Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers selling hacked police emails to request user data from TikTok, Facebook

404media.co

Post reply on HN
Print view View original

21–30 of 53 posts

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#21

Post by jazzyjackson »

wmf wrote: post #16
NoZebra120vClip wrote: post #4

Ok if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupid, and deserve any hacking they get. Ouch.

I don't think most law enforcement agencies have any second factor to authenticate themselves online. And it's not the social media companies that suffer but their users whose privacy is being violated.

Don't you think it's within the social media companies interest to respond to as few subpeonas as possible i.e. only genuine ones from authorities?

but maybe you're right and this problem won't be solved because the person being harmed has no power and the institution in power sees no harm

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#23

Post by fullspectrumdev »

vkou wrote: post #13
NoZebra120vClip wrote: post #4

Ok if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupid, and deserve any hacking they get. Ouch.

You'll be horrified to learn exactly how much business is conducted through unsecured fax machines.

For some absurd reason fax is often seen by bureaucracies in some countries as “more secure” than email.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#24

Post by dahdum »

what-no-tests wrote: post #22

The emails should just be made public anyway. They are public servants, yes? "To serve and to protect."

It’s about fraudulent data requests using hacked email accounts from government bodies all around the world. What emails are you referring to that should be made public?

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#27

Post by singleshot_ »

extraduder_ire wrote: post #7
NoZebra120vClip wrote: post #4

Ok if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupid, and deserve any hacking they get. Ouch.

To many normal people the "from" field in an email means that it came from there. I am wondering how they get the data back though, unless they demand it is faxed, or sent to another email address. (Or the person replying doesn't notice the different reply-to address.)

Generally email systems will have rules that support things like “if this account gets any mail from this address at Facebook.com, move it to some obscure folder and forward it to badguy@gmail.com” which is sometimes how this plays out.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#28

Post by what-no-tests »

singleshot_ wrote: post #26
what-no-tests wrote: post #22

The emails should just be made public anyway. They are public servants, yes? "To serve and to protect."

Castle Rock v. Gonzales, 545 U.S. 748 (2005) (Police not required to serve or to protect).

False advertising.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#29

Post by wmf »

jazzyjackson wrote: post #21
wmf wrote: post #16

Earlier quoted context omitted.

I don't think most law enforcement agencies have any second factor to authenticate themselves online. And it's not the social media companies that suffer but their users whose privacy is being violated.

Don't you think it's within the social media companies interest to respond to as few subpeonas as possible i.e. only genuine ones from authorities? but maybe you're right and this problem won't be solved because the person being harmed has no power and the institution in power sees no harm

Obviously they're going to try to verify law enforcement requests. It's a tradeoff.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#30

Post by wmf »

fullspectrumdev wrote: post #23
vkou wrote: post #13

Earlier quoted context omitted.

You'll be horrified to learn exactly how much business is conducted through unsecured fax machines.

For some absurd reason fax is often seen by bureaucracies in some countries as “more secure” than email.

In the 1990s the phone network probably was more secure than the Internet but it's not today.
Post reply on HN