18 ms·

>The Bindmans LLP law firm, acting on behalf of Jones, contacted six of those listed to verify their passwords (the others could not be traced). In response, fi

by dTal 10y ago

>The Bindmans LLP law firm, acting on behalf of Jones, contacted six of those listed to verify their passwords (the others could not be traced). In response, five of the six gave passwords that matched those given in the letter, and the sixth was nearly a match. Well jeez no wonder they were hacked if they're that easy to socially engineer. "Verify my password? That's funny, you're the third one this month..."

RubenSandwich 10y ago
I think your selling the victims short here. The law firm could of been more discrete. e.g. "Hello X, We are investigating a case involving the government hacking journalists. You are a person of interest in this case. The government records show that your password is Y. Can you confirm or deny that this was your password around the dates Z?"
- dTal 10y ago
  Well, at the very least, "the sixth was nearly a match" is pretty damning. "Nono, you've got it wrong, MY password is hunterTHREE - you see there was this incident..."
  - RubenSandwich 10y ago
    I'm gonna continue to play Devils advocate here and that person in question could of merely confirmed that it was close. But realistically I think your right. People will gladly handout passwords to people who sound authoritative. It's amazing to me how many DEFCON talks begin with: "So we just pretended to be X and asked for their password and got it."
    - pritambaral 10y ago
      OT: I see you've used "could of" multiple times. Just wanted to say it's "could have". Cheers.
      - eric_h 10y ago
        Or could've, which is clearly the pronunciation s/he was going for.
      - RubenSandwich 10y ago
        Thank you for the pointer. English is not my first language so I often get the grammar wrong.
    - deleted 10y ago
      [deleted]
  - TallGuyShort 10y ago
    For those who don't get this brilliant reference: http://www.bash.org/?244321 http://www.bash.org/?244321
    - garyfirestorm 10y ago
      this is the funniest thing i have ever read!
deadbunny 10y ago
Blaming the victims? Really?
- dTal 10y ago
  Obviously the people hacking accounts are the baddies. But I don't think it's inappropriate to note that, seemingly, someone literally phoned them up, asked for, and received their passwords - and that's not even the main story!
  - cmdrfred 10y ago
    I still can't believe the "humans are generally trusting and helpful to strangers" vulnerability has yet to be patched. http://www.smbc-comics.com/?id=2526 http://www.smbc-comics.com/?id=2526
    - BearGoesChirp 10y ago
      I've been installing cynicism for years. Its a huge patch and the devs seem to have added more bugs than they fixed. It causes some communication issues with those not running the patched version.
    - 6stringmerc 10y ago
      It is a wonderfully effective platform for compelling fiction, however! See: O. Henry.
- hunter2_ 10y ago
  When victims are overtaken by force, coercion, stealth, or a multitude of other reasons, you can't blame them. When a victim in their right mind offers up a secret to someone they didn't authenticate, "victim blaming" as a construct is a stretch.
  - arximboldi 10y ago
    It is not a stretch. The government must not spy its citizens. Period. They are the only ones to get blame. If I get my bike stolen I am not be blamed if I use a shitty lock. If I get raped I am not to be blamed if I was too drunk to resist. If I get hacked I am not to be blamed if I was susceptible to social engineering. Yes, it is very useful for potential victims to learn how to best protect themselves. But the moral responsibility in such violations is on the attacker, and is proportional to the damage caused to the victim, not the efforts taken to cause it. Admittedly, this is part of why part of the crypto-activist community puts me off. Yes, cryptography is a great resistance tool, but my utopia is a society built on cooperation, equality and trust, not one of algebraic fences.
geofft 10y ago
Hmm. Thinking realistically about threat model, a well-known law firm is obligated to behave ethically or will lose the ability to conduct business. If someone who can prove that they're from a reputable law firm - AND that they're acting on behalf of a former Deputy Mayor of London and current member of the House of Lords - comes to me and asks me for my email password with a good reason why they want it, it's not clear that saying yes would be a mistake. Personally, I would almost certainly say no on the principle that nobody should have my email password, but I'd probably be okay with revealing one letter at a time while they also reveal one letter at a time of the alleged password.
- zhte415 10y ago
  Thinking realistically, the chance of a law firm asking for passwords, or any kind of personal information, would be a wise time to defer to legal council, compliance office, or whoever has expertise.
  - geofft 10y ago
    Yup. If this were my work account (or an account I use for work), I'd go in person to IT security and also to our legal counsel, say "Hey, this law firm contacted me because they think that the government has stolen my email password, should I work with them," and follow their advice. And I'd expect "Yes, we know them, they're good folks" to be a potential answer.
    - zhte415 10y ago
      Indeed. And then the ball is in their court to pick up and deliver on.
Joeboy 10y ago
> one of the 10 activists said “their password may have still been in use as recently as late 2015 or early 2016.” So these were all abandoned passwords, at the point Bindmans confirmed them correct. Having said which, the notion that people are generally crap with passwords is obviously correct. Also I wouldn't be at all surprised if the way the article reports the password verification is abridged or at least wildly inaccurate. Edit: I notice the Guardian article says Jones is represented by Jules Carey, who's a very well known and trusted lawyer among UK environmental activists, not a random person. I don't know if that's who they gave up their old passwords to, but we seem to be generally letting our imaginations run away with us here so let's say it was.
- dTal 10y ago
  Good catch! And, recognizing an old password is much harder than recalling it, which would seem to suggest the law firm volunteered the passwords they had first. Morevover, if anything, the fact that all passwords had been changed reflects well on the people in question. It seems I was indeed perhaps too hasty...

by dTal 10y ago

RubenSandwich 10y ago

I think your selling the victims short here. The law firm could of been more discrete. e.g. "Hello X, We are investigating a case involving the government hacking journalists. You are a person of interest in this case. The government records show that your password is Y. Can you confirm or deny that this was your password around the dates Z?"

dTal 10y ago
Well, at the very least, "the sixth was nearly a match" is pretty damning. "Nono, you've got it wrong, MY password is hunterTHREE - you see there was this incident..."
- RubenSandwich 10y ago
  I'm gonna continue to play Devils advocate here and that person in question could of merely confirmed that it was close. But realistically I think your right. People will gladly handout passwords to people who sound authoritative. It's amazing to me how many DEFCON talks begin with: "So we just pretended to be X and asked for their password and got it."
  - pritambaral 10y ago
    OT: I see you've used "could of" multiple times. Just wanted to say it's "could have". Cheers.
    - eric_h 10y ago
      Or could've, which is clearly the pronunciation s/he was going for.
    - RubenSandwich 10y ago
      Thank you for the pointer. English is not my first language so I often get the grammar wrong.
  - deleted 10y ago
    [deleted]
- TallGuyShort 10y ago
  For those who don't get this brilliant reference: http://www.bash.org/?244321 http://www.bash.org/?244321
  - garyfirestorm 10y ago
    this is the funniest thing i have ever read!

deadbunny 10y ago

Blaming the victims? Really?

dTal 10y ago
Obviously the people hacking accounts are the baddies. But I don't think it's inappropriate to note that, seemingly, someone literally phoned them up, asked for, and received their passwords - and that's not even the main story!
- cmdrfred 10y ago
  I still can't believe the "humans are generally trusting and helpful to strangers" vulnerability has yet to be patched. http://www.smbc-comics.com/?id=2526 http://www.smbc-comics.com/?id=2526
  - BearGoesChirp 10y ago
    I've been installing cynicism for years. Its a huge patch and the devs seem to have added more bugs than they fixed. It causes some communication issues with those not running the patched version.
  - 6stringmerc 10y ago
    It is a wonderfully effective platform for compelling fiction, however! See: O. Henry.
hunter2_ 10y ago
When victims are overtaken by force, coercion, stealth, or a multitude of other reasons, you can't blame them. When a victim in their right mind offers up a secret to someone they didn't authenticate, "victim blaming" as a construct is a stretch.
- arximboldi 10y ago
  It is not a stretch. The government must not spy its citizens. Period. They are the only ones to get blame. If I get my bike stolen I am not be blamed if I use a shitty lock. If I get raped I am not to be blamed if I was too drunk to resist. If I get hacked I am not to be blamed if I was susceptible to social engineering. Yes, it is very useful for potential victims to learn how to best protect themselves. But the moral responsibility in such violations is on the attacker, and is proportional to the damage caused to the victim, not the efforts taken to cause it. Admittedly, this is part of why part of the crypto-activist community puts me off. Yes, cryptography is a great resistance tool, but my utopia is a society built on cooperation, equality and trust, not one of algebraic fences.

geofft 10y ago

Hmm. Thinking realistically about threat model, a well-known law firm is obligated to behave ethically or will lose the ability to conduct business. If someone who can prove that they're from a reputable law firm - AND that they're acting on behalf of a former Deputy Mayor of London and current member of the House of Lords - comes to me and asks me for my email password with a good reason why they want it, it's not clear that saying yes would be a mistake. Personally, I would almost certainly say no on the principle that nobody should have my email password, but I'd probably be okay with revealing one letter at a time while they also reveal one letter at a time of the alleged password.

zhte415 10y ago
Thinking realistically, the chance of a law firm asking for passwords, or any kind of personal information, would be a wise time to defer to legal council, compliance office, or whoever has expertise.
- geofft 10y ago
  Yup. If this were my work account (or an account I use for work), I'd go in person to IT security and also to our legal counsel, say "Hey, this law firm contacted me because they think that the government has stolen my email password, should I work with them," and follow their advice. And I'd expect "Yes, we know them, they're good folks" to be a potential answer.
  - zhte415 10y ago
    Indeed. And then the ball is in their court to pick up and deliver on.

Joeboy 10y ago

> one of the 10 activists said “their password may have still been in use as recently as late 2015 or early 2016.” So these were all abandoned passwords, at the point Bindmans confirmed them correct. Having said which, the notion that people are generally crap with passwords is obviously correct. Also I wouldn't be at all surprised if the way the article reports the password verification is abridged or at least wildly inaccurate. Edit: I notice the Guardian article says Jones is represented by Jules Carey, who's a very well known and trusted lawyer among UK environmental activists, not a random person. I don't know if that's who they gave up their old passwords to, but we seem to be generally letting our imaginations run away with us here so let's say it was.

dTal 10y ago
Good catch! And, recognizing an old password is much harder than recalling it, which would seem to suggest the law firm volunteered the passwords they had first. Morevover, if anything, the fact that all passwords had been changed reflects well on the people in question. It seems I was indeed perhaps too hasty...