It was like I read some scary book.
How I Lost My $50,000 Twitter Username
371–380 of 394 posts
Re: How I Lost My $50,000 Twitter Username
#372Earlier quoted context omitted.
In which case, once I return in the afternoon I will be entitled to shoot whomever is there for trying to steal my home. I'll be 'naturalisticaly' defending it. Sounds like a great way to run a society. I better make sure I have a bigger gun than the rest then. (edit-language)
Is shooting people your first go-to for defense? I prefer arguments and evidence presented to institutions who have both been given permission to shoot people and are willing to do it on my behalf pending their judgements of my arguments and evidence. Of course, if the institution's judgement is that people can take things that I'm not using at that exact moment, and it is not interested in intervening, then it's not…
When an armed intruder is breaking into my house? Yes shooting them is in fact my first go-to defense. When someone else is intending to do harm to me or someone I love I'm not going to wait around for the police to get there 30 minutes later. All the police are going to find is my dead body by then.
Re: How I Lost My $50,000 Twitter Username
#373Seems like Twitter could easily verify the story based on their own logs and then restore access to his N account. He doesn't mention pursuing that, though.
(I work at twitter but don't have anything to do with account security, etc) I think something is in the works...
This thread could be renamed "How I Lost My Job at Twitter"
Re: How I Lost My $50,000 Twitter Username
#374Earlier quoted context omitted.
Naoki has already made changes to prevent this type of attack from working again (e.g., removing credit cards from Paypal, moving his domains from GoDaddy, etc.)
Hopefully the attacker didn't back up a decades' worth of his emails.
The attacker never got access to the victim's email accounts. He changed dns records to point to a different server. So he would have gotten some new email emails during the time he had the MX records pointed at his server (and he could have used that time to gather additional information), but he couldn't get to any existing emails.
Re: How I Lost My $50,000 Twitter Username
#375Earlier quoted context omitted.
See, that "account should be locked" is what got people to hate Paypal in the first place - they used to be quick on the trigger, wrong IP = locked account; transfer to new account = locked account, etc. And it took 1-2 weeks to restore. Now they laxed the security somewhat and people give them sheet for that... There's no winning for them, is there? But really, the employees should not give away any user information…
I didn't mean locked from transactions or logins using existing good credentials - I meant locked from front line customer service reps accessing its details. If you loose your credentials and the token that you can use to recover your credentials with (credit card number), it's fine, even preferable, that it takes 1-2 weeks to recover them. Also, people don't seem to be up in arms over PayPal freezing funds on suspi…
They're never indefinitely frozen - you can transfer them to your bank account after 6 months, that was always the case.
People have a problem with sending their credit card scans, driver's license, birth certificate, marriage certificate and their first born in order to remove those dreaded limits that seem to be imposed for little reason :-).
I gotta say that's not the case anymore, at the very least they don't limit the account for paying too much on eBay or logging in from a different IP in my experience (and that's a good thing).
Re: How I Lost My $50,000 Twitter Username
#376Someone tracked down the hacker: http://www.reddit.com/r/hacking/comments/1whk3a/tracking_the...
Re: How I Lost My $50,000 Twitter Username
#377Reminds me of harvesting ICQ numbers. There was a time when you could search 6-digit ICQ numbers for expired freemail addresses like Hotmail (they deleted your account after a while), register that freemail address and reset your ICQ number password to get a brand "new" 6-digit number. I think this doesn't work anymore, since most freemail hosters don't "free" expired email addresses but keep them locked. It still wo…
Maybe I'm missing something, but who uses ICQ still? And why not focus on 3-digit numbers? There's a million 6-digit ICQ numbers; not that unique.
I still use my ICQ account.... Mind you it's combined into trillian.
Re: How I Lost My $50,000 Twitter Username
#378Yet another example of a compromised GoDaddy account and someone potentially losing their domain. Yet people continue to use GoDaddy time and time again.
It was worth ditching GoDaddy just so I wouldn't have to use that horrible interface ever again.
Re: How I Lost My $50,000 Twitter Username
#379Earlier quoted context omitted.
Doesn't this mean your email account is compromised?
I doubt it. I have two factor auth set up on my email. Looking at the timestamps, the Welcome email was sent the same minute as the "Please confirm" email, so it's possible the Twitter account is not live and this was just an automatic welcome e-mail. Still, it would be nice if the "Not My Account" link actually worked properly or there was some way to contact support about it.
Maybe the "Please confirm" mail was fake and actually meant to get you to click on the "Not My Account" link ...
Re: How I Lost My $50,000 Twitter Username
#380Earlier quoted context omitted.
The hacker sells it anonymously to someone who isn't aware of the controversy or who doesn't care. It will probably shrink the value of the username but I bet it's still worth something.
Selling is prohibited by the TOS, so if the buyer does their due diligence they know what risk they're taking
So is selling accounts in MMOs etc. Doesn't mean it doesn't happen.