Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notes on the Celebrity Data Theft

nikcub.com

Post reply on HN
Print view View original

261–270 of 292 posts

Re: Notes on the Celebrity Data Theft

#261

Post by baby »

harryh wrote: post #3
rayiner wrote: post #2

I wrote this in the other thread on the leak before it died: > Even if the leaks result from one at a time social engineering, it still really calls into question the practical security of the cloud. I doubt it's much harder to steal, e.g. confidential business documents from executives' cloud accounts than it is to steal pictures from celebrities' cloud accounts. > If I were a big organization with confidential info…

Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.

What if you're not on your computer and you want to check something on gmail, or facebook, or airbnb, etc...

Re: Notes on the Celebrity Data Theft

#262

Post by alexgaribay »

baby wrote: post #261
harryh wrote: post #3

Earlier quoted context omitted.

Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.

What if you're not on your computer and you want to check something on gmail, or facebook, or airbnb, etc...

They have a mobile version that syncs your passwords across devices. I use the iOS app frequently.

Re: Notes on the Celebrity Data Theft

#264

Post by hyperpape »

vertex-four wrote: post #226
runn1ng wrote: post #185

Earlier quoted context omitted.

If it's randomly generated, it's impossible to remember to fill in on your phone. Unless you have it on a piece of paper in your wallet.

Really? I remember quite a few four-word (xkcd-style) random passphrases.

Bingo. I'm actually thinking of diceware.

Re: Notes on the Celebrity Data Theft

#265

Post by MattyRad »

MattyRad wrote: post #119
karlick88 wrote: post #11

While I am complete appalled by the data breach and hope that similar things never happens to anyone again I would like to propose a purely thought experiment: The hacker reported sold the nude photos of Jennifer lawrence for a mere sum of $130 using bitcoin. If we apply game theory here, these kind of data is very difficult to monetize. If you sell one copy of the data, it is then immediately distributed online for…

While I don't actually have any solid grasp of the code that would be required, I imagine it would be possible to release 1 image to show that one does indeed have a collection of "valuable" photos. Once trust has been established that the person probably does indeed have additional photos, people will be more willing to submit bitcoin. You overwrite each pixel of each photo with black. You assign every photo a bitco…

As noted by ______1, the hacker did something similar by censoring the photos and offering to uncensor for bitcoin. The difference here is that people sending bitcoin have no guarantee that the photos will actually be released once the bitcoin is sent. They don't have any guarantee that the posted bitcoin address is not an imposter, and the real address is elsewhere. They don't even have a guarantee that the hacker was already caught, thereby wasting their bitcoin. That system is lacking in trust. A dynamic system described above would help mitigate that problem (even though the hacker could reblack-out each photo and tell them to start again, but that would completely demolish any future trust, although it would hardly be considered "stealing" since the percentage paid of each photo was already released).

Re: Notes on the Celebrity Data Theft

#266

Post by simonw »

anigbrowl wrote: post #205
jsmthrowaway wrote: post #89

Earlier quoted context omitted.

AKA 1FailureToUnderstandTheThreatVector, the common antisecurity argument of lazy or pedantic people. A password manager is not defending against a social engineering attack (how could it?), it's defending against Joe's Blog getting knocked over and your re-used password on Wells Fargo being disclosed. Your comment is a really lame excuse for not using a password manager and is quite a bit of FUD; there is no technic…

I'm at a loss as to what benefit I'm supposed to gain by using one. I don't reuse passwords for anything that actually needs to be secure, though I reuse a few for sites that make me create a password even though I don't care about whether those accounts are secure or not. I dpn't see why I should adopt a password manager just because other people don't practice good password security.

How do you remember all of your passwords?

Re: Notes on the Celebrity Data Theft

#267

Post by king_jester »

TeMPOraL wrote: post #251
king_jester wrote: post #247

Earlier quoted context omitted.

> To be honest, the one I perceive (as a straight, white, middle-class, educated male) larger is the misandristic one. As a person who strives to be good and helpful to every human being equally, regardless of race, gender, orientation or whatever, I get everyday on the Internet and I get flooded by articles and comments saying that everything I do or think is misogynistic, wrong and overprivileged. This is just anot…

> Unless, of course, the things you are doing on the internet are wrong and misogynistic, in which case people are sending you articles and comments for a reason. Fortunately no one sends me anything like that, they just end up in my news feed as I have many friends involved in feminism/minority movements, and because local media loves to spin everything as gender issues. > Certainly if you are a man who doesn't do t…

> Well, even if one has nothing to worry about personally, it's just tiring and demotivating to see all those broad accusations all the time. sigh

You do realize that when people talk about men as a class, that isn't the same thing as a personal accusation, right?

Re: Notes on the Celebrity Data Theft

#268

Post by fluidcruft »

antimagic wrote: post #254
oliyoung wrote: post #150

Earlier quoted context omitted.

My problem is that 1Password et al are curing symptoms, not solving causes. Personal infosec hasn't evolved quick enough to match the technology it depends on. Sure we're comfortable with 12 character, 3 month rotation passwords, but the average 'civilian'? Probably doesn't even have a passcode on their phone despite the massive personal security risk they're carrying around with them. We need to educate and/or provi…

No, no I am not comfortable with 12 character, 3 month rotating passwords. 12 character, ok, but only if the damn thing isn't going to change all of the time. I have a hard enough time remembering my passwords for the computers at work that rotate every three months. You start making it necessary to do that for all of the sites I use on the Internet, and I'll lose access to pretty much every service. Not a workable s…

Why not just extend the 12-char password you are comfortable with using a random 4-character-ish suffix that you change every three months? It doesn't take long to learn a new set of 4 characters.

Re: Notes on the Celebrity Data Theft

#269

Post by simonw »

mrweasel wrote: post #210
nodata wrote: post #7

Why is nobody talking about password reset questions?

I'm not sure if it's completely fair, but everytime I see "security questions" I can't help think: "Oh, it's an American site". Silly "security" questions about mothers, dogs and favorite teachers seems to be cultural to the US (and maybe Canada), why is that?

Having moved to the US from the UK it's really noticeable how poor security culture is here in general. Plenty of things are secured by "the last 4 digits of your social security number", utility companies operate mainly on your address, very limited support for chip and pin (credit cards are still all signature based, and no one ever checks the signature).

Re: Notes on the Celebrity Data Theft

#270

Post by jessaustin »

king_jester wrote: post #267
TeMPOraL wrote: post #251

Earlier quoted context omitted.

> Unless, of course, the things you are doing on the internet are wrong and misogynistic, in which case people are sending you articles and comments for a reason. Fortunately no one sends me anything like that, they just end up in my news feed as I have many friends involved in feminism/minority movements, and because local media loves to spin everything as gender issues. > Certainly if you are a man who doesn't do t…

> Well, even if one has nothing to worry about personally, it's just tiring and demotivating to see all those broad accusations all the time. sigh You do realize that when people talk about men as a class, that isn't the same thing as a personal accusation, right?

Yikes! I don't think that argument would work for any other "class" of people.
Post reply on HN