Forgot your password?
typodupeerror
Twitter Crime Security Social Networks

Developer Loses Single-Letter Twitter Handle Through Extortion 448

Posted by Unknown Lamer
from the kevin-mitnick-returns-to-get-a-cool-twitter-handle dept.
Hugh Pickens DOT Com writes "Naoki Hiroshima, creator of Cocoyon and a developer for Echofon, writes at Medium that he had a rare one-letter Twitter username — @N — and had been offered as much as $50,000 for its purchase. 'People have tried to steal it. Password reset instructions are a regular sight in my email inbox,' writes Hiroshima. 'As of today, I no longer control @N. I was extorted into giving it up.' Hiroshima writes that a hacker used social engineering with Paypal to get the last four digits of his credit card number over the phone then used that information to gain control of his GoDaddy account. 'Most websites use email as a method of verification. If your email account is compromised, an attacker can easily reset your password on many other websites. By taking control of my domain name at GoDaddy, my attacker was able to control my email.' Hiroshima received a message from his extortionist. 'Your GoDaddy domains are in my possession, one fake purchase and they can be repossessed by godaddy and never seen again. I see you run quite a few nice websites so I have left those alone for now, all data on the sites has remained intact. Would you be willing to compromise? access to @N for about 5 minutes while I swap the handle in exchange for your godaddy, and help securing your data?' Hiroshima writes that it''s hard to decide what's more shocking, the fact that PayPal gave the attacker the last four digits of his credit card number over the phone, or that GoDaddy accepted it as verification. Hiroshima has two takeaways from his experience: Avoid custom domains for your login email address and don't let companies such as PayPal and GoDaddy store your credit card information."
This discussion has been archived. No new comments can be posted.

Developer Loses Single-Letter Twitter Handle Through Extortion

Comments Filter:
  • by royallthefourth (1564389) <royallthefourth@gmail.com> on Wednesday January 29, 2014 @12:32PM (#46100569)

    like so many other articles, this just seems like another reminder to never ever use godaddy

    • by davek (18465) on Wednesday January 29, 2014 @12:36PM (#46100613) Homepage Journal

      like so many other articles, this just seems like another reminder to never ever use godaddy

      Perhaps this is more of an indictment of using ANY non-big-brother email provider for login information to ANY domain registrar. It seems to me the crux of this attack was to a) gain access to the victem's domain registrar account and then b) hijack the domain MX record so all email to that domain goes to the attacker's server. At that point, you can reset all the victem's passwords to all accounts and ALL password reset emails will go to the attacker.

      Time to enable 2-factor on all my registrar accounts.

      • Re: (Score:2, Insightful)

        by davek (18465)

        gain access to the victem's domain registrar account

        Sometimes I hate not being able to spell :(

      • by rwven (663186) on Wednesday January 29, 2014 @12:38PM (#46100645)

        Two-factor probably wouldn't have helped here. They reset the account credentials, assuming the owner lost the ability to log in. That would have included resetting any "2nd factor."

        I don't think any action on the user's part would have helped any of this other than maybe his comment about the TTL on the MX record.

        • How about if he'd used GMail or a similar mail provider? It sounds like the problem was that he was using his own domain for email and GoDaddy was the weakest link.
          • by sodul (833177)

            You can use gmail with your own domain name. It used to be free (and still free if you got grandfathered in). There are good reasons to use your own domain name with out without gmail. Most notably it looks more professional and you can actually have a very nice looking email instead of @gmail.com I have @.com, and my last name is 4 letters. It can also be more secure if you provide smtp access over ssl for your organization and so email within your own domain is usually fully encrypted while going over the

          • by ArhcAngel (247594) on Wednesday January 29, 2014 @01:09PM (#46101015)
            gmail would have worked. Google never answers the phone or email support requests anyway.
      • Time to enable 2-factor on all my registrar accounts.

        No, time to use a registrar that does not use untrained idiots for customer support. This would not have happened at SafeNames. Of course, SafeNames is more expensive than GoDaddy. But if you are protecting a business asset worth over $50k, you do not worry about a few bucks a year.

    • by rwven (663186) on Wednesday January 29, 2014 @12:36PM (#46100623)

      Or paypal? IMHO they're the ones who enabled the entire operation here. They gave away the last four digits of the guy's credit card to a stranger...

      Granted, godaddy should have required a photo id as well.

      They're both rubbish.

      • by Anonymous Coward on Wednesday January 29, 2014 @12:58PM (#46100851)

        They gave away the last four digits of the guy's credit card to a stranger...

        I'm not going to defend paypal, but the last 4 digits are generally considered safe to identify a distinct credit card without sharing enough information to allow identify theft. That godaddy accepted the last 4 digits as proof of ownership is far more disturbing than that paypal probably asked 'will this be using the card ending with "1234"?' while the scammer was digging for info.

        Still, I've been avoiding paypal since I got over my old ebay habit. [cue Weird Al song]

      • by David_W (35680) on Wednesday January 29, 2014 @12:59PM (#46100859)

        They gave away the last four digits of the guy's credit card to a stranger...

        Not to defend PayPal, but the last 4 digits are often not treated as particularly secret. They put it on your credit receipts, many sites show them to help you figure out which card you have registered with them... Yeah, PayPal shouldn't be giving it out, but GoDaddy really really shouldn't be using it as some sort of ID verification. One of these is kinda dumb, the other is weapons-grade dumb.

        • by Em Adespoton (792954) <slashdotonly.1.adespoton@spamgourmet.com> on Wednesday January 29, 2014 @01:48PM (#46101567) Homepage Journal

          They gave away the last four digits of the guy's credit card to a stranger...

          Not to defend PayPal, but the last 4 digits are often not treated as particularly secret. They put it on your credit receipts, many sites show them to help you figure out which card you have registered with them... Yeah, PayPal shouldn't be giving it out, but GoDaddy really really shouldn't be using it as some sort of ID verification. One of these is kinda dumb, the other is weapons-grade dumb.

          I know it's common practice, but it really shouldn't be -- the last four digits of your credit card number are really 3 digits plus the Luhn check [wikipedia.org]. That means that with that string, you can test out all the number combinations and arrive at a significantly narrowed set of possible credit card numbers.

          Take for example American Express -- the first 4 digits are known (they're the card ID). If you give away the last four digits, that's 3 digits and Luhn. That means that you now have only 8 unknown digits, and they have to be in a permutation that totals with the other 7 digits to the proper Luhn total. In effect, this means that you can also reliably guess the 5th and 12th digit (as they're paired with the known digits and have an extremely limited set of permutations for the remaining 6 -- only a few hundred for in-my-head calculations.

          That may still sound like a lot, but it means that if you have access to the last four digits of 1,000 cards, you're likely going to get the correct card number on the first try on a significant portion of them.

          Summary: the last number of a credit card shouldn't be given out, as it tells a lot more about the entire number than it appears at first glance.

          • by Obfuscant (592200) on Wednesday January 29, 2014 @03:11PM (#46102641)

            I know it's common practice, but it really shouldn't be -- the last four digits of your credit card number are really 3 digits plus the Luhn check. That means that with that string, you can test out all the number combinations and arrive at a significantly narrowed set of possible credit card numbers.

            It doesn't matter where the check digit is, the fact that it exists changes a 16 digit number into a 15 digit one. (And AMEX is an exception, they're only 15 to start with.) I can give you three digits and the "check" and you will need to guess the other 7 (because one of the 8 is constricted by checksum), or I give you four digits and you guess 7 more and calculate the check.

            Once you have the bank and the last four, it is still 7 you get to guess at and the 8th is still limited by having to meet the check.

            but it means that if you have access to the last four digits of 1,000 cards, you're likely going to get the correct card number on the first try on a significant portion of them.

            One in 10 to the 7th power for each one, right on the first guess, assuming you know the first four from the bank for each one. Let's see, the chance of getting it wrong is 1-1e7, so getting all 1000 wrong is (1-1e7)^1000. I get 0.99990. Very close to 1, but about 1/10,000. Odds say you won't get any of them right on the first guess.

            And of course, now that I look up the actual Luhn algorithm [wikipedia.org] it is clear that giving you the check digit actually doesn't help you as much as giving you one of the real digits would. If you have to guess 8 digits that match the check I've given you, you will get false positives for all the failure modes listed in the reference, but if I give you an extra digit you'll have one less digit to get wrong.

        • No, this was a clear violation of CPNI. They either needed to confirm his identity via physical photo ID or his password/Pin over the phone. If they gave ANY information about his account at all, even the fact that he had one, without the Pin/Password they violated CPNI and their fines will be substantial.

          Now if his Pin was something stupid like his birthday, well that's his own fault.

      • by sconeu (64226)

        This could quite possibly be a PCI violation.

    • I never understood while people did in the first place. Their website has always been ugly as sin and barely functional; their tv advertisements have never had anything to do with their actual business; they get way more bad press than good (have they ever gotten good press?).
    • The moral is to not use a Registrar that allows domain updates from any IP. easydns.com, for example, can be configured to allow DNS updates only from a list of known IPs. That would stop this kind of deviltry in its tracks.

  • by Rinisari (521266) on Wednesday January 29, 2014 @12:33PM (#46100583) Homepage Journal

    Methinks if Mr. Hiroshima had the funds available, or pro-bono lawyer stepped in, there's grounds for a lawsuit against at least PayPal if not also GoDaddy.

    • by squiggleslash (241428) on Wednesday January 29, 2014 @12:50PM (#46100777) Homepage Journal

      Why Paypal?

      The last four digits of your credit card are printed on pretty much every receipt, shown on every order confirmation page, every "My account saved credit cards" screen, and are usually shown in addition to an expiration date. That's information that's never been considered confidential - quite the opposite indeed. It's pretty much public information.

      GoDaddy was insane to consider it valid authentication information. You might just as well treat someone's name as their password.

      • by rudy_wayne (414635) on Wednesday January 29, 2014 @01:04PM (#46100921)

        Why Paypal?

        The last four digits of your credit card are printed on pretty much every receipt, shown on every order confirmation page, every "My account saved credit cards" screen, and are usually shown in addition to an expiration date. That's information that's never been considered confidential - quite the opposite indeed. It's pretty much public information.

        True, but irrelevant. Think about that for a minute -- you call PayPal and tell them:

        "I have forgotten the last 4 digits of my credit card number, can you give them to me".

        In what bizzaro parallel universe does that even make sense? There is no amount of "social engineering" that can explain why you need someone to tell you the last 4 digits of YOUR credit card.

        PayPal needs to be reamed for such a major fuck up.

        • by femtobyte (710429) on Wednesday January 29, 2014 @01:14PM (#46101073)

          "I have forgotten the last 4 digits of my credit card number, can you give them to me".

          "Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."

          • by codegen (103601) on Wednesday January 29, 2014 @01:22PM (#46101167) Journal

            "I have forgotten the last 4 digits of my credit card number, can you give them to me".

            "Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."

            In an ideal universe: "Sir, if you tell me the last four digits of the card number, I can tell you if you updated it."

            • by femtobyte (710429) on Wednesday January 29, 2014 @01:40PM (#46101453)

              Right, in an ideal universe everyone would follow security-conscious procedures. In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric. Quickly helping a friendly, innocent, and clueless-sounding customer, versus remembering and strictly following every procedure in the 400-page employee handbook, doesn't always happen. That's why social engineering works --- the system is not designed for maximum security rigor, but for cutting corners on call-answering costs.

              • by atheos (192468)
                "In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric"
                And I would call that problematic by design. Mr Hiroshima didn't chose this for Paypal's business model, and Paypal is ultimately responsible for this.
              • by Xest (935314)

                "In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric."

                Right, but backing up this thread to the previous point that still makes it PayPal's fault for not ensuring security comes before other arbitrary metrics. That excuses the call centre worker, that is why social engineering happens as you say, but none of it is a viable excuse for PayPal as a company allowing the data to be handed over.

          • by firex726 (1188453)

            SOP for when I was in a call center was that in response to that kind of question, you'd have to let THEM volunteer the information or have them check online.

            And even then we'd expect them to verify all the rest of the account information, server IP addresses, billing address, last bill amount, etc...

          • Paypal's response should be "I'm sorry, but we can't give this information over the phone" or "You can see a list of cards you have linked to your account on our website." Possibly they could say "Ok, I can give you that information but first give me this Secret Passcode to prove that you are who you say you are." All of these would help actual customers in this situation while guarding against social engineering.

        • by malakai (136531)

          I routinely get service reps reading my last 4 digits of cards they have on file. This happen on Delta all the time. I have about 6 credit cards on file, and sometimes I need them to make sure specific tickets are on specific cards. I often have a conversation like "That's the one ending in 1011 right? No sir. Is it the 1099? No sir. Really? Which is it? It's the 1014 sir. Oh yeah, that one. ok."

          Last 4 are not a secret. Best buy and lots of box retailers now actually ask you for it when you check out. You h

  • by egranlund (1827406) on Wednesday January 29, 2014 @12:33PM (#46100585)

    Avoid custom domains for your login email address

    Honestly, I don't think that would have helped. I doubt it's much harder to gain control of someone's gmail, yahoo or hotmail account if they are as motivated as it sounds like his attacker was.

    Once you gain control of anyone's email account, even if the attacker doesn't have custom domains to hold for ransom, they could easily threaten bank accounts, etc etc.

    • by Nemyst (1383049) on Wednesday January 29, 2014 @12:46PM (#46100729) Homepage
      If your Google account doesn't have your credit card number on file and uses two-factor auth, I think it'd be a lot harder to crack into it even using social engineering. The problem is always that most sites are designed so that in the event of people forgetting EVERYTHING, they can still recover their account somehow. If we accepted that losing your password, your security data for recovery and your two-factor auth would mean you lose your account (or you need something very, very elaborate to recover it, much more than just your last four CC numbers), security would be improved.

      The problem is that for every super-focused hack like this one, there's a thousand people who forget their access credentials and want their account back, so it makes more sense to have lax security and cover the biggest proportion of your audience.
      • by PRMan (959735)
        It would be VERY hard to break into a Google account using social engineering. First you'd have to find an actual person at Google.
    • The problem with customs domains is that it created another attack vector that no one really thinks about. The attacker hijacked his mx records and directed his email away. Up until now, I was sitting pretty thinking that I was safe because I used LastPass to create a long fucking Google Apps password and Google Authenticator for two-factor security. I never considered the notion that someone could hijack my mx records. I'm going over to namecheap to enable two-factor authentication.

  • by Admodieus (918728) <.john. .at. .misczak.net.> on Wednesday January 29, 2014 @12:34PM (#46100595)
    If your account has two-factor enabled, any account change will require entry of that limited-time token. Now, if the person doing the social engineering was able to access the account in the first place with only the last four digits of the card number, then they may have also been able to bypass this or turn it off with the help of the customer support rep. But I didn't see any mention of this in the article and wanted to point it out for those who use GoDaddy and are afraid of a similar situation occurring.
    • by jaymz666 (34050) on Wednesday January 29, 2014 @12:36PM (#46100627)

      the godaddy person let him keep trying various numbers until it worked. How can you trust them when it comes to security at all.

      These companies need to be held accountable for their actions.

    • by AuMatar (183847)

      Are you sure about that? My guess would be that they have internal tools that can get around the 2 factor authentication- what would happen if you lost the token generator? In that case social engineering would still work.

    • by rwven (663186)

      Godaddy would have just removed the 2nd factor for the same reason they handed over the "1st" factor. Hiroshima pretended he was the user, who has lost the ability to log in. They would have just reset the password and removed two-factor authentication from the account after the identify was "verified."

  • lawsuit (Score:5, Insightful)

    by internerdj (1319281) on Wednesday January 29, 2014 @12:37PM (#46100637)
    I'd be talking to a lawyer. Sounds like someone at Paypal owes $50k to Mr. Hiroshima.
    • by u38cg (607297)
      Remoteness. Won't fly. Godaddy is the one to go after.
    • by Solandri (704621)
      I really doubt that lawsuit would get very far. The only evidence against Paypal is the written testimony of a known criminal (the guy who conducted the attack). For all we know, the attacker could be a worker at Starbucks who lifted Mr. Hiroshima's credit card number when he bought coffee there. And he hates Paypal (like most of us do) so he's setting up a false trail leading to Paypal.

      The real problem is using the credit card number as authentication of anything other than a credit card purchase. I
    • by Pope (17780)

      I'd be talking to a lawyer. Sounds like someone at Paypal owes $50k to Mr. Hiroshima.

      Nobody owes him any money whatsoever. He claims it was "valued at over $50,000", but it's worth exactly $0 until he sells it.

    • Re:lawsuit (Score:5, Informative)

      by bill_mcgonigle (4333) * on Wednesday January 29, 2014 @01:45PM (#46101519) Homepage Journal

      Patience may be rewarded. Somebody will start using @N at some point, and that person will have a money trail to the criminal.

  • by CanHasDIY (1672858) on Wednesday January 29, 2014 @12:40PM (#46100671) Homepage Journal

    don't let companies such as PayPal and GoDaddy store your credit card information.

    I wonder, does Mr. Hiroshima realize that consumers have little to no (closer to the latter) control over what a corporation does with our credit card info once we make a purchase with them?

    Does he know of some nuclear option the rest of us aren't aware of?

  • by jader3rd (2222716) on Wednesday January 29, 2014 @12:40PM (#46100673)

    This is a story about how 'real' people hate secure things. Nerds are all about creating encryption and security that requires knowing a secret key. Real world people deal with the fact that they forget secret keys, and want companies to restore their data for them. So for companies to keep customers, they have to create workarounds for the secret keys.

    As a result the only way to for sure secure something, is to not depend upon companies who have 'real' people for customers.

  • And this is why I avoid Twitter, GoDaddy & PayPal like the plague they are.

  • i get the feeling that this is high enough profile where the extortionist is going to get a beatdown by one of the tech companies involved.

  • by Dan East (318230) on Wednesday January 29, 2014 @12:45PM (#46100725) Homepage Journal

    When the Target data breach happened, I commented here about some of the advantages to using throw-away, preload credit cards (which limits your potential loss and allows you to quickly switch to an entirely different account if you feel the other might be compromised). I was modded down by people who have bought into the whole big-bank credit card racket, and the attitude "why should I worry, when the bank is responsible and I'll eventually get my money back". Well here is yet another advantage of using preloaded credit cards. You load money on it, pay your annual hosting fees, etc, and then just toss it and get another next year to make the next annual payment. This story illustrates the advantages of using an entirely different credit card per service, so the card you use with Godaddy is not the same as you use with Paypal.

    Yes, yes, it will cost you $3 each time you load a card to make that yearly payment, but you can decide for yourself what that extra $3 can buy you.

    • by swb (14022)

      I like this idea, but have never used preloaded cards before. Do they work like "real" credit cards, ie, broadly accepted like any card? How do you load them up with money, can you buy value with a credit card or does it require a cash transaction?

      There was a story in the paper today about banks reissuing 150 million cards due to the Target debacle and I thought -- why don't they just do that every year anyway? Or when they issue cards, maybe they should give you a 12 pack of cards that are only good for

  • by pla (258480)
    OR! Does this Slashdot FP itself count as a social engineering attack by Naoki Hiroshima to pressure GoDaddy/Twitter/Paypal/SomeoneElseEntirely into submission, possibly for the stated purpose (control of @N), or for something seemingly unrelated but actually useful?

    I kid, of course... I have no reason to doubt the story as given. I do find it odd that someone would actually break the law (at the very minimum, identity theft and extortion) in such a contrived chain of events... Just to gain control of s
  • by angel'o'sphere (80593) on Wednesday January 29, 2014 @12:48PM (#46100751) Homepage Journal

    After all Twitter knows which new eMail-address is holding @N. Should not be to hard to figure the real person behind it. And simply asking Twitter to hand it back should also work.

    • by Junta (36770) on Wednesday January 29, 2014 @01:01PM (#46100883)

      Is that the current controller of N is legitimate, and *this* story is the social engineering attack to get control of it.

      • by Shatrat (855151)

        Hah, that's the first thing I thought of as well. He could have accepted that $50,000 and now be trying to get that domain back.

  • by Tenek (738297) on Wednesday January 29, 2014 @12:59PM (#46100863)
    I will assume since it hasn't come up already that there is some reason Twitter can't just give him back the handle. What is it?
  • Nope (Score:5, Insightful)

    by ledow (319597) on Wednesday January 29, 2014 @01:00PM (#46100873) Homepage

    This is like kidnap or a mugging. At no point do I have an actual incentive to give in to such a person's demands. "We won't hurt you / them / your website if you do X". I have *absolutely* no guarantee of that.

    I *cannot* win. If I do everything you request, you could still trash my domain / stab me anyway / kill your hostage and there's nothing I can do to stop that.

    As such, non-compliance is no different to compliance in such a situation. So why voluntarily give them MORE power over you / your assets?

    As it is you would have to wipe servers, settings, email etc. and start again even if they did honout their agreement.

    But then, you have to remember, this person is already committing a crime... what's in their conscience that will make them honourcan agreement concerning that crime.

    Let them squirm, report them, regain control when you can, then purge their access from your systems.

    Anything else is just stupid.

    • Easy to say right now. Harder to say if you are the one who is facing someone who has access to the DNS records of all of your websites (and has locked you out) or (even worse) a mugger with a gun pointed at you.

  • Did you really expect GoDaddy to care about protecting your interests?

    Some excellent alternatives were offered by respondents on the OPs blog, and I'll add another - moniker. Their claim to fame? They have "never lost a domain". And, so, they have a really good reason to keep others from taking your domain - they'd have to give-up that claim. They also offer a reasonably-priced enhanced security feature, though I feel it's unnecessary given the company's history. (And just checked, they still make the claim

  • by HangingChad (677530) on Wednesday January 29, 2014 @01:07PM (#46100975) Homepage

    This story reminds me why I don't use GoDaddy and, if you haven't already done so, activate two-factor authentication on your Gmail account.

    It's not bulletproof (what is?) but it's an extra layer of security that keeps a hacker from getting control of your email account.

  • A social-engineering blackhat extorted a distinctive and notable, and thus allegedly valuable, Twitter handle from its legitimate registered user.

    Why?

    It's like stolen art: the thief can't display it without implicating himself. The thief can't sell it, because the fool that buys it can't display it without implicating himself, and the thief by association (and vulnerability to investigative back-tracking).

    So.... why?

    A lot of work to go to for the sole purpose of effectively destroying a Twitter handle.

  • The good news for him is that PayPal and GoDaddy and Twitter now owe him a hell of a lot more than $50,000.

  • by An Ominous Cow Erred (28892) on Wednesday January 29, 2014 @01:12PM (#46101053)

    Simply put -- consumers can't be trusted to be able to deal with complex secure authentication schemes. That's why there's so many easy-to-guess "What city did you grow up in?" password-reset functions. There are so many weak links in the chain of trust, it takes a concerted effort on the individual's part to secure it.

    The CEO of Cloudflare fell victim to this when someone CONVINCED AT&T TO REROUTE HIS VOICEMAIL, starting a chain of events that wound up with the interloper having complete control over Cloudflare and the myriad of sites that use CF (and therefore trust it to send legitimate data).

    It's a bit exciting/fascinating to read about the chain of events, (particularly the timeline):

    http://blog.cloudflare.com/the... [cloudflare.com]

    http://blog.cloudflare.com/pos... [cloudflare.com]

  • by marcgvky (949079) on Wednesday January 29, 2014 @01:13PM (#46101063) Journal
    I am a GoDaddy customer and had a problem with my ex-partner: he tried to social engineer his way into grabbing control of our domains/email accounts, hosted by GoDaddy. Subsequently, I enabled a feature that GoDaddy offers. GoDaddy sends a text message that I must respond with. This extra factor is required for all changes, now. People should enable this feature, regardless of where you host your email. It makes it impossible to social engineer your way past a customer service rep.
    • by pspahn (1175617)

      I use Google Voice as my phone number, you insensitive clod!

    • by wvmarle (1070040)

      "Hey godaddy, my house burned down with that phone in it, so I can't get to those messages nor or ever, please change it to my new number 1234-4321 so I can receive your messages again."

  • I'm a strong believer in having individual email addresses for each important login. I don't think I have a single email address that is related to more than 3 logins max. This greatly limits the ability to have a single breech allow someone into the entire kingdom. While this may not be as convenient as having a single pass login.... I'm ok with that. I keep everything in a password wallet (locally, no cloud usage) to have it all organized.
  • Should we not all now jump up and try the same for the other one letter handles? As a matter of civil upsetness?

  • by asylumx (881307) on Wednesday January 29, 2014 @02:10PM (#46101889)

    writes at Medium that he had a rare one-letter Twitter username

    Well done.

  • by Boawk (525582) on Wednesday January 29, 2014 @02:42PM (#46102299)
    Wow, that must be rare, there can't be more than about a hundred of those.
  • by SpaceLifeForm (228190) on Wednesday January 29, 2014 @08:50PM (#46105899)
    Link [techcrunch.com]

Pause for storage relocation.

Working...