Hackers Break Into Ringo Starr's Twitter Account With Simple Password Reset 118
blottsie writes: Ringo Starr's account was compromised by a hacker operating under the username "af," who spoke to the Daily Dot about the breach. The hacker says he gained access to an email account associated with Doug Brasch, senior director of digital marketing at Universal Music Group, who managed Starr's Twitter account. He simply used an email password reset to gain access.
Email got hacked (Score:3, Insightful)
so the real hack was the email account not twitter?
Re:Email got hacked (Score:5, Funny)
so the real hack was the email account not twitter?
Exactly. If it was a "simple Password reset" it would have been:
Security question: What's your favorite band?
Answer: The Beatles.
Re: (Score:2)
Record your answer somewhere safe.
Like a piece of paper stuck beneath the keyboard.
Re: (Score:2)
I hate websites forcing Security Questions down my throat for this reason.
Worst are those who require you to answer their questions, and not your own.
What was your mother's maiden name?
I never knew who my mother were, you insensitive clod! And if I did know, I bet that a quick search of any genealogy site would tell an intruder too.
What city were you born in?
I wasn't born in a city, you insensitive clod! And isn't town of birth public data?
What was the name of your 6th grade teacher?
People seriously remember this into their 70s?
I wonder how many of the secret answers are "FUCK
Re: (Score:2)
Use a strong random string as the answer, regardless of what the question is, and store it in a password manager (next to the question). Then the question doesn't matter, it's only used for lookup.
What is your mother's maiden name? JbdsxnzvB31M4uW0AxVsh2gIcFHhgN
What is your favorite color? ESWKiF0J8IyZj7aZQzCjsAhGcyn4QC
Re: (Score:2)
But the whole point of the 'security questions', is that you've lost your password. If you're using a password manager to store your passwords already, then there's no point using it to store your answers, because then you'd have your actual password, and wouldn't need the 'security questions'.
You might as well type in random text, and not even bother to remember it, if you're going to use a password manager to store it. I hate the things too.
Re: (Score:2)
You might as well type in random text, and not even bother to remember it, if you're going to use a password manager to store it.
You have to store the answers to the "security questions", because sometimes websites will require you to know them, even if you have your password. It's happened to me more than once.
Of course, they shouldn't actually be called "security questions" (since the purpose is not to enhance security, but to actually weaken it so customer service doesn't have to deal with people who forgot their password) but obviously they can't admit to that. And since they need to pretend it's about security, they also need to
Re: (Score:2)
You have to store the answers to the "security questions", because sometimes websites will require you to know them, even if you have your password. It's happened to me more than once.
Well. That's pretty stupid. In that case I guess you're stuck, and your random answers are a pretty good idea. I don't know that most password managers actually support 'security questions' without creating a whole new entry for each one - the one I use (keepass) certainly doesn't. It's time that we used a hardware security dongle - you know, like we do with doors - to allow people into their accounts.
Re: (Score:2)
Some password managers allow you to store description (arbitrary text) alongside the passwords.
That's what I do. MyPasswordSafe allows storing comment text with each entry, so I put the "security question"/answer pairs in there.
Re: (Score:2)
But the whole point of the 'security questions', is that you've lost your password. If you're using a password manager to store your passwords already, then there's no point using it to store your answers, because then you'd have your actual password, and wouldn't need the 'security questions'.
Right. All this extra "security" bullshit we have to put up with is because of the idiots who don't use password managers, (and password generators). It's the dumbing-down of security. I don't see how these people will ever learn if they're always having their hands held. Let them lose control of a few accounts. Then, maybe, they'll get with the program.
Re: (Score:1)
I had a credit card hacked once. The person used it to pay for a lot of crap on iTunes. When I called Apple support, the said that the credit card was attached to a different account. So when the support person wanted to validate who I was, she asked me for the answers to my secret questions. I had scrambled answers like you describe. I also always use the maximum number of characters that the field (or rule) will allow. About 50 characters into it, she said she knew it was me.
Re: (Score:1)
Re: (Score:2)
It was an iCloud email address, but in this case, Apple's security questions were such that the answers could be found via Facebook.
31337 (Score:5, Insightful)
Re:31337 (Score:5, Informative)
Re: (Score:1)
Around the late 90's, if I recall correctly.
you mean IIRC
Re: (Score:2)
Re: (Score:2)
Long before that, try early/mid 80's.
Re: (Score:1)
As far as I'm aware it's always meant that.
It's just that until the 90's the only people with anything important accessible by computer were big businesses and the government so the douchebags could pretend to be Robin Hood class d-bags instead of The Joker class d-bags.
I thought a "hacker" built stuff and a "cracker" broke stuff. "Breaking into an account" would then fall under "cracking," not hacking. AFAIK, "hacking" is when you use some paperclips, a few resistors, and a perl script to turn your motherboard into a radio. THAT is hacking.
Did you circumvent encryption? Crack.
Did you come up with a no-cd game patch? Crack.
Did you figure out how to send digital files UUencode-style via SMS using a rooted iPhone? Hack.
Did you make your line printer play Christmas songs? Hac
Hackers and crackers (Score:2)
I thought a "hacker" built stuff and a "cracker" broke stuff.
There has been an attempt to get that usage adopted, but it's failed.
Basically, the definition of "cracker" as "A poor and usually bigotted white person living in the south" is so well accepted in America that it hasn't been possible to graft a new definition on.
see: ubran dictionary [urbandictionary.com] or NPR [npr.org]
Re: (Score:2)
I can't confirm when it started, but it reached a peak when people started swiping their friend's unlocked smartphones and posting douchey photo to the owner's Facebook page, along with the text "You've been hacked LOL!"
It's handled by a marketing droid (Score:2)
I wonder how many celebrities don't even have access to (ostensibly) their own social media accounts?
Also, who cares about Ringo Starr in 2016?
Re: (Score:3)
Probably quite a lot of them. You don't actually think celebrities are making all those posts to Facebook and Twitter themselves, right?
Re: (Score:2)
I dunno. If Kanye isn't making his own Tweets, he ought to fire whoever he has doing it for him.
Re: (Score:2)
Re: (Score:2)
Also, who cares about Ringo Starr in 2016?
Rory and the Hurricanes [youtube.com] is as sweet a pop song as anyone puts out today.
E-mail is the universal key (Score:5, Insightful)
I occasionally run into people who don't believe they need to be very careful with their e-mail security, because "it's only e-mail, it's not like my bank account or anything". But given that virtually every other online account you create uses e-mail to manage password reset, it is your bank account. And everything else.
Use a good password on your e-mail account, and enable two-factor authentication. If your e-mail provider doesn't offer 2FA, or offers a form of it that's too inconvenient to use, get a better e-mail provider. #emailmatters
Re:E-mail is the universal key (Score:5, Insightful)
#emailmatters
#hashtagsareretarded
Re: (Score:2)
#emailmatters
#hashtagsareretarded
#itsapoundsignanditisretardedtoo
#icallitanoctothorpeyouinsensitiveclod
Re: (Score:2)
If you want a better e-mail provider you'll have to pay for it. If you ever get unable to pay (say, unemployment, homeless, prison, war, disease etc.) you're then at a risk of losing it all. :). And I have never thought yet about what happens if I lose a phone number tied to a password!
As for 2FA there's no way I'm giving my phone number to $email_provider
We need some way to be secure without recurring bills. e.g. using Firefox instead of IE was free at least.
Re: (Score:3)
As for 2FA there's no way I'm giving my phone number to $email_provider
Well texts are far from being the ONLY way to get 2FA but beyond that, perhaps you're too paranoid to be on the internet?
Re: (Score:2)
If you want a better e-mail provider you'll have to pay for it.
Gmail is free, and has excellent security. Better than any paid service I've seen, actually.
As for 2FA there's no way I'm giving my phone number to $email_provider
So, don't use phone-based 2FA. Continuing with Gmail as an example, you can get 2FA via security key (a little USB stick), smartphone app, printed codes (pieces of paper you carry in your wallet), SMS or voice phone. Only the last two involve your phone number. Though I have to wonder... just what do you think $email_provider is going to do with your phone number anyway? And if you don't want them to have it, you'd b
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I use the same scheme, although I'm harder with _everything_ gets their own email address.
Small companies that look at things manually usually get confused when I fill in the email address "smallcompany.com@example.com". One even canceled an order because they didn't believe the email address. (Apologies and rebate though when I told them that yes, that's the correct one.)
I also sort every @example.com in a separate mailbox. If anyone have a good tip of a good imap server/mail reader combo that can handle a
PGP Reset Emails (Score:2)
I've wondered why services don't allow you to do something like add a PGP public key, and all notifications from that site are sent encrypted to that key. If someone gets ahold of your reset email, well unless they have your private key and passphase, they're still out of luck. Furthermore, legit email notices could be signed by a known public key of the site.
OK, it was a bit rhetorical perhaps, as I know not many are familiar with PGP to use it. Outlook doesn't support it out of the box so that cuts out a
It's a business solution, not a technological one (Score:1)
I've wondered why services don't allow you to do something like add a PGP public key, and all notifications from that site are sent encrypted to that key. If someone gets ahold of your reset email, well unless they have your private key and passphase, they're still out of luck. Furthermore, legit email notices could be signed by a known public key of the site.
OK, it was a bit rhetorical perhaps, as I know not many are familiar with PGP to use it. Outlook doesn't support it out of the box so that cuts out a lot of users right there. And even people technical enough to know what its doing don't always like it.
And I guess the problem then would be people saying "I forgot my PGP passphase, please help!". So maybe it wouldn't actually solve much and still be prone to social engineering. But still. In 2016 I would have thought we'd have a better handle on privacy and security.
Because that doesn't make sense from a business standpoint.
2-factor authentication to your phone works for most consumers. For higher-value accounts of celebrities, etc..., people should be able to pay to have password resets confirmed by fedex or by phone call to their IT department/agent/secretary.
Re: (Score:2)
simple solution - expire passwords at random time intervals
Which is itself a stupid policy and has been proven time and time again to only lead users to choosing weaker passwords, writing their passwords down, etc. so they can remember them.
Re: (Score:2)
Don't allow them to set weak passwords. If you allow your users to set weak passwords, expect them to set weak passwords.
Users will set the weakest password you will let them get away with. You can try to set all sorts of arcane rules and yet users will still find ways to make weak passwords.
As far as writing it down goes, you're never going to stop that. I've come across users that wrote down even the simplest of passwords; forcing harder passwords is not going to change that.
Forcing them to constantly change their password is going to KEEP them doing it.
Your argument is worthless as long as we're talking about passwords. Once there is a working replacement for passwords, your argument has merit.
It's only "worthless" if you don't actually really care about opsec. Enjoy your users' accounts being easy to break in to.
This is what you get when... (Score:2)
Re: (Score:2)
lol
Good one.
Was his password.... (Score:2)
Curious (Score:1)
So much for the new management (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
As well you should. I see so much noise from so-called "old timers" who think they're the end-all be-all of defining what /. should be. Like not reading an article that you can see from the title isn't to your taste is a fucking burden.
I can tell that you guys are trying. It's one reason I'm back after several years of not bothering to check this place at all.
As long as you guys can keep the shitposts down, I think we're good.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Well, you fired those two worthless losers when you arrived, which was a great breath of fresh air. There's still one left, who apparently thinks that the word "hack" plus the word "Twitter" equals "Slashdot story". How many weeks do you need to stop posting stuff like this? I volunteer to start picking out stories instead of timothy. I'll do it for free, too. As a bonus, my stories will not repeat themselves in the same 24 hours, I will use a spell checker, and I will explain unfamiliar concepts and a
Re: (Score:2)
Re: (Score:2)
Sorry, I react poorly to people to whom I perceive have flipped me the bird verbally.
In the past, the firehose has been roundly ignored when it votes up inconvenient stories like the Albright "burn in hell" story. Thus, me and a lot of other people stopped using it a long time ago. Try renaming it to something other than 'firehose' and tell us that it'll auto-post no matter how damaging the topic matter is to the Democrats.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
There's not going to be a pro-Trump story because that prick has no one's interests at heart than his own. If you're looking for "Fox News" style "fair and balanced" you can fuck right off to your fascist hacienda and die.
By your imaginary "news for nerds" filter, how would a pro-Trump story even be a thing here? You're a bit of a prat.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No you just have to learn the customs of a sane community. Raging at "the man" without a point of reference is seldom productive.
Re: (Score:2)
Imaginary news for nerds filter? WTF? It is the founding statement of the website. It's why we're all here. By nerds, for nerds. I am seriously having a problem comprehending how you don't know this.
If you have a problem tolerating people who think differently from yourself, you fit all the criteria in this article. Here is a particularly damaging excerpt that describes you to a T:
Re: (Score:2)
Re: (Score:2)
And I react poorly to people that think that they alone represent the filter through which "News for Nerds" should pass. There's so many of you grognard assholes. Get the fuck over it. The new ownership does seem to care. They just don't have to specifically care about YOU.
Peace and Love, Peace and love! (Score:2)
it's not like a celebrity has any different security than normal people.
But it's still funny.
Re: (Score:2)
Ringo isn't even involved. As stated, this was someone breaking into the email of the guy who runs Ringo's Twitter account.
Where's the IT angle? (Score:1)
Motive (Score:2)
useful? (Score:2)
Can I use this "hack" to get my old, bot-stolen (because I obviously didn't care back then), twitter account back?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)