Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Lost My $50,000 Twitter Username

medium.com

Post reply on HN
Print view View original

341–350 of 394 posts

Re: How I Lost My $50,000 Twitter Username

#341

Post by jotm »

mseebach wrote: post #287
ck2 wrote: post #253

This story is horrifying because PayPal was the enabler. PayPal gave the attacker the last four digits of my credit card number over the phone That person should lose their job if it is not PayPal policy. I really hope by some small chance the person that did this gets some serious prison time, if not for this then anything else prior or down the road. Then maybe one of those mornings they wake up in prison they can…

It's possible that this was gross negligence on part of the employee and that the thief just got really, really lucky - but that seems unlikely. This is a systemic fault of PayPal and firing a lowly phone-jockey will not solve that. There are computer system protections that were clearly not in place (the representative was able to see this data on the screen, rather than having to enter it blind and have it validate…

See, that "account should be locked" is what got people to hate Paypal in the first place - they used to be quick on the trigger, wrong IP = locked account; transfer to new account = locked account, etc. And it took 1-2 weeks to restore.

Now they laxed the security somewhat and people give them sheet for that... There's no winning for them, is there?

But really, the employees should not give away any user information, ever. It should be a one way street here. That would have stopped the attacker in this case, as well, I believe...

Re: How I Lost My $50,000 Twitter Username

#342

Post by tedchs »

xauronx wrote: post #285
benatkin wrote: post #100

It's sad, but twitter's not transferring it back in a week's time gives me more confidence in twitter, not less. There isn't any evidence of the stealing of the domain names and the extortion available besides OP's copies of the email messages and information that GoDaddy won't provide. With the value twitter ID has, twitter shouldn't do anything without clear evidence. He might have been able to get it back if it wa…

I was thinking how witty that would be if THIS was the actually hacker, and he was using us to create a shitstorm in order to rush Twitter into giving him the account. I'm sure there is sufficient data to support that he was the original owner though.

Twitter hopefully has an audit trail of account changes they could review to make a decision to revert the change.

Re: How I Lost My $50,000 Twitter Username

#343

Post by mseebach »

jotm wrote: post #341
mseebach wrote: post #287

Earlier quoted context omitted.

It's possible that this was gross negligence on part of the employee and that the thief just got really, really lucky - but that seems unlikely. This is a systemic fault of PayPal and firing a lowly phone-jockey will not solve that. There are computer system protections that were clearly not in place (the representative was able to see this data on the screen, rather than having to enter it blind and have it validate…

See, that "account should be locked" is what got people to hate Paypal in the first place - they used to be quick on the trigger, wrong IP = locked account; transfer to new account = locked account, etc. And it took 1-2 weeks to restore. Now they laxed the security somewhat and people give them sheet for that... There's no winning for them, is there? But really, the employees should not give away any user information…

I didn't mean locked from transactions or logins using existing good credentials - I meant locked from front line customer service reps accessing its details.

If you loose your credentials and the token that you can use to recover your credentials with (credit card number), it's fine, even preferable, that it takes 1-2 weeks to recover them.

Also, people don't seem to be up in arms over PayPal freezing funds on suspicious activity for 1-2 weeks. They seem to be up in arms over funds being indefinitely frozen with no recourse for the unambiguously legitimate account owner.

Re: How I Lost My $50,000 Twitter Username

#344

Post by dpritchett »

pavel_lishin wrote: post #335
67726e wrote: post #276

Earlier quoted context omitted.

As in the attacker would be able to pop up and attack the original user of @N at will for what might very well be a vicious attempt to take over or destroy as much of his digital holdings as possible. The grandfather post is referencing asymmetric warfare[0] which would be a pretty decent name for what could happen. I don't think he just threw some cliches into a sentence. [0] http://en.wikipedia.org/wiki/Assymetrica…

Naoki has already made changes to prevent this type of attack from working again (e.g., removing credit cards from Paypal, moving his domains from GoDaddy, etc.)

Hopefully the attacker didn't back up a decades' worth of his emails.

Re: How I Lost My $50,000 Twitter Username

#345

Post by mseebach »

owens99 wrote: post #340
mseebach wrote: post #289

Earlier quoted context omitted.

The Twitter account wasn't actually compromised. The guy was blackmailed to hand it over. It would be pretty nice of Twitter to hand it back, but it's really hard to fault them, and it's especially hard to fault them for not just reassigning the account without a very careful investigation - what if the writer of this article is actually the guy trying to steal the account from someone else, using this article to bul…

This sounds relatively easy to verify, as the guy seems to be well known and the founder of an SF-based startup.

It's not about his identity, it's about the legitimacy of his claim to the account.

Just for the record, I have no reason to believe he's saying anything less than the truth - but I can't fault Twitter for basically presuming malice until they have conclusively documented the opposite.

Re: How I Lost My $50,000 Twitter Username

#346

Post by imsofuture »

bigiain wrote: post #90
imsofuture wrote: post #38

Earlier quoted context omitted.

I'm a very casual and infrequent tweeter, and I can't fathom how that makes my username 'up for grabs'. Sorry you have such a twisted view of username ownership :/

While sympathetic - I'm also slightly amused at your twisted view about twitter name/account "ownership"… Just how much of the "real world" law you're alluding to by using the term "ownership" do you suppose applies to Twitter handles? (or Gmail addresses, or Facebook pages, or even domain names?)

I don't think the user 'owns' it at all. I mean, it's pretty obvious that you're just laying claim to some set of bits in somebody else's system. I'm not confused about that :)

I just don't quite see how a username is 'owed' to other people who would use it more, either.

Re: How I Lost My $50,000 Twitter Username

#347

Post by jdrenterprises »

I'm not a programming expert, nor a process expert, but the way I see it...

... there has got to be a multi-stage process for authentication that does NOT use any CC or SSN. Of course, the responsibility lies with the account owner for maintaining passwords/authentication information.

If you lose the information, no way to recover it.

I say this because it seems (again, I'm not an expert) that these thieves use social engineering mostly in the "data recovery" stage of the process.

The only way to tighten that from my perspective is to put maximum responsibility on the account owner to keep their logins, passwords (again, for multi-stage authentication), and such on hand. Don't have a need to recover your info, and others can't use the recovery process to get to your account.

I guess it wouldn't be a perfect scenario but... this, or lose @N.

I am sorry to hear there are companies allowing these practices, though... sad.

Re: How I Lost My $50,000 Twitter Username

#348

Post by aaronem »

talmand wrote: post #332
aaronem wrote: post #293

Earlier quoted context omitted.

Back when I was doing payment code, I built several sites which didn't prompt for the card type, since (a) the first digit identifies the association [1] and (b) the processor doesn't usually care anyway, i.e., you don't need to submit a card type value along with the rest of the transaction data. Most of the clients for whom I built these sites complained about the lack of a dropdown, and were not terribly receptive…

During my time working on websites for a retail company the imagery of the credit cards accepted were considered important. They would even be on pages that just mentioned taking payments before you get to the actual input page. One reasoning is that it is a sort of reassurance, much like the stickers you see on doors of retail locations that show which cards they accept. It's a reassurance in the idea that if you're…

All of what you say is true, but I was referring to a dropdown or radio button set for choice of card type, and not the card type images themselves, which I always included unless the client preferred otherwise -- something I don't remember ever happening, now I think back.

Re: How I Lost My $50,000 Twitter Username

#349

Post by dmix »

mikevm wrote: post #301
driverdan wrote: post #77

Earlier quoted context omitted.

Do it. Paypal is a terrible company who doesn't give a shit about its users.

What are the alternatives for for non-Americans?

(tumbleweed)

PayPal is the only way I can get paid by my American client (in Canada) other than waiting a week for a cheque to mail, walking to the bank to deposit it, then another week or two for it to clear.

Re: How I Lost My $50,000 Twitter Username

#350

Post by hhw »

nevi-me wrote: post #50

My custom domain address was stolen with the Dropbox data leak, got so much spam that I set my Gmail to pull my mails via POP3. Then I changed everything to use my Gmail, and locked down my Gmail account. I've heard people go on about how Google (and I suppose other corporations) are evil, and how they are rolling their own custom mail solutions etc. It's times like these that people lose important things. Also, I re…

A custom domain address can also be used with a custom mail server configuration that includes spamassassin. You can even setup IMAP folders for you to drag and drop mail into to be learned automatically as spam, ham, or forgotten. You can also setup fairly sophisticated rules with procmail or sieve. A good mail provider will also have this implemented for you.

Aside from mining your data for marketing purposes, Google is evil because they continue to store your e-mails even after you delete them. Custom mail solutions are markedly superior if you know what you're doing, like anything else in life that you assume your own direct control over rather than leaving it to someone else.

Post reply on HN