osdir.com
mailing list archive F.A.Q. -since 2001!



Subject: How to Avoid the Sarah Palin "Secret
Question" Account Trap - msg#00007

List: org.pfir.announce

Mail Archive Navigation:
by Date: Prev Next Date Index by Thread: Prev Next Thread Index


How to Avoid the Sarah Palin "Secret Question" Account Trap

http://lauren.vortex.com/archive/000431.html


Greetings. I've already discussed the hacking of Sarah Palin's
Yahoo e-mail account and why that hack was both dumb and wrong
( http://lauren.vortex.com/archive/000429.html ).

But how was this attack accomplished? Reports suggest that a
youngster exploited one of the weakest aspects of account protection
at many sites, the so-called "secret question" system.

The secret question (and its corresponding "secret answer") is
supposed to be used for you to recover system access when you've
lost or forgotten your real password. Questions like: "What is your
favorite color?" or "What High School did you attend?" (that's the
one that was used in Palin's case, we're told), or "What was your
first dog's name?" and so on.

Supposedly the concept behind this approach is to come up with
something that you know well and won't forget. The problem of
course is that in many cases the answers to these questions are
trivial to guess or research, as seems to have been the case with
Palin's account hacker.

Is there a way to avoid just using random alphanumeric strings as
answers to secret questions (that's my approach of choice, by the
way) and still reduce the probability of your answers being easily
hacked?

Sure. Lots of ways. Here are just a few.

You can simply answer the questions incorrectly -- that's an obvious
approach. Or you can misspell answers. One particularly useful
technique is simply to add unrelated text onto the correct answers
(ideally different at every site, but even using the same add-on
string everywhere would be better than nothing within the context of
secret questions). So for example, your first dog might be
"Manfred23Skidoo" -- your favorite color could be "blueRasputin" --
and so on.

The idea is simply to choose answers that are memorable, combined
with some additional easy to remember text that renders the main
part of the answer useless for hacking by itself, even by someone
who has researched your pets, color preferences, educational
background, and so on.

Such simple techniques can go a long way toward helping to protect
your Internet accounts without requiring any changes to the systems
themselves. Obviously these methods are not foolproof, but small
changes in the ways that we treat account information can make
significant improvements in security, with relatively little effort
on our part really being required.

--Lauren--
Lauren Weinstein
lauren@xxxxxxxxxx or lauren@xxxxxxxx
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
- People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
- Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com


Thread at a glance:

Previous Message by Date:

Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong

Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong http://lauren.vortex.com/archive/000429.html Greetings. By now you've probably heard -- assuming that we're not dealing with a sophisticated and probably unlikely political hoax -- that Sarah Palin's Yahoo account has been hacked, and apparently quantities of her e-mail, photos, and related materials have been publicly posted ( http://gawker.com/5051193/sarah-palins-personal-emails )._ Since it has previously been suggested in some quarters that Gov. Palin often used private e-mail accounts for Alaska state business - -- which would avoid government data retention laws associated with official e-mail -- the exposure of the Yahoo data seems to be triggering considerable glee in some quarters. As much as I hold in disdain the concept of someone like Sarah Palin being considered for a single microsecond as qualified to be Vice President of this great country, and as much as I find most of her viewpoints and her public modus operandi to be appalling, I still must assert that any joy over this hacking is dumb, wrong -- and dangerous -- both from ethical and practical standpoints. The ethical issue should be clear enough and is as old as mankind -- we shouldn't be doing to others that which we wouldn't want done to ourselves. Palin's truly personal e-mail and photos have no bearing on the political situation, yet they've been posted along with everything else. There's simply no justifying this from an ethical standpoint. But the practical issues are equally obvious. There are official channels for the gathering of electronic evidence in cases of suspected wrongdoing. Those channels should not and normally do not include -- and in fact efforts at prosecution can be stymied by -- ad hoc public releases, especially when those materials are obtained through illegal acts as was apparently the case in this situation. Exposure can also trigger premature deletion (maybe still retrievable, maybe not) of other materials that might have been useful to investigators, as may have already happened in this case. Even worse, this chain of events plays into the hands of the Palin/McCain campaign (some observers have suggested that perhaps this was all actually a "dirty trick" from that side -- I consider this to be extremely unlikely based on what we know right now). The hacking and publication of Palin's data unfortunately feeds directly into the sensibilities of many of Palin's supporters, who have already been attempting to position her (up to now I would have said without merit) as a victim of unfair treatment -- and using this to their political advantage. Now the hackers who released her data have handed that campaign a gift that on balance will probably help Palin's and McCain's efforts between now and election day. Many in the public will react to this event with a natural revulsion to the apparent privacy violation, regardless of the contents of the material that was released in this situation. The concept of Sarah Palin being Vice President of the U.S. is not only utterly unacceptable, but also just this side of completely insane. Her presence on the GOP ticket can't help but cause one to question John McCain's judgment and unfortunately his previously untarnished integrity as well. But none of this justifies the hacking of Sarah Palin's accounts. The hackers in this case haven't done any favor to those of us who don't want to see Palin one heartbeat away from the President, and have simultaneously struck a blow against continuing efforts to bring ethics back into the political discourse. Dumb, dumber, and wrong. --Lauren-- Lauren Weinstein lauren@xxxxxxxxxx or lauren@xxxxxxxx Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com

Next Message by Date:

Google Phone "Heavy" Data Users May be Throttled

Google Phone "Heavy" Data Users May be Throttled http://lauren.vortex.com/archive/000433.html Greetings. With today's official announcement of the HTC G1 smartphone running Google's long-awaited Android OS -- sure to inspire significant data usage by many adopters -- a particular section in the fine print of T-Mobile's 3G data information page ( http://www.t-mobileg1.com/3G.aspx ) was brought to my attention by several alert observers. To wit: "If your total data usage in any billing cycle is more than 1GB, your data throughput for the remainder of that cycle may be reduced to 50 kbps or less. Your data session, plan, or service may be suspended, terminated, or restricted for significant roaming or if you use your service in a way that interferes with our network or ability to provide quality service to other users." I'm actually rather disinclined to pass judgment on this policy just yet. Given the special characteristics and limitations of cellular data networks that are certainly different from non-wireless systems, true "data hogs" on the former can be a genuine problem. However, there are a couple of concerns. First, a powerful phone like the G1 is, as I suggested above, going to encourage data usage to an extent not usually seen for other phones in standalone usage. The wide open Google Android development and applications distribution environments are likely to encourage a vast range of attractive data-hungry programs for the G1 -- perhaps far exceeding those of Apple's relatively closed-environment iPhone. This means that reaching 1 GB of data in a month might not be a particularly difficult feat with the G1 (or later Android phones that will appear). We're talking about a bit more than 30 MB per day data usage -- and that's just not the same sort of "big" number that it used to be. If data throttling kicks in, you're likely to really notice the drop from 3G speeds down to 50 Kbps or less (hmm -- just how much less? Inquiring minds want to know ...) I must admit that I'm certainly interested in putting a G1 Android phone through its paces and reporting the results, though I'm not prepared at this point to jump over to a 2-year T-Mobile contract for the privilege. I continue to wonder how much longer T-Mobile will continue without an attempt made to merge it with one of the other U.S. wireless carriers, and some of possibilities in that regard are rather depressing. G1 manufacturer HTC builds great phones. My Cingular 8125 (HTC Wizard) has provided excellent service for several years within its design capabilities, but there's no way getting around that fact that its getting rather long in the tooth, and going out for lunch waiting for MS WM5 to boot does get a bit boring after a while. So I freely admit that if an unlocked G1 Android suddenly appeared here, the SIM card in my Wizard would fly into the G1 faster than you can say PageRank. I won't hold my breath for this to transpire, however. We could potentially be heading for the bizarre and unfortunate situation, in both the cellular wireless and wired Internet environments, where uber-powerful consumer devices of various sorts may routinely outstrip the capabilities of commonly used Internet access facilities (and/or easily run afoul of ISP terms-of-service agreements). Such circumstances would certainly not be expected to inspire consumer confidence nor enthusiasm, to be sure. --Lauren-- Lauren Weinstein lauren@xxxxxxxxxx or lauren@xxxxxxxx Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com

Previous Message by Thread:

Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong

Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong http://lauren.vortex.com/archive/000429.html Greetings. By now you've probably heard -- assuming that we're not dealing with a sophisticated and probably unlikely political hoax -- that Sarah Palin's Yahoo account has been hacked, and apparently quantities of her e-mail, photos, and related materials have been publicly posted ( http://gawker.com/5051193/sarah-palins-personal-emails )._ Since it has previously been suggested in some quarters that Gov. Palin often used private e-mail accounts for Alaska state business - -- which would avoid government data retention laws associated with official e-mail -- the exposure of the Yahoo data seems to be triggering considerable glee in some quarters. As much as I hold in disdain the concept of someone like Sarah Palin being considered for a single microsecond as qualified to be Vice President of this great country, and as much as I find most of her viewpoints and her public modus operandi to be appalling, I still must assert that any joy over this hacking is dumb, wrong -- and dangerous -- both from ethical and practical standpoints. The ethical issue should be clear enough and is as old as mankind -- we shouldn't be doing to others that which we wouldn't want done to ourselves. Palin's truly personal e-mail and photos have no bearing on the political situation, yet they've been posted along with everything else. There's simply no justifying this from an ethical standpoint. But the practical issues are equally obvious. There are official channels for the gathering of electronic evidence in cases of suspected wrongdoing. Those channels should not and normally do not include -- and in fact efforts at prosecution can be stymied by -- ad hoc public releases, especially when those materials are obtained through illegal acts as was apparently the case in this situation. Exposure can also trigger premature deletion (maybe still retrievable, maybe not) of other materials that might have been useful to investigators, as may have already happened in this case. Even worse, this chain of events plays into the hands of the Palin/McCain campaign (some observers have suggested that perhaps this was all actually a "dirty trick" from that side -- I consider this to be extremely unlikely based on what we know right now). The hacking and publication of Palin's data unfortunately feeds directly into the sensibilities of many of Palin's supporters, who have already been attempting to position her (up to now I would have said without merit) as a victim of unfair treatment -- and using this to their political advantage. Now the hackers who released her data have handed that campaign a gift that on balance will probably help Palin's and McCain's efforts between now and election day. Many in the public will react to this event with a natural revulsion to the apparent privacy violation, regardless of the contents of the material that was released in this situation. The concept of Sarah Palin being Vice President of the U.S. is not only utterly unacceptable, but also just this side of completely insane. Her presence on the GOP ticket can't help but cause one to question John McCain's judgment and unfortunately his previously untarnished integrity as well. But none of this justifies the hacking of Sarah Palin's accounts. The hackers in this case haven't done any favor to those of us who don't want to see Palin one heartbeat away from the President, and have simultaneously struck a blow against continuing efforts to bring ethics back into the political discourse. Dumb, dumber, and wrong. --Lauren-- Lauren Weinstein lauren@xxxxxxxxxx or lauren@xxxxxxxx Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com

Next Message by Thread:

Google Phone "Heavy" Data Users May be Throttled

Google Phone "Heavy" Data Users May be Throttled http://lauren.vortex.com/archive/000433.html Greetings. With today's official announcement of the HTC G1 smartphone running Google's long-awaited Android OS -- sure to inspire significant data usage by many adopters -- a particular section in the fine print of T-Mobile's 3G data information page ( http://www.t-mobileg1.com/3G.aspx ) was brought to my attention by several alert observers. To wit: "If your total data usage in any billing cycle is more than 1GB, your data throughput for the remainder of that cycle may be reduced to 50 kbps or less. Your data session, plan, or service may be suspended, terminated, or restricted for significant roaming or if you use your service in a way that interferes with our network or ability to provide quality service to other users." I'm actually rather disinclined to pass judgment on this policy just yet. Given the special characteristics and limitations of cellular data networks that are certainly different from non-wireless systems, true "data hogs" on the former can be a genuine problem. However, there are a couple of concerns. First, a powerful phone like the G1 is, as I suggested above, going to encourage data usage to an extent not usually seen for other phones in standalone usage. The wide open Google Android development and applications distribution environments are likely to encourage a vast range of attractive data-hungry programs for the G1 -- perhaps far exceeding those of Apple's relatively closed-environment iPhone. This means that reaching 1 GB of data in a month might not be a particularly difficult feat with the G1 (or later Android phones that will appear). We're talking about a bit more than 30 MB per day data usage -- and that's just not the same sort of "big" number that it used to be. If data throttling kicks in, you're likely to really notice the drop from 3G speeds down to 50 Kbps or less (hmm -- just how much less? Inquiring minds want to know ...) I must admit that I'm certainly interested in putting a G1 Android phone through its paces and reporting the results, though I'm not prepared at this point to jump over to a 2-year T-Mobile contract for the privilege. I continue to wonder how much longer T-Mobile will continue without an attempt made to merge it with one of the other U.S. wireless carriers, and some of possibilities in that regard are rather depressing. G1 manufacturer HTC builds great phones. My Cingular 8125 (HTC Wizard) has provided excellent service for several years within its design capabilities, but there's no way getting around that fact that its getting rather long in the tooth, and going out for lunch waiting for MS WM5 to boot does get a bit boring after a while. So I freely admit that if an unlocked G1 Android suddenly appeared here, the SIM card in my Wizard would fly into the G1 faster than you can say PageRank. I won't hold my breath for this to transpire, however. We could potentially be heading for the bizarre and unfortunate situation, in both the cellular wireless and wired Internet environments, where uber-powerful consumer devices of various sorts may routinely outstrip the capabilities of commonly used Internet access facilities (and/or easily run afoul of ISP terms-of-service agreements). Such circumstances would certainly not be expected to inspire consumer confidence nor enthusiasm, to be sure. --Lauren-- Lauren Weinstein lauren@xxxxxxxxxx or lauren@xxxxxxxx Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com
blog comments powered by Disqus

Home | News | Sitemap | FAQ | advertise | OSDir is an Inevitable website. GBiz is too!