|
|
Subject: How to Avoid the Sarah Palin "Secret Question" Account Trap - msg#00007
How to Avoid the Sarah Palin "Secret Question" Account Trap
http://lauren.vortex.com/archive/000431.html
Greetings. I've already discussed the hacking of Sarah Palin's
Yahoo e-mail account and why that hack was both dumb and wrong
( http://lauren.vortex.com/archive/000429.html ).
But how was this attack accomplished? Reports suggest that a
youngster exploited one of the weakest aspects of account protection
at many sites, the so-called "secret question" system.
The secret question (and its corresponding "secret answer") is
supposed to be used for you to recover system access when you've
lost or forgotten your real password. Questions like: "What is your
favorite color?" or "What High School did you attend?" (that's the
one that was used in Palin's case, we're told), or "What was your
first dog's name?" and so on.
Supposedly the concept behind this approach is to come up with
something that you know well and won't forget. The problem of
course is that in many cases the answers to these questions are
trivial to guess or research, as seems to have been the case with
Palin's account hacker.
Is there a way to avoid just using random alphanumeric strings as
answers to secret questions (that's my approach of choice, by the
way) and still reduce the probability of your answers being easily
hacked?
Sure. Lots of ways. Here are just a few.
You can simply answer the questions incorrectly -- that's an obvious
approach. Or you can misspell answers. One particularly useful
technique is simply to add unrelated text onto the correct answers
(ideally different at every site, but even using the same add-on
string everywhere would be better than nothing within the context of
secret questions). So for example, your first dog might be
"Manfred23Skidoo" -- your favorite color could be "blueRasputin" --
and so on.
The idea is simply to choose answers that are memorable, combined
with some additional easy to remember text that renders the main
part of the answer useless for hacking by itself, even by someone
who has researched your pets, color preferences, educational
background, and so on.
Such simple techniques can go a long way toward helping to protect
your Internet accounts without requiring any changes to the systems
themselves. Obviously these methods are not foolproof, but small
changes in the ways that we treat account information can make
significant improvements in security, with relatively little effort
on our part really being required.
--Lauren--
Lauren Weinstein
lauren@xxxxxxxxxx or lauren@xxxxxxxx
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
- People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
- Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Thread at a glance:
Previous Message by Date:
Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong
Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong
http://lauren.vortex.com/archive/000429.html
Greetings. By now you've probably heard -- assuming that we're not
dealing with a sophisticated and probably unlikely political hoax --
that Sarah Palin's Yahoo account has been hacked, and apparently
quantities of her e-mail, photos, and related materials have been
publicly posted ( http://gawker.com/5051193/sarah-palins-personal-emails )._
Since it has previously been suggested in some quarters that Gov.
Palin often used private e-mail accounts for Alaska state business
- -- which would avoid government data retention laws associated with
official e-mail -- the exposure of the Yahoo data seems to be
triggering considerable glee in some quarters.
As much as I hold in disdain the concept of someone like Sarah Palin
being considered for a single microsecond as qualified to be Vice
President of this great country, and as much as I find most of her
viewpoints and her public modus operandi to be appalling, I still
must assert that any joy over this hacking is dumb, wrong -- and
dangerous -- both from ethical and practical standpoints.
The ethical issue should be clear enough and is as old as mankind --
we shouldn't be doing to others that which we wouldn't want done to
ourselves. Palin's truly personal e-mail and photos have no bearing
on the political situation, yet they've been posted along with
everything else. There's simply no justifying this from an ethical
standpoint.
But the practical issues are equally obvious. There are official
channels for the gathering of electronic evidence in cases of
suspected wrongdoing. Those channels should not and normally do not
include -- and in fact efforts at prosecution can be stymied by --
ad hoc public releases, especially when those materials are obtained
through illegal acts as was apparently the case in this situation.
Exposure can also trigger premature deletion (maybe still
retrievable, maybe not) of other materials that might have been
useful to investigators, as may have already happened in this case.
Even worse, this chain of events plays into the hands of the
Palin/McCain campaign (some observers have suggested that perhaps
this was all actually a "dirty trick" from that side -- I consider
this to be extremely unlikely based on what we know right now).
The hacking and publication of Palin's data unfortunately feeds
directly into the sensibilities of many of Palin's supporters, who
have already been attempting to position her (up to now I would have
said without merit) as a victim of unfair treatment -- and using
this to their political advantage. Now the hackers who released her
data have handed that campaign a gift that on balance will probably
help Palin's and McCain's efforts between now and election day.
Many in the public will react to this event with a natural revulsion
to the apparent privacy violation, regardless of the contents of the
material that was released in this situation.
The concept of Sarah Palin being Vice President of the U.S. is not
only utterly unacceptable, but also just this side of completely
insane. Her presence on the GOP ticket can't help but cause one to
question John McCain's judgment and unfortunately his previously
untarnished integrity as well.
But none of this justifies the hacking of Sarah Palin's accounts.
The hackers in this case haven't done any favor to those of us who
don't want to see Palin one heartbeat away from the President, and
have simultaneously struck a blow against continuing efforts to
bring ethics back into the political discourse.
Dumb, dumber, and wrong.
--Lauren--
Lauren Weinstein
lauren@xxxxxxxxxx or lauren@xxxxxxxx
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
- People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
- Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Next Message by Date:
Google Phone "Heavy" Data Users May be Throttled
Google Phone "Heavy" Data Users May be Throttled
http://lauren.vortex.com/archive/000433.html
Greetings. With today's official announcement of the HTC G1
smartphone running Google's long-awaited Android OS -- sure to
inspire significant data usage by many adopters -- a particular
section in the fine print of T-Mobile's 3G data information page
( http://www.t-mobileg1.com/3G.aspx ) was brought to my attention by
several alert observers. To wit:
"If your total data usage in any billing cycle is more than 1GB,
your data throughput for the remainder of that cycle may be reduced
to 50 kbps or less. Your data session, plan, or service may be
suspended, terminated, or restricted for significant roaming or if
you use your service in a way that interferes with our network or
ability to provide quality service to other users."
I'm actually rather disinclined to pass judgment on this policy just
yet. Given the special characteristics and limitations of cellular
data networks that are certainly different from non-wireless
systems, true "data hogs" on the former can be a genuine problem.
However, there are a couple of concerns. First, a powerful phone
like the G1 is, as I suggested above, going to encourage data usage
to an extent not usually seen for other phones in standalone usage.
The wide open Google Android development and applications
distribution environments are likely to encourage a vast range of
attractive data-hungry programs for the G1 -- perhaps far exceeding
those of Apple's relatively closed-environment iPhone.
This means that reaching 1 GB of data in a month might not be a
particularly difficult feat with the G1 (or later Android phones
that will appear). We're talking about a bit more than 30 MB per
day data usage -- and that's just not the same sort of "big" number
that it used to be. If data throttling kicks in, you're likely to
really notice the drop from 3G speeds down to 50 Kbps or less
(hmm -- just how much less? Inquiring minds want to know ...)
I must admit that I'm certainly interested in putting a G1 Android
phone through its paces and reporting the results, though I'm not
prepared at this point to jump over to a 2-year T-Mobile contract
for the privilege. I continue to wonder how much longer T-Mobile
will continue without an attempt made to merge it with one of the
other U.S. wireless carriers, and some of possibilities in that
regard are rather depressing.
G1 manufacturer HTC builds great phones. My Cingular 8125 (HTC
Wizard) has provided excellent service for several years within its
design capabilities, but there's no way getting around that fact
that its getting rather long in the tooth, and going out for lunch
waiting for MS WM5 to boot does get a bit boring after a while.
So I freely admit that if an unlocked G1 Android suddenly appeared
here, the SIM card in my Wizard would fly into the G1 faster than
you can say PageRank. I won't hold my breath for this to transpire,
however.
We could potentially be heading for the bizarre and unfortunate
situation, in both the cellular wireless and wired Internet
environments, where uber-powerful consumer devices of various sorts
may routinely outstrip the capabilities of commonly used Internet
access facilities (and/or easily run afoul of ISP terms-of-service
agreements).
Such circumstances would certainly not be expected to inspire
consumer confidence nor enthusiasm, to be sure.
--Lauren--
Lauren Weinstein
lauren@xxxxxxxxxx or lauren@xxxxxxxx
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
- People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
- Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Previous Message by Thread:
Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong
Why Hacking Sarah Palin's E-Mail Was Dumb, Dumber, and Just Plain Wrong
http://lauren.vortex.com/archive/000429.html
Greetings. By now you've probably heard -- assuming that we're not
dealing with a sophisticated and probably unlikely political hoax --
that Sarah Palin's Yahoo account has been hacked, and apparently
quantities of her e-mail, photos, and related materials have been
publicly posted ( http://gawker.com/5051193/sarah-palins-personal-emails )._
Since it has previously been suggested in some quarters that Gov.
Palin often used private e-mail accounts for Alaska state business
- -- which would avoid government data retention laws associated with
official e-mail -- the exposure of the Yahoo data seems to be
triggering considerable glee in some quarters.
As much as I hold in disdain the concept of someone like Sarah Palin
being considered for a single microsecond as qualified to be Vice
President of this great country, and as much as I find most of her
viewpoints and her public modus operandi to be appalling, I still
must assert that any joy over this hacking is dumb, wrong -- and
dangerous -- both from ethical and practical standpoints.
The ethical issue should be clear enough and is as old as mankind --
we shouldn't be doing to others that which we wouldn't want done to
ourselves. Palin's truly personal e-mail and photos have no bearing
on the political situation, yet they've been posted along with
everything else. There's simply no justifying this from an ethical
standpoint.
But the practical issues are equally obvious. There are official
channels for the gathering of electronic evidence in cases of
suspected wrongdoing. Those channels should not and normally do not
include -- and in fact efforts at prosecution can be stymied by --
ad hoc public releases, especially when those materials are obtained
through illegal acts as was apparently the case in this situation.
Exposure can also trigger premature deletion (maybe still
retrievable, maybe not) of other materials that might have been
useful to investigators, as may have already happened in this case.
Even worse, this chain of events plays into the hands of the
Palin/McCain campaign (some observers have suggested that perhaps
this was all actually a "dirty trick" from that side -- I consider
this to be extremely unlikely based on what we know right now).
The hacking and publication of Palin's data unfortunately feeds
directly into the sensibilities of many of Palin's supporters, who
have already been attempting to position her (up to now I would have
said without merit) as a victim of unfair treatment -- and using
this to their political advantage. Now the hackers who released her
data have handed that campaign a gift that on balance will probably
help Palin's and McCain's efforts between now and election day.
Many in the public will react to this event with a natural revulsion
to the apparent privacy violation, regardless of the contents of the
material that was released in this situation.
The concept of Sarah Palin being Vice President of the U.S. is not
only utterly unacceptable, but also just this side of completely
insane. Her presence on the GOP ticket can't help but cause one to
question John McCain's judgment and unfortunately his previously
untarnished integrity as well.
But none of this justifies the hacking of Sarah Palin's accounts.
The hackers in this case haven't done any favor to those of us who
don't want to see Palin one heartbeat away from the President, and
have simultaneously struck a blow against continuing efforts to
bring ethics back into the political discourse.
Dumb, dumber, and wrong.
--Lauren--
Lauren Weinstein
lauren@xxxxxxxxxx or lauren@xxxxxxxx
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
- People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
- Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Next Message by Thread:
Google Phone "Heavy" Data Users May be Throttled
Google Phone "Heavy" Data Users May be Throttled
http://lauren.vortex.com/archive/000433.html
Greetings. With today's official announcement of the HTC G1
smartphone running Google's long-awaited Android OS -- sure to
inspire significant data usage by many adopters -- a particular
section in the fine print of T-Mobile's 3G data information page
( http://www.t-mobileg1.com/3G.aspx ) was brought to my attention by
several alert observers. To wit:
"If your total data usage in any billing cycle is more than 1GB,
your data throughput for the remainder of that cycle may be reduced
to 50 kbps or less. Your data session, plan, or service may be
suspended, terminated, or restricted for significant roaming or if
you use your service in a way that interferes with our network or
ability to provide quality service to other users."
I'm actually rather disinclined to pass judgment on this policy just
yet. Given the special characteristics and limitations of cellular
data networks that are certainly different from non-wireless
systems, true "data hogs" on the former can be a genuine problem.
However, there are a couple of concerns. First, a powerful phone
like the G1 is, as I suggested above, going to encourage data usage
to an extent not usually seen for other phones in standalone usage.
The wide open Google Android development and applications
distribution environments are likely to encourage a vast range of
attractive data-hungry programs for the G1 -- perhaps far exceeding
those of Apple's relatively closed-environment iPhone.
This means that reaching 1 GB of data in a month might not be a
particularly difficult feat with the G1 (or later Android phones
that will appear). We're talking about a bit more than 30 MB per
day data usage -- and that's just not the same sort of "big" number
that it used to be. If data throttling kicks in, you're likely to
really notice the drop from 3G speeds down to 50 Kbps or less
(hmm -- just how much less? Inquiring minds want to know ...)
I must admit that I'm certainly interested in putting a G1 Android
phone through its paces and reporting the results, though I'm not
prepared at this point to jump over to a 2-year T-Mobile contract
for the privilege. I continue to wonder how much longer T-Mobile
will continue without an attempt made to merge it with one of the
other U.S. wireless carriers, and some of possibilities in that
regard are rather depressing.
G1 manufacturer HTC builds great phones. My Cingular 8125 (HTC
Wizard) has provided excellent service for several years within its
design capabilities, but there's no way getting around that fact
that its getting rather long in the tooth, and going out for lunch
waiting for MS WM5 to boot does get a bit boring after a while.
So I freely admit that if an unlocked G1 Android suddenly appeared
here, the SIM card in my Wizard would fly into the G1 faster than
you can say PageRank. I won't hold my breath for this to transpire,
however.
We could potentially be heading for the bizarre and unfortunate
situation, in both the cellular wireless and wired Internet
environments, where uber-powerful consumer devices of various sorts
may routinely outstrip the capabilities of commonly used Internet
access facilities (and/or easily run afoul of ISP terms-of-service
agreements).
Such circumstances would certainly not be expected to inspire
consumer confidence nor enthusiasm, to be sure.
--Lauren--
Lauren Weinstein
lauren@xxxxxxxxxx or lauren@xxxxxxxx
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
- People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
- Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
|
|