13 ms·

Hackers Stole My Website

147 points by vezycash 10y ago

vezycash 10y ago
>I’ve heard of identity theft, and of cyber hacking, but honestly, my attitude... was “it could never happen to me.” >I didn’t exactly understand why it was such a huge deal. >Couldn’t you just explain to people what had happened, prove who you were, and sort it all out? >it seemed completely impossible to me that someone could actually get away with pretending to be someone else with any real consequences beyond a few phone calls and some irritation. I have nothing to hide... "The only thing necessary for the triumph of evil is for good men to do nothing." - Edmund Burke
deleted 10y ago
[deleted]
_eht 10y ago
>3. Turn off your computer and personal devices when they’re not in use. This article reads like an AOL scare from 1995 directed at my grandma.
- brianmartinek 10y ago
  Agree. No mention of turning on 2FA as a security measure or using a password manager to help create those "total nonsense" passwords.
- blowski 10y ago
  And yet many people who were born in 1995 are still using crappy passwords, downloading crappy files from crappy sites with no protection. This stuff may be obvious to us, but it seems we're in a minority.
  - et-al 10y ago
    EDIT: If you're going to downvote me, did you even read the article? Also, go look at the submitter's history: https://news.ycombinator.com/submitted?id=vezycash https://news.ycombinator.com/submitted?id=vezycash - - - But should it be on the front page of Hacker News? Why did vezycash take the effort to share this when it has little value for the HN audience? The author nevers explain how their domain was stolen, nor do they tell us if the "sting" operation (asking to stop a wire transfer, hardly a sting) was successful. It's a long-winded rant about HostMonster and GoDaddy being shitty. We already knew these things. If the article was just focused criticism on GoDaddy or clear advice on web security, I wouldn't be so hash. Whatever educational benefits there were in article are lost with the writing. This has got to be on the front page because of some shilling.
    - sverige 10y ago
      It's obvious, isn't it? It's here because this is Hacker News and the theft of the website was done by hackers so this is news for our consumption. </sarc> (an HTML5 compliant tag, since </s> has been repurposed)
      - et-al 10y ago
        Pretty much. I wonder how many people actually read the article.
        blowski 10y ago
        I found it an interesting story to share with non-techie people about why they need to worry about security. Also, HN Guidelines ask you not to suggest people haven't read the article. If you don't like the article, flag it or make a constructive comment (which I think you did) and move on.
        et-al 10y ago
        Cheers, thanks.
    - bittercynic 10y ago
      I think it is valuable to be reminded of the depth of ignorance of even "tech savvy" people.
      - et-al 10y ago
        The author is a lifestyle blogger, not a tech savvy person.
        bittercynic 10y ago
        Since she owns and operates a blog, an average person would consider her highly tech savvy.
  - Ajedi32 10y ago
    I think the point is that "Turn off your computer and personal devices when they’re not in use." is not an effective security measure. (What are you worried about? Malware? Malware can steal your account just as easily when you _are_ using your computer as when you aren't.) Some of the other advice in that section is also rather questionable. (E.g. "Your password should not contain “real” words".)
- discreditable 10y ago
  > 3. Turn off your computer and personal devices when they’re not in use. Even Bruce Schneier recommends you do that[1]. The idea is that if your machine is a spambot and you don't know it, there are fewer windows of time where your machine can be blasting the Internet with spam. Or if there's some network-based exploit, you're not vulnerable while your device is off. 1. https://www.schneier.com/blog/archives/2004/12/safe_personal_c.html https://www.schneier.com/blog/archives/2004/12/safe_personal...
  - Ajedi32 10y ago
    > Turn off the computer when you're not using it, especially if you have an "always on" Internet connection. How old is that article? Sounds like this is from the days back when dial-up was still popular. I guess there may be some marginal increase in security by turning off your computer like this, but I don't think it's the kind of thing most users should be worried about. > if your machine is a spambot and you don't know it, there are fewer windows of time where your machine can be blasting the Internet with spam If your machine is part of a botnet, you're already compromised and turning it off when you're not using it isn't going to fix that. It might marginally help _other_ people getting DDoSed or spammed by your PC, but it won't improve your own security. > Or if there's some network-based exploit, you're not vulnerable while your device is off I guess. But unless you become aware of the exploit and take measures to mitigate it before turning your PC on and connecting it to the internet, leaving it off when you're not using it is unlikely to help with this - you'll just be compromised as soon as you turn your PC on. Not to mention that the kind of zero-day that would allow compromising a fully up-to-date PC with nothing more than network access to it is extremely rare. I'd argue the security benefits of leaving your computer on so it can auto-install security updates while you're away probably outweighs any marginal benefits you might get from turning it off when not using it. (Though either way the difference is extremely minor.)
    - discreditable 10y ago
      The article is from 2004. Keep in mind it's geared towards being very simple. I don't think some of the advice is good, such as deleting cmd.exe and command.com.
theamk 10y ago
> If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking. So true! A $100 unrooted Android tablet is almost infinitely more secure than the windows/mac, even with the best antivirus. Or if you like physical keyboard (I do), get a $300 Chromebook and do all your banking there. Just don't login with your primary google account, or someone may install evil chrome extension on it.
- fiddlerwoaroof 10y ago
  If you want to go down this route, I'd just use qubes os to run each set of apps in its own vm. Sure, you have issues with vm escapes but it's a lot more convenient than switching devices.
  - theamk 10y ago
    Well, qubes requires technical expertise, and a lot of people have a tablet anyway. My point is, if you want to check online banking, your tablet (ipad|android) is much more secure than your (windows|linux|mac) laptop. For example, here is how I would explain Android security to someone non-technical: "Do not ever enable 'unknown sources' setting, and always refuse if it asks you something about installing a keyboard". Try doing the same for full-featured laptop.
ploggingdev 10y ago
> 1. Have a really, really good password, and change it often. Even better, use a password manager. > 2. If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking. Not necessary, use an up to date computer with Windows defender turned on and create a non-admin account for your kids. > 4. Have antivirus software on your computer Only use Windows defender, which is what the security community recommends. Also use 2FA on all services which offer it. Regarding the domain registrars, I would recommend Namecheap. They have a great support team and also offer 2FA, but I think it's only SMS based 2FA.
- brianmartinek 10y ago
  I really wish domain registers offered a Google Authenticator option for 2FA. All of the ones I have seen that offer 2FA are SMS based.
  - deleted 10y ago
    [deleted]
  - deleted 10y ago
    [deleted]
  - ams6110 10y ago
    SMS is far better than nothing. Your average script kiddie is not going to be able to intercept your SMS messages. If you are specifically targeted by sophisticated attackers, maybe.
    - seccess 10y ago
      My biggest gripe with SMS 2FA is that it is prone to locking me out of my accounts on travel, if I suddenly need to log in to something and my phone number isn't the same abroad.
      - deleted 10y ago
trevyn 10y ago
And then I called the wire transfer company and placed a stop on the payment. How do you place a stop on a wire transfer? I thought irreversibility was the whole point of wire transfers.
- gtdawg 10y ago
  I was thrown by this too. If the destination account had the funds deposited, which set the domain transfer process in motion, I don't think a stop payment works. What I do think works is reporting that the money was involved in fraud and freezing the money in the destination account, subject to the destination banks cooperation with the source bank and FBI. https://www.quora.com/Can-wire-transfers-be-reversed-in-case-of-fraud-What-options-does-a-customer-have-if-they-have-been-defrauded-and-paid-via-wire-transfer https://www.quora.com/Can-wire-transfers-be-reversed-in-case...
- appleiigs 10y ago
  The whole point of wire transfers is traceability. The banks can watch it very closely. I've been able to reverse wire transfers the next day, with a back-date (ie. pretend it never happened). However, author seems to know wire transfers as well as she knows internet security - which is not very well. You can trace the wire into the destination account, but if that person moves it immediately and eventually withdraws it out of the banking system, then it's gone. The hacker wouldn't release the domain unless they had control of the funds. I doubt her claims that the hacker doesn't have the money.
  - mustacheemperor 10y ago
    Yeah, I think there's either missing details regarding the attorneys, etc (which is possible) or this is really "How I Paid $30,000 for My Website." Either way the lack of customer protection from the host and registrar is appalling to me.
- rubicon33 10y ago
  I as well had this thought... I feel like we're not getting all the details on this particular point.
meow_mix 10y ago
Crazy experience --very surprised the FBI was as helpful as you described. I definitely wouldn't have considered that move but I'm glad the author mentions it.
jeremyt 10y ago
So let me get this straight, her domain got hacked, transferred to a hacker, who proceeded to sell it. Then, she contacted the FBI, who gave her an interview and basically did not much, and then she got her domain back by paying for it and then putting a stop on the money transfer? And this is worthy of a Sandra Bullock movie? Yeah, real nail biter there. This is just content hacking to get me to read more of the article so she can make more money on medium. I feel a bit cheated.
- cityzen 10y ago
  Not to mention this was written up by her on mashable back in 2014.... (I commented elsewhere in the thread about it). But yes, I agree completely.
twostorytower 10y ago
The most surprising thing is how helpful (and immediate) the FBI was. Wouldn't have guessed that. Can you really stop a wire transfer? I thought the whole point of wires is that they are immediate and irreversible? Also, couldn't the FBI track the bank account info back to the thief? Or I guess it's possible the bank account is opened through a stolen identity. I guess the smartest thing the thief could do is then use that money to buy crypto and eventually funnel that back to his real identity.
- akcreek 10y ago
  Money was wired to an escrow service who was informed of the situation ahead of time and expecting the incoming wire.
tobyjsullivan 10y ago
It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.). So the #1 step to reducing your risk of an attack like this would be setting up 2FA on your email account. The industry standard is password resets via email. If an attacker has access to your email, they have access to every online account you own. Stealing email passwords is easy. So easy. No matter how complicated your password is or how often you change it. 2FA is an easy, reliable way to make it orders of magnitude harder for any attacker to breach your account. I know I'm preaching to the choir here on HN but I'm just flabbergasted this didn't make it into the article.
- darkhorn 10y ago
  Step #2 is to use unique passwords for your main email addresses. These passwords should be unique in the universe. You must not use them with another account or to encrypt a file etc. Nowhere! And step #3 is to keep all your softwares up to date; OS, antivirus, browser, your WordPress, its plugins, your Notepad++, WinRAR, firmware of your ADSL modem, other computers on the network, BIOS, smart TV etc. Everything should be updated to the latest version.
  - korethr 10y ago
    And step #4 is to throw up your hands and shout "Fuck it!" the Nth time you lost everything because you can't find your master copy of your password manager, your back up has drifted out of sync, and you just accidentally spilled your coffee on the flash drive that holds your backup-backup--destroying it. Hyperbolic sarcasm aside, keeping on top of security is starting to feel like Alice and the Red Queen -- it takes as fast as you can run just to remain in place. I'm starting to feel a bit more sympathy for those who give up on good practices and start using the same password/pin everywhere and pray that ill will never befall them.
- toothbrush 10y ago
  Yeah so about that 2FA. I have a local email client, which uses IMAP and hence cannot do 2FA. What now? I've always thought this is rather a gaping hole. Of course i use app-specific passwords which presumably won't allow access to webmail or changing the account password, but still, if someone got my app password for IMAP, they could still siphon out password reset emails for all my other services. What do the rest of you do? Only use webmail with 2FA, disable all other access? That seems onerous.
passivepinetree 10y ago
As others have noted, her advice seems to be a little suspect. I took issue with the following: > Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense. Isn't it generally accepted that the XKCD-style "correct horse battery staple" passwords are more secure?
- weka 10y ago
  You would be correct. The plausibility that algos are geared towards one word/phrase with different variants and small additions are higher than the combination of seemingly random words.
- fiddlerwoaroof 10y ago
  As far as I can tell, xkcd passwords are the securest way to generate memorable passwords but it's usually better to use a password manager to generate a random string of characters.
- emanreus 10y ago
  One downside of xkcd style passwords is that they are not accepted everywhere. Many websites have a list of characters you must and must not include in your password.
  - passivepinetree 10y ago
    Right, but a good password manager (like 1pass) will have both options available to generate so you can do XKCD-style where possible and randomly generated characters elsewhere.
EdSharkey 10y ago
Great job, FBI!
shendu 10y ago
Want to share a strange experience I had: in the year 2014, I was looking for buy a .io domain and was surprised to find that citi.io was available, so I bought it in domains.google.com with an expiration date in 5 years and I also noticed that there was a website called citi.io that I could still visit. I didn't change the DNS settings of the new domain I bought and didn't use the domain. Then sometime in 2016, I noticed that the domain didn't belong to me. I tried to look up my history of purchase, there was no such purchase record in my account. Unless my memory fooled me (which I just can't believe), the whole experience made me really confused.
- jacquesm 10y ago
  Maybe you remembered a very vivid dream? The lack of purchase history is a tell that it probably didn't actually happen.
- Psilidae 10y ago
  Check for confirmation emails?
_cairn 10y ago
Her password advice is literally the opposite of the classic https://xkcd.com/936/ https://xkcd.com/936/.
- magic_beans 10y ago
  Whom should I trust?
  - _cairn 10y ago
    Well, I am not very well informed on this topic, however, I tend to believe that the math checks out in the "correct horse" principle. This is a vast oversimplification, but basically longer passwords are better - the brute force complexity of additional length is in the exponent, the character diversity (special chars/numbers/upper+lower case) is in the base. Therefore, make your passwords as long (and randomly chosen - i.e. selection method should not be easy to guess!) as you possibly can.
- cdubzzz 10y ago
  There has been lots of discussion surrounding that comic. I have read a few articles over time and ultimately landed, one way or another, on considering it bad advice. Here is some info from a quick search: https://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase https://security.stackexchange.com/questions/6095/xkcd-936-s...
  - _cairn 10y ago
    Cool thanks for the link! Were you meaning to say that you consider the "correct horse" password selection principles bad advice? Or that the advice given by the author of the article is bad advice?
    - cdubzzz 10y ago
      I feel the "correct horse" method is bad advice. Though, certainly not terrible. I actually followed it for a while and it works amazingly well for memory, but over time I was convinced that the best route is a password manager with randomly generated passwords.
rb808 10y ago
I had a boss who had a domain stolen from him too and never got it back. I realize its handy to be able to easily move registrars whenever you want but can we have it more difficult? Eg it would be nice if a registrar would only transfer a domain if it gets a signed letter which it follows up with a phone call then a 3 month delay. With the cut throat competition out there I'd have thought this would be available by now. After the loss I moved my own domains to google domains which at least has 2fa to access.
cityzen 10y ago
I'm a skeptic and stuff like this always seems like marketing to me. This happened back in/before 2014 and her article on mashable from april 2, 2014 is almost the same: http://mashable.com/2014/04/02/ramshackle-glam-hacking/#j.mbLiAEpsqT http://mashable.com/2014/04/02/ramshackle-glam-hacking/#j.mb... Looks like it got a good number of shares and good velocity so makes sense to keep milking it for what it's worth i suppose. Btw, GoDaddy's response: http://news.softpedia.com/news/GoDaddy-Defends-Itself-in-RamshackleGlam-com-Hacking-435991.shtml http://news.softpedia.com/news/GoDaddy-Defends-Itself-in-Ram...
emanreus 10y ago
> I don’t have my money back yet, but the man who stole my site from me doesn’t have it, either, and won’t be getting it, ever. How did she found out it was a man?
najajomo 10y ago
Pardon my cynicism but is there any actual verifiable third party evidence for this.
johnmoore 10y ago
Anyone who uses godaddy add 2FA now and i mean now. This is my story I enabled 2FA i don't why. I think i read somewhere, how someone got there domains stoled. Last month ago, I got a text message out of the blue, I googled the number and it was godaddy service. So this person had got my username and password in godaddy and hit the 2FA, godaddy uses customer IDs and the password i use was a old password but one i didn't use in any other service. So someone is running through all the customers Id numbers with a password dictonary because i knew this password was on one of those leaked password dictionaries. They can do this because the godaddy site doesn't lock the account out for 24 hours after 5 wrong times. The hacker can try different combinations multiple times. This is a major flaw on there site.
mehdym 10y ago
Most important security measure : Enable 2FA on all your accounts.

147 points by vezycash 10y ago

>I’ve heard of identity theft, and of cyber hacking, but honestly, my attitude... was “it could never happen to me.” >I didn’t exactly understand why it was such a huge deal. >Couldn’t you just explain to people what had happened, prove who you were, and sort it all out? >it seemed completely impossible to me that someone could actually get away with pretending to be someone else with any real consequences beyond a few phone calls and some irritation. I have nothing to hide... "The only thing necessary for the triumph of evil is for good men to do nothing." - Edmund Burke

deleted 10y ago

[deleted]

_eht 10y ago

>3. Turn off your computer and personal devices when they’re not in use. This article reads like an AOL scare from 1995 directed at my grandma.

brianmartinek 10y ago
Agree. No mention of turning on 2FA as a security measure or using a password manager to help create those "total nonsense" passwords.
blowski 10y ago
And yet many people who were born in 1995 are still using crappy passwords, downloading crappy files from crappy sites with no protection. This stuff may be obvious to us, but it seems we're in a minority.
- et-al 10y ago
  EDIT: If you're going to downvote me, did you even read the article? Also, go look at the submitter's history: https://news.ycombinator.com/submitted?id=vezycash https://news.ycombinator.com/submitted?id=vezycash - - - But should it be on the front page of Hacker News? Why did vezycash take the effort to share this when it has little value for the HN audience? The author nevers explain how their domain was stolen, nor do they tell us if the "sting" operation (asking to stop a wire transfer, hardly a sting) was successful. It's a long-winded rant about HostMonster and GoDaddy being shitty. We already knew these things. If the article was just focused criticism on GoDaddy or clear advice on web security, I wouldn't be so hash. Whatever educational benefits there were in article are lost with the writing. This has got to be on the front page because of some shilling.
  - sverige 10y ago
    It's obvious, isn't it? It's here because this is Hacker News and the theft of the website was done by hackers so this is news for our consumption. </sarc> (an HTML5 compliant tag, since </s> has been repurposed)
    - et-al 10y ago
      Pretty much. I wonder how many people actually read the article.
      - blowski 10y ago
        I found it an interesting story to share with non-techie people about why they need to worry about security. Also, HN Guidelines ask you not to suggest people haven't read the article. If you don't like the article, flag it or make a constructive comment (which I think you did) and move on.
        et-al 10y ago
        Cheers, thanks.
  - bittercynic 10y ago
    I think it is valuable to be reminded of the depth of ignorance of even "tech savvy" people.
    - et-al 10y ago
      The author is a lifestyle blogger, not a tech savvy person.
      - bittercynic 10y ago
        Since she owns and operates a blog, an average person would consider her highly tech savvy.
- Ajedi32 10y ago
  I think the point is that "Turn off your computer and personal devices when they’re not in use." is not an effective security measure. (What are you worried about? Malware? Malware can steal your account just as easily when you _are_ using your computer as when you aren't.) Some of the other advice in that section is also rather questionable. (E.g. "Your password should not contain “real” words".)
discreditable 10y ago
> 3. Turn off your computer and personal devices when they’re not in use. Even Bruce Schneier recommends you do that[1]. The idea is that if your machine is a spambot and you don't know it, there are fewer windows of time where your machine can be blasting the Internet with spam. Or if there's some network-based exploit, you're not vulnerable while your device is off. 1. https://www.schneier.com/blog/archives/2004/12/safe_personal_c.html https://www.schneier.com/blog/archives/2004/12/safe_personal...
- Ajedi32 10y ago
  > Turn off the computer when you're not using it, especially if you have an "always on" Internet connection. How old is that article? Sounds like this is from the days back when dial-up was still popular. I guess there may be some marginal increase in security by turning off your computer like this, but I don't think it's the kind of thing most users should be worried about. > if your machine is a spambot and you don't know it, there are fewer windows of time where your machine can be blasting the Internet with spam If your machine is part of a botnet, you're already compromised and turning it off when you're not using it isn't going to fix that. It might marginally help _other_ people getting DDoSed or spammed by your PC, but it won't improve your own security. > Or if there's some network-based exploit, you're not vulnerable while your device is off I guess. But unless you become aware of the exploit and take measures to mitigate it before turning your PC on and connecting it to the internet, leaving it off when you're not using it is unlikely to help with this - you'll just be compromised as soon as you turn your PC on. Not to mention that the kind of zero-day that would allow compromising a fully up-to-date PC with nothing more than network access to it is extremely rare. I'd argue the security benefits of leaving your computer on so it can auto-install security updates while you're away probably outweighs any marginal benefits you might get from turning it off when not using it. (Though either way the difference is extremely minor.)
  - discreditable 10y ago
    The article is from 2004. Keep in mind it's geared towards being very simple. I don't think some of the advice is good, such as deleting cmd.exe and command.com.

theamk 10y ago

> If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking. So true! A $100 unrooted Android tablet is almost infinitely more secure than the windows/mac, even with the best antivirus. Or if you like physical keyboard (I do), get a $300 Chromebook and do all your banking there. Just don't login with your primary google account, or someone may install evil chrome extension on it.

fiddlerwoaroof 10y ago
If you want to go down this route, I'd just use qubes os to run each set of apps in its own vm. Sure, you have issues with vm escapes but it's a lot more convenient than switching devices.
- theamk 10y ago
  Well, qubes requires technical expertise, and a lot of people have a tablet anyway. My point is, if you want to check online banking, your tablet (ipad|android) is much more secure than your (windows|linux|mac) laptop. For example, here is how I would explain Android security to someone non-technical: "Do not ever enable 'unknown sources' setting, and always refuse if it asks you something about installing a keyboard". Try doing the same for full-featured laptop.

ploggingdev 10y ago

> 1. Have a really, really good password, and change it often. Even better, use a password manager. > 2. If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking. Not necessary, use an up to date computer with Windows defender turned on and create a non-admin account for your kids. > 4. Have antivirus software on your computer Only use Windows defender, which is what the security community recommends. Also use 2FA on all services which offer it. Regarding the domain registrars, I would recommend Namecheap. They have a great support team and also offer 2FA, but I think it's only SMS based 2FA.

brianmartinek 10y ago
I really wish domain registers offered a Google Authenticator option for 2FA. All of the ones I have seen that offer 2FA are SMS based.
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
- ams6110 10y ago
  SMS is far better than nothing. Your average script kiddie is not going to be able to intercept your SMS messages. If you are specifically targeted by sophisticated attackers, maybe.
  - seccess 10y ago
    My biggest gripe with SMS 2FA is that it is prone to locking me out of my accounts on travel, if I suddenly need to log in to something and my phone number isn't the same abroad.
    - deleted 10y ago

trevyn 10y ago

And then I called the wire transfer company and placed a stop on the payment. How do you place a stop on a wire transfer? I thought irreversibility was the whole point of wire transfers.

gtdawg 10y ago
I was thrown by this too. If the destination account had the funds deposited, which set the domain transfer process in motion, I don't think a stop payment works. What I do think works is reporting that the money was involved in fraud and freezing the money in the destination account, subject to the destination banks cooperation with the source bank and FBI. https://www.quora.com/Can-wire-transfers-be-reversed-in-case-of-fraud-What-options-does-a-customer-have-if-they-have-been-defrauded-and-paid-via-wire-transfer https://www.quora.com/Can-wire-transfers-be-reversed-in-case...
appleiigs 10y ago
The whole point of wire transfers is traceability. The banks can watch it very closely. I've been able to reverse wire transfers the next day, with a back-date (ie. pretend it never happened). However, author seems to know wire transfers as well as she knows internet security - which is not very well. You can trace the wire into the destination account, but if that person moves it immediately and eventually withdraws it out of the banking system, then it's gone. The hacker wouldn't release the domain unless they had control of the funds. I doubt her claims that the hacker doesn't have the money.
- mustacheemperor 10y ago
  Yeah, I think there's either missing details regarding the attorneys, etc (which is possible) or this is really "How I Paid $30,000 for My Website." Either way the lack of customer protection from the host and registrar is appalling to me.
rubicon33 10y ago
I as well had this thought... I feel like we're not getting all the details on this particular point.

meow_mix 10y ago

Crazy experience --very surprised the FBI was as helpful as you described. I definitely wouldn't have considered that move but I'm glad the author mentions it.

jeremyt 10y ago

So let me get this straight, her domain got hacked, transferred to a hacker, who proceeded to sell it. Then, she contacted the FBI, who gave her an interview and basically did not much, and then she got her domain back by paying for it and then putting a stop on the money transfer? And this is worthy of a Sandra Bullock movie? Yeah, real nail biter there. This is just content hacking to get me to read more of the article so she can make more money on medium. I feel a bit cheated.

cityzen 10y ago
Not to mention this was written up by her on mashable back in 2014.... (I commented elsewhere in the thread about it). But yes, I agree completely.

twostorytower 10y ago

The most surprising thing is how helpful (and immediate) the FBI was. Wouldn't have guessed that. Can you really stop a wire transfer? I thought the whole point of wires is that they are immediate and irreversible? Also, couldn't the FBI track the bank account info back to the thief? Or I guess it's possible the bank account is opened through a stolen identity. I guess the smartest thing the thief could do is then use that money to buy crypto and eventually funnel that back to his real identity.

akcreek 10y ago
Money was wired to an escrow service who was informed of the situation ahead of time and expecting the incoming wire.

tobyjsullivan 10y ago

It sounds like the core of this hack was an attack on her email (followed by password resets for registrar, etc.). So the #1 step to reducing your risk of an attack like this would be setting up 2FA on your email account. The industry standard is password resets via email. If an attacker has access to your email, they have access to every online account you own. Stealing email passwords is easy. So easy. No matter how complicated your password is or how often you change it. 2FA is an easy, reliable way to make it orders of magnitude harder for any attacker to breach your account. I know I'm preaching to the choir here on HN but I'm just flabbergasted this didn't make it into the article.

darkhorn 10y ago
Step #2 is to use unique passwords for your main email addresses. These passwords should be unique in the universe. You must not use them with another account or to encrypt a file etc. Nowhere! And step #3 is to keep all your softwares up to date; OS, antivirus, browser, your WordPress, its plugins, your Notepad++, WinRAR, firmware of your ADSL modem, other computers on the network, BIOS, smart TV etc. Everything should be updated to the latest version.
- korethr 10y ago
  And step #4 is to throw up your hands and shout "Fuck it!" the Nth time you lost everything because you can't find your master copy of your password manager, your back up has drifted out of sync, and you just accidentally spilled your coffee on the flash drive that holds your backup-backup--destroying it. Hyperbolic sarcasm aside, keeping on top of security is starting to feel like Alice and the Red Queen -- it takes as fast as you can run just to remain in place. I'm starting to feel a bit more sympathy for those who give up on good practices and start using the same password/pin everywhere and pray that ill will never befall them.
toothbrush 10y ago
Yeah so about that 2FA. I have a local email client, which uses IMAP and hence cannot do 2FA. What now? I've always thought this is rather a gaping hole. Of course i use app-specific passwords which presumably won't allow access to webmail or changing the account password, but still, if someone got my app password for IMAP, they could still siphon out password reset emails for all my other services. What do the rest of you do? Only use webmail with 2FA, disable all other access? That seems onerous.

passivepinetree 10y ago

As others have noted, her advice seems to be a little suspect. I took issue with the following: > Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense. Isn't it generally accepted that the XKCD-style "correct horse battery staple" passwords are more secure?

weka 10y ago
You would be correct. The plausibility that algos are geared towards one word/phrase with different variants and small additions are higher than the combination of seemingly random words.
fiddlerwoaroof 10y ago
As far as I can tell, xkcd passwords are the securest way to generate memorable passwords but it's usually better to use a password manager to generate a random string of characters.
emanreus 10y ago
One downside of xkcd style passwords is that they are not accepted everywhere. Many websites have a list of characters you must and must not include in your password.
- passivepinetree 10y ago
  Right, but a good password manager (like 1pass) will have both options available to generate so you can do XKCD-style where possible and randomly generated characters elsewhere.

EdSharkey 10y ago

Great job, FBI!

shendu 10y ago

Want to share a strange experience I had: in the year 2014, I was looking for buy a .io domain and was surprised to find that citi.io was available, so I bought it in domains.google.com with an expiration date in 5 years and I also noticed that there was a website called citi.io that I could still visit. I didn't change the DNS settings of the new domain I bought and didn't use the domain. Then sometime in 2016, I noticed that the domain didn't belong to me. I tried to look up my history of purchase, there was no such purchase record in my account. Unless my memory fooled me (which I just can't believe), the whole experience made me really confused.

jacquesm 10y ago
Maybe you remembered a very vivid dream? The lack of purchase history is a tell that it probably didn't actually happen.
Psilidae 10y ago
Check for confirmation emails?

_cairn 10y ago

Her password advice is literally the opposite of the classic https://xkcd.com/936/ https://xkcd.com/936/.

magic_beans 10y ago
Whom should I trust?
- _cairn 10y ago
  Well, I am not very well informed on this topic, however, I tend to believe that the math checks out in the "correct horse" principle. This is a vast oversimplification, but basically longer passwords are better - the brute force complexity of additional length is in the exponent, the character diversity (special chars/numbers/upper+lower case) is in the base. Therefore, make your passwords as long (and randomly chosen - i.e. selection method should not be easy to guess!) as you possibly can.
cdubzzz 10y ago
There has been lots of discussion surrounding that comic. I have read a few articles over time and ultimately landed, one way or another, on considering it bad advice. Here is some info from a quick search: https://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase https://security.stackexchange.com/questions/6095/xkcd-936-s...
- _cairn 10y ago
  Cool thanks for the link! Were you meaning to say that you consider the "correct horse" password selection principles bad advice? Or that the advice given by the author of the article is bad advice?
  - cdubzzz 10y ago
    I feel the "correct horse" method is bad advice. Though, certainly not terrible. I actually followed it for a while and it works amazingly well for memory, but over time I was convinced that the best route is a password manager with randomly generated passwords.

rb808 10y ago

I had a boss who had a domain stolen from him too and never got it back. I realize its handy to be able to easily move registrars whenever you want but can we have it more difficult? Eg it would be nice if a registrar would only transfer a domain if it gets a signed letter which it follows up with a phone call then a 3 month delay. With the cut throat competition out there I'd have thought this would be available by now. After the loss I moved my own domains to google domains which at least has 2fa to access.

cityzen 10y ago

I'm a skeptic and stuff like this always seems like marketing to me. This happened back in/before 2014 and her article on mashable from april 2, 2014 is almost the same: http://mashable.com/2014/04/02/ramshackle-glam-hacking/#j.mbLiAEpsqT http://mashable.com/2014/04/02/ramshackle-glam-hacking/#j.mb... Looks like it got a good number of shares and good velocity so makes sense to keep milking it for what it's worth i suppose. Btw, GoDaddy's response: http://news.softpedia.com/news/GoDaddy-Defends-Itself-in-RamshackleGlam-com-Hacking-435991.shtml http://news.softpedia.com/news/GoDaddy-Defends-Itself-in-Ram...

emanreus 10y ago

> I don’t have my money back yet, but the man who stole my site from me doesn’t have it, either, and won’t be getting it, ever. How did she found out it was a man?

najajomo 10y ago

Pardon my cynicism but is there any actual verifiable third party evidence for this.

johnmoore 10y ago

Anyone who uses godaddy add 2FA now and i mean now. This is my story I enabled 2FA i don't why. I think i read somewhere, how someone got there domains stoled. Last month ago, I got a text message out of the blue, I googled the number and it was godaddy service. So this person had got my username and password in godaddy and hit the 2FA, godaddy uses customer IDs and the password i use was a old password but one i didn't use in any other service. So someone is running through all the customers Id numbers with a password dictonary because i knew this password was on one of those leaked password dictionaries. They can do this because the godaddy site doesn't lock the account out for 24 hours after 5 wrong times. The hacker can try different combinations multiple times. This is a major flaw on there site.

mehdym 10y ago

Most important security measure : Enable 2FA on all your accounts.