company desktop, laptop, or blackberry. Really? And how do these devices inter-communicate if data never leaves from anywhere to anywhere? Burying a laptop to the ground would make it safe enough to keep out the bad guys.

> Burying a laptop to the ground would make it safe enough to keep out the bad guys.

That will just drive the bad guys underground.

Re: Notes on the Celebrity Data Theft

#202

Post by uladzislau »

I'm wondering if simple GeoIP check can prevent lots of intrusion attempts - if the user consistently logs in from one location and then suddenly tries to log in with the wrong password from the distant one, that's the red flag that warrants temporary account lockout at least.

Re: Notes on the Celebrity Data Theft

#203

Post by treyp »

uladzislau wrote: post #202

I'm wondering if simple GeoIP check can prevent lots of intrusion attempts - if the user consistently logs in from one location and then suddenly tries to log in with the wrong password from the distant one, that's the red flag that warrants temporary account lockout at least.

problem #1: GeoIP isn't accurate enough

Re: Notes on the Celebrity Data Theft

#204

Post by tripzilch »

yaeger wrote: post #192
fpgeek wrote: post #142

> 6. iCloud is the most popular target because Picture Roll backups are enabled > by default and iPhone is a popular platform. Windows Phone backups are > available on all devices but are disabled by default (it is frequently enabled, > although I couldn’t find a statistic) while Android backup is provided by > third party applications (some of which are targets). Fragmentation, for the (security) win! Not really, of…

Does Android really not provide an auto upload of snapped pictures to the cloud? I was under the impression that they did this way before iCloud even came up. First it was to Picasa or some place, then to the google+ place somewhere. Either way, I don't even remember if the iCloud upload was default or not. When it was introduced I took an interest to find out how to deactivate that in case it was enabled by default.…

Dropbox does it for you. Plus you get a free 50GB dropbox account with many Android devices, so the incentive is there.

Re: Notes on the Celebrity Data Theft

#205

Post by anigbrowl »

jsmthrowaway wrote: post #89
anigbrowl wrote: post #48

Earlier quoted context omitted.

aka 1PointOfFailure. Having spent several years maintaining and repairing computer systems for corporate and professional clients, I can tell you from experience that it is trivially easy to social engineer someone's credentials out of them.

AKA 1FailureToUnderstandTheThreatVector, the common antisecurity argument of lazy or pedantic people. A password manager is not defending against a social engineering attack (how could it?), it's defending against Joe's Blog getting knocked over and your re-used password on Wells Fargo being disclosed. Your comment is a really lame excuse for not using a password manager and is quite a bit of FUD; there is no technic…

I'm at a loss as to what benefit I'm supposed to gain by using one. I don't reuse passwords for anything that actually needs to be secure, though I reuse a few for sites that make me create a password even though I don't care about whether those accounts are secure or not. I dpn't see why I should adopt a password manager just because other people don't practice good password security.

Re: Notes on the Celebrity Data Theft

#207

Post by deanclatworthy »

berberich wrote: post #137
shirro wrote: post #113

Earlier quoted context omitted.

I don't get Apple's password based security at all. The stupid question/answer thing they forced everyone to do was just crazy. You have a physical device in your possession. Apple don't seem to have heard about two factor auth. If the only company on the planet that obsessively ties consumer hardware and software into a single cohesive product can't get their shit together the future worries me. It should be the def…

They've had two-step authentication since March of 2013: http://support.apple.com/kb/ht5570

Only available in certain countries though. Mine being one that isn't yet available (Finland).

Re: Notes on the Celebrity Data Theft

#208

Post by baddox »

runn1ng wrote: post #132
sbarre wrote: post #95

Earlier quoted context omitted.

Don't use an "idiot" password, use a long password.. Good passwords aren't complex, they're LONG.. "this is a really dumb password" is probably actually a really good password. ;-) And also, your "problem" is simply your decision to trade security for convenience. You need to weigh the risks vs. reward and make the choice for yourself. If something goes wrong, at least you'll know why.

The problem is to tap all of that into your phone, every time iOS decides it desperately needs it again, with just stars instead of letters. That's annoying.

I've got a fairly long iCloud password with upper and lower case letters, numbers, and symbols. After four or so years of typing it on iOS devices, I have the muscle memory to type is extremely fast without thinking about it. In fact, to figure out the actual characters of the password, I have to visually reconstruct the physical typing that I do from muscle memory.

Re: Notes on the Celebrity Data Theft

#209

Post by mr_sturd »

harryh wrote: post #3
rayiner wrote: post #2

I wrote this in the other thread on the leak before it died: > Even if the leaks result from one at a time social engineering, it still really calls into question the practical security of the cloud. I doubt it's much harder to steal, e.g. confidential business documents from executives' cloud accounts than it is to steal pictures from celebrities' cloud accounts. > If I were a big organization with confidential info…

Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.

I started using Mitro, recently for the same thing.

I had been slowly working on a system which would store pseudo-randomly generated salts and store one for each individual domain. It would detect which site I was entering my password into, take the relevant salt and digest it against the password I had entered - sending a stupidly long, digested passwords to the sites which would allow for it. The password itself would never leave my computer. Progress was slow, though, and other projects took priority.

With Mitro, I've done a similar thing by pseudo-randomly generating 64-character base64 strings to store as the passwords for my accounts.

Re: Notes on the Celebrity Data Theft

#210

Post by mrweasel »

nodata wrote: post #7

Why is nobody talking about password reset questions?

I'm not sure if it's completely fair, but everytime I see "security questions" I can't help think: "Oh, it's an American site".

Silly "security" questions about mothers, dogs and favorite teachers seems to be cultural to the US (and maybe Canada), why is that?

Post reply on HN