Live data from Hacker News

How I Lost My $50,000 Twitter Username

medium.com

331–340 of 394 posts

Re: How I Lost My $50,000 Twitter Username

#331
This is a terrifying story, and I'm very glad Hiroshima wrote it, because I didn't have two factor auth turned on with my domain provider. Now I do!

It seems like if he'd had 2FA turned on with GoDaddy, this may not have happened. So rather than use @gmail.com addresses to register for things, as he recommends, just turn on 2FA with your provider. And if your provider doesn't support it, leave them and tell them why.

The admonition to use a @gmail.com address was annoying enough that I actually put up a response blog post just on this point: https://konklone.com/post/protect-your-domain-name-with-two-...

Re: How I Lost My $50,000 Twitter Username

#332
post #227

Earlier quoted context omitted.

The first digit of a credit card number identifies the type of company the issuer is, e.g. 1 is an airline, 3 is a travel agency, 4 and 5 are credit card companies, 7 is an oil company. The final digit is a checksum. Two things about this baffle me: 1) that websites feel the need to have a dropdown to identify what sort of card you have instead of just figuring it out and 2) why they need to ping it off the issuer's…

Back when I was doing payment code, I built several sites which didn't prompt for the card type, since (a) the first digit identifies the association [1] and (b) the processor doesn't usually care anyway, i.e., you don't need to submit a card type value along with the rest of the transaction data. Most of the clients for whom I built these sites complained about the lack of a dropdown, and were not terribly receptive…

During my time working on websites for a retail company the imagery of the credit cards accepted were considered important. They would even be on pages that just mentioned taking payments before you get to the actual input page.

One reasoning is that it is a sort of reassurance, much like the stickers you see on doors of retail locations that show which cards they accept. It's a reassurance in the idea that if you're deciding if you want to make the purchase or not, that the site will have no problems in accepting the payment option you would like to use. Plus, in a strange sort of way, it implies the site is a valid on-the-level company because surely a credit card company would come down hard on a scam site for using their copyrighted visual identity.

There's not much valid reasons other than it's a visual thing for customers. Although I always suggested using the method of displaying the type of card after starting the number, that goes against the reassurance thing. If a customer has two different branded credit cards, they know up front if one or both will be accepted. Otherwise they have to start typing to find out, which is work for the customer. You always want it to be easy for the customer to spend money, no second guessing.

Re: How I Lost My $50,000 Twitter Username

#333
post #32
post #18

Who are people's current favorite domain registrars? I've been with name.com for the last year or so and have been happy, but I'm always curios to hear from others.

Been with gandi.net for a few years now; excellent service and 2-factor auth.

Wouldn't recommend them. I heard they have a "moral contract" you have to agree to. If they don't like what you're doing with your domains (even if it's legal), they can (I forget, seize or kick you out, but bad stuff).

Re: How I Lost My $50,000 Twitter Username

#334

Everyone looks bad here, but I want to focus on Twitter. For me this case is yet another demonstration that Twitter sees its customers as advertisers and places low priority on the community. I pay Twitter nothing, and yet the service is valuable to me. So instead of continuously crippling the service in the name of goodness knows what, why not actually charge users for a premium experience. Things like customer serv…

> So instead of continuously crippling the service in the name of goodness knows what, why not actually charge users for a premium experience.

Because then they couldn't justify their $50 Billion valuation. They'd "just" be a $1 billion company or something.

Sites like Twitter or Facebook could be perfectly fine profitable ventures that worked in their users' interests. But instead they got unobtainable market values, so they have to look like they're on track to meet them, and the easiest way to do that is to exploit their users.

Re: How I Lost My $50,000 Twitter Username

#335
post #276

Earlier quoted context omitted.

"that resulting shenanigans might be a little asymmetric. " - What does this statement even mean? You should think before you just throw a load of cliches into a sentence.

As in the attacker would be able to pop up and attack the original user of @N at will for what might very well be a vicious attempt to take over or destroy as much of his digital holdings as possible. The grandfather post is referencing asymmetric warfare[0] which would be a pretty decent name for what could happen. I don't think he just threw some cliches into a sentence. [0] http://en.wikipedia.org/wiki/Assymetrica…

Naoki has already made changes to prevent this type of attack from working again (e.g., removing credit cards from Paypal, moving his domains from GoDaddy, etc.)

Re: How I Lost My $50,000 Twitter Username

#336

Earlier quoted context omitted.

Kind of off topic but that site also shows sites that email users their password when they create the account. That does not necessarily mean they store it plain text. Though the kind of devs that would send the password in email are likely to store it in plain text, but it's not necessary.

It does mean that passwords aren't properly hashed. They may be encrypted, but that still leaves open the possibility for an engineer or attacker to have access to plain text passwords.

No, it does not. You can receive the password, email it to creator, hash it, and then store it. It's not ideal because you now expose it in plaintext in the original email, but you aren't storing plaintext.

Re: How I Lost My $50,000 Twitter Username

#337

>Using my Google Apps email address with a custom domain feels nice but it has a chance of being stolen if the domain server is compromised. Sigh I use Google Apps exactly so that I have control over the domain and aren't subject to the good will of Google. I had never thought of this particular problem. Now I don't know what to do.

The real solution is to use a DNS registrar and DNS hosting that properly verifies your identity before allowing changes. Google Apps has nothing to do with it, and in fact has enabled 2-factor auth for a long time. Everyone should be using it.

Re: How I Lost My $50,000 Twitter Username

#339

Earlier quoted context omitted.

Kind of off topic but that site also shows sites that email users their password when they create the account. That does not necessarily mean they store it plain text. Though the kind of devs that would send the password in email are likely to store it in plain text, but it's not necessary.

It does mean that passwords aren't properly hashed. They may be encrypted, but that still leaves open the possibility for an engineer or attacker to have access to plain text passwords.

No it doesn't, the registration email can be sent before the password is hashed.

Re: How I Lost My $50,000 Twitter Username

#340
post #255

Earlier quoted context omitted.

Yes, I meant that GoDaddy and PayPal should apologize. Twitter should look into what happened in this specific case, and somehow (if the posting is right) return the username to its original owner. But there does seem to be something terribly broken here if it's possible for someone to get another person's Twitter account, and for it to take a full investigation to get it back to the original owner. And for not havin…

The Twitter account wasn't actually compromised. The guy was blackmailed to hand it over. It would be pretty nice of Twitter to hand it back, but it's really hard to fault them, and it's especially hard to fault them for not just reassigning the account without a very careful investigation - what if the writer of this article is actually the guy trying to steal the account from someone else, using this article to bul…

This sounds relatively easy to verify, as the guy seems to be well known and the founder of an SF-based startup.
Post reply on HN