9 ms·

Hacked

217 points by grellas 15y ago

losethos 15y ago
All you have to know in life is God is just. I talk to Him, so of course I'm laid-back. If somethign bad happens, you deserved it, it was a blessing in disguise or you'll get a reward. God says... C:\TEXT\EMILY.TXT Would be a daily thing, Did not ourselves the cubits warp For fear to be a king. XV. THE INEVITABLE. While I was fearing it, it came, But came with less of fear, Because that fearing it so long Had almost made it dear. There is a fitting a dismay, A fitting a despair. 'Tis harder knowing it is due, Than knowing it is here. The trying on the utmost, The morning it is new, Is terribler than wearing it A whole existence through. XVI. A BOOK. The ---------------- Yer fucked ROFLMAO
0x12 15y ago
Painful. Great they got their stuff back but apparently it takes knowing people at google to get stuff done beyond the 'sorry we can not answer further emails about this'. I understand that there are limits to what technical support you can offer your end users but the fact that someone is a reporter with 'access' should not be the determining factor in who does and does not get back their email after a hack (which is a large word, account compromised would be a better description) like this.
- 01Michael10 15y ago
  I think it's incredible anyone would think a free service should be expected to recover six years of email. I would rather Google delete my email permanently when I empty my trash and do my own backups.
  - eli 15y ago
    Err, I wouldn't. If you don't trust Google with your old messages, then why do you have a gmail account at all?
    - sliverstorm 15y ago
      So they must either be the Fort Knox/Iron Mountain of email, or else there is no reason whatsoever to use them?
      - eli 15y ago
        No, but I can't think of any additional threat that Google keeping backups of your mail exposes you to that just using Google as your email provider doesn't also expose you to. If you don't trust them to keep your email backups safe, you shouldn't be using them.
  - tsycho 15y ago
    I agree with you, but I think that this was within the 30-day permanent-delete-from-trash window. If you are saying that the the 30-day window is too long, that's a reasonable opinion. Maybe Gmail could offer a user-settable window length, with the default at 30, while more savvy users who trust their own email management could set it to zero. Update: I would even be willing to pay Google for extra features such as the above, and more importantly, for guaranteed/quicker support from them if anything goes wrong.
    - alttag 15y ago
      But the problem with a user-settable window is that a supposed hacker could set it to zero, then delete--which is exactly one of the use cases the "undelete project" desires to handle.
      - carussell 15y ago
        Don't allow the new window to take effect until the length of the old window has lapsed. I.e., make the window apply not just to deletion, but also to the window setting itself.
mixmax 15y ago
For reasons too complex to explain here, even some systems, like Gmail’s, that don’t allow intruders to make millions of random guesses at a password can still be vulnerable to brute-force attacks. I'm curios as to what the reasons are? How do you bruteforce a gmail account? Surely Google will not allow you millions of tries?
- Joakal 15y ago
  It's seemingly infinite amount of tries because after 2-3 failed password attempts, you get a captcha to do.
- rdl 15y ago
  Password reuse by end users puts even a relatively well secured site like gmail at risk of user passwords being brute forced. Break into a less-well-secured site, steal the password file, which may use something like md5. Brute force offline. Then, try that password and username on a more secure site like gmail.
  - sausagefeet 15y ago
    I'm glad I switched to 1Password and switched all of my accounts to a different randomly generated password. I'm sure I'm using it in some insecure way but at least all of my passwords are different.
  - ajross 15y ago
    This. I continue to be saddened at the extent to which "DON'T REUSE PASSWORDS EVER" isn't the first sentence and summary to any discussion of this stuff. Even people who should know better (c.f. posters right here on this site) don't, and those who do get distracted talking about more "interesting" stuff like GPU hashing algorithms instead. Just don't do it. And tell all your friends.
    - sukuriant 15y ago
      But it's so hard to. Really. Most people aren't willing to spend the time (I know I'm not). It takes more memorization (unless you use exploitable tricks) and most people think they're mostly safe, so "what's the point?", they think.
beej71 15y ago
The first thing I did was to back them all up onto her hard disk, with Thunderbird—and then back up those archives elsewhere, just in case. If you care about your mail, you should be doing some kind of personal backup with any service like this. I just fire up Thunderbird, like the author, but I'm sure there must be a lot of scripts and programs out there to do local gmail backup.
- mknod 15y ago
  I use getmail on linux. All it really does is backup the mail in mbox format, but it'll be really handy one day I'm sure. This person's tale should be a warning to those who have not done a backup recently. Harddrives have never been cheaper in terms of price per byte. It only takes a couple of steps to set it up so that it's done automatically.
DevX101 15y ago
Today's security model is broken. And most people, included readers here at HN equate safety with a low probability of being hacked. I've signed up for at least 50 sites, probably more. The chances are good that not all of these sites have great security. And if anyone gets my password from that weak link, many of my other account are at risk. Worse is if someone manages to get malicious software directly to my computer. At that point I'm screwed, and everything including email/bank accounts are an open book. I don't know what the answer is but I sure hope someone would fix it.
- Simucal 15y ago
  I've started using two-factor authentication with my Google account and it isn't that bad. The mild pain of having to type in my authentiation number occasionally is offset by my increase peace of mind. It does require you to use an authenticator app on your smartphone though, so for some it might not be an option.
  - graeme 15y ago
    Two-factor authentication is nice. I know many of my different logins are vulnerable, but they're also for sites that aren't very important, even if comprimised. Gmail is a different story. Anyone with access to that gets access to most other things. So the inconvenience of inputing a text message code once a month pales in comparison to the hurdle it adds to accessing my account.
  - dos1 15y ago
    I feel like I should turn in my nerd card, as I had no idea Google was currently offering two factor auth. Thanks for mentioning this!
  - morsch 15y ago
    You can use SMS notifications, so a smartphone isn't strictly required. Is the authenticator app experience much better? Using SMS is fairly painless, as far as possible with two-factor auth.
- sneak 15y ago
sunsu 15y ago
Just another example of why you should enable 2 step authentication on your Google account. Seriously...do it today!
- cheald 15y ago
  For real. Unique, strong password and two factor auth. Your email account is the master key to everything you do online. Protect it accordingly.
  - itsnotvalid 15y ago
    Unless you don't use the same email account for password recovery, your email address is as important as it seems. However many sites won't allow you to have a different email account just for password recovery, that is insecure, as people would then know where to go for.
ChuckMcM 15y ago
As it turns out my father-in-law had the same thing happen to him (and the same mugged-in-madrid form letter). It is a tragedy, and soon email will cease to be viable for a large portion of the community. That being said, I've pushed off and on some development for a network identity device. Not the big 'Identity' problem that most people run away screaming from but a much reduced (and tractable) part of the problem. A device which can prove that the person making a request is in physical possession of the identity device they had when they created the account. Such a unit prevents people in Lagos from exploiting your password even if they get it as they don't have the device.
- simoncion 15y ago
  Isn't Google already doing this? http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...
  - joebadmo 15y ago
    Yes, and it's a bit of a hassle, but does provide some peace of mind. I remember that when my wife was in school in the Netherlands, her bank there gave her a fob that created a second factor for sign in, too.
  - ChuckMcM 15y ago
    No, if they were then you wouldn't have to type extra numbers into your browser. That seems kind of like a 'nit', I know, but if we learned anything from Steve Jobs it is that there is a difference between providing an answer and providing a solution. The elements that will be present in a solution include; 1) You won't have to type anything else, a program will have an API which can definitively tell it you are making this request or you are not. 2) The 'key' won't be anything else, it won't be an app on your phone or a plug-in to your browser. 3) It will work with any service you care to use it with and if it has not been implemented there will be no legal/enumberance/techincal barriers to doing so. 4) It will not degrade your privacy options. Google's two factor authentication fails on a number of these, not the least of which that it requires that you own a 'smart phone' which is something my father in law will never do before he dies. So no, Google doesn't do this yet.
RockyMcNuts 15y ago
good article on how to fix insecure passwords - http://www.slate.com/articles/technology/technology/2009/07/fix_your_terrible_insecure_passwords_in_five_minutes.html http://www.slate.com/articles/technology/technology/2009/07/... take a phrase - ask not what you can do for your country -> Anwycd4yc for each site mix in some letters from the domain, ie 2nd two letters of amazon -> maAnwycd4yc bingo - easy to remember - strong - unique for each site password safe like keypass is also good. occasionally you get services with silly password rules where your generator function doesn't return a valid password. still important to have 2 factor on that one email account that has your banks etc., otherwise one encounter with one of these bad boys and it's all over - http://www.google.com/search?q=usb+keylogger&tbm=isch http://www.google.com/search?q=usb+keylogger&tbm=isch
- RyanMcGreal 15y ago
  Why not just make your password 'AskNotWhatYouCanDoForYourCountry'? That seems pretty strong to me.
  - corin_ 15y ago
    If someone gets hold of your password from one source, the goal is that they won't be able to use it in other places, hence the "ma" from Amazon in his example. If I have maAskNotWhatYouCanDoForYourCountry then someone seeing it could possible guess the relevance of the ma, and try ew or hn, etc. on this site. Woth maAnwycd4yc on the other hand, without being told, are you going to guess that maybe it's a generic password with a small site-specific portion?
  - noahc 15y ago
    Some websites cut your password off at twelve or even six characters. What this means is that your long password when you enter it into the password form is only 'AskNot'. That's not so hard to brute force. To avoid confusion some websites let you type in x characters, but only take the first y characters.
  - RockyMcNuts 15y ago
    That works too. My main reason is: a pain to type on a mobile device As others mentioned: may also get truncated or not accepted as a valid password due to length; if you added Amazon in there somewhere it might be easy to reverse engineer for other sites
Timothee 15y ago
I'd be curious to read what people on HN think of one particular aspect of the story: she's not planning on using her old Gmail address anymore, which made me think of the longevity of one's email address and what one can do to keep control of it. In particular, I'm thinking that backups of all your "cloud" data mostly takes care of the fear of losing it like written in the OP. However, to not lose your email address itself, you have to have your own domain, but is that really sufficient? In the end, you mostly lease it rather than owning it, so can it just be assumed that a .com address won't be messed with (as long as there aren't any trademark issue)? (as opposed to, say, a .ly) Do you use your own domain for email? Do you think that email addresses have some inherent risks that make them potentially disposable after 5-10 years? A bigger question is how could anyone (that is: people who have currently no idea what a domain really is and how to get one) take control of their addresses in a similar way? As far as I'm concerned, I haven't used my own domain yet for emails but my alumni association gives me a lifelong forwarding address. I haven't been super strict with using it everywhere though, so it's a bit all over the place. The truth is too that my Gmail address is much easier to type and give away than either my alumni one or my own domain…
- sneak 15y ago
  I think that at some point in the future (after DNSSEC takes hold), FQDNs will be used both for identity and messaging (both realtime like IM/voice and non, like email). We're already seeing some of this in the form of *@personaldomain.com addresses. I wrote about this a while ago: http://sneak.datavibe.net/20100227/the-future-of-the-internet/ http://sneak.datavibe.net/20100227/the-future-of-the-interne... I think that most people's FQDNs will be third-level or deeper, granted by some identity provider, though once the whole user@host format is abandoned I'm guessing that there will be lots of identity/email providers that allow one to one-stop register a domain and integrate it with the service (something that's beyond most casual users of email today).
  - jaylevitt 15y ago
    I thought one of the big lessons of OpenID is that the non-technical world thinks FQDNs are for web sites (or something you type into Google!) and user@host is for identity? I still have trouble explaining that jay@jay.fm is my entire e-mail address, and that there is no .com at the end of it. I think there was a point where everybody wanted to blog, and thus might have an URL that they considered "me", but that's gone away with Twitter and Facebook. Come to think of it, many people have a Facebook claimed URL, but I've never typed or clicked one, and I don't even know my own.
Shenglong 15y ago
Has anyone ever wondered why spammers don't use proper grammar? Is it because the majority of people they target can't type with proper grammar, or because they're foreign?
- hugh3 15y ago
  Almost certainly because they're not native English speakers.
  - ehsanu1 15y ago
    I seem to remember spammers doing this in order to evade naive spam filters. For example, substitute "v1agra" for "viagra", and get through to the inbox. Though once you use a trick like that and it gets marked as spam a few times, you can't use it again. So yeah, perhaps your reason is more sensible.
  - jarek 15y ago
    Not that native English speakers always use proper English grammar in situations where proper grammar is not required for business success (and spam is obviously one).
josephcooney 15y ago
A friend of mine got his gmail hacked - he believes through POP password brute forcing vulnerability. The person or persons who stole it used it to steal his domain. Fortunately he was able to get it back. I turned on 2-factor auth for gmail soon afterwards. http://secretgeek.net/sg_hijack_1.asp http://secretgeek.net/sg_hijack_1.asp http://secretgeek.net/sg_hijack_2.asp http://secretgeek.net/sg_hijack_2.asp
DeanCollinsLCC 15y ago
i laughed at reading the end of this it was still incconcievable that the author and his wife were personally responsable fo rthe mess they find themselves in. using crappy passwords,using unprotected computers,not backing up..... i want my 10 mins back.
DeanCollinsLCC 15y ago
i laughed at reading the end of this it was still incconcievable that the author and his wife were personally responsable fo rthe mess they find themselves in. using crappy passwords,using unprotected computers,not backing up..... i want my 10 mins back.
pbreit 15y ago
OT: is it me or has The Atlantic made a concerted effort to use HN to expose its move into tech news?
- michael_dorfman 15y ago
  It's you. James Fallows has been writing tech stuff for the Atlantic for decades.
rsanheim 15y ago
Does anyone have any suggestions for backing up 6 GB of gmail data to somewhere easily? I have my own personal domain I could sync it all to, somehow, I suppose. Then I need a linode box, scripts, etc, etc... I don't really want maintain or worry about a local backup of 6 GB (and growing) of mail grom gmail...
- RockyMcNuts 15y ago
  Get Thunderbird (or any email client), on local or hosted box. Or hosted mail service that can fetch POP. Set it to download Gmail via POP, leave copy on server.
Uchikoma 15y ago
Can anybody explain how this makes sense: "The account had seemed sluggish earlier that morning because my wife had tried to use it at just the moment a hacker was taking it over and changing its settings [...]" It does not sense to me that GMail is sluggish when someone else changes the settings.
- Pahalial 15y ago
  More likely it was in the midst of the mass-deletion later referred to - deleting 6 years' worth of email could certainly make gmail sluggish.
geekytenny 15y ago
no one is speaking about how we can get this hacker..
tlrobinson 15y ago
Expecting average users to use unique sufficiently complex passwords, or even just a few "tiers" of passwords, will never work because users just don't care... until it's too late. Single sign-on systems are the only reasonable solution. Of course that introduces a single point of failure, so they need to be extremely secure, but at least it's easier to secure one system with two factor authentication, advanced monitoring, etc than every site on the web.
muratmutlu 15y ago
Sounds like this is becoming a bit of a problem, another article from someone at the Guardian who experienced the same thing http://www.guardian.co.uk/technology/2011/oct/16/email-hacker-identity-rowenna-davis http://www.guardian.co.uk/technology/2011/oct/16/email-hacke...
tsycho 15y ago
>> On Google’s side, one explanation involved complexities of the law. My wife and I might think that Google had a “duty” to be able to find her messages after some hacker had erased them. But according to Google’s legal department, its higher and more stringent duty is to ensure that messages are erased, if whoever is in charge of an account wants them gone. That is a good reason. Moral of the story: make your own personal backups of everything that you wouldn't want to lose.
lapost1979 15y ago
Ever hear of two-factor authentication???

217 points by grellas 15y ago

All you have to know in life is God is just. I talk to Him, so of course I'm laid-back. If somethign bad happens, you deserved it, it was a blessing in disguise or you'll get a reward. God says... C:\TEXT\EMILY.TXT Would be a daily thing, Did not ourselves the cubits warp For fear to be a king. XV. THE INEVITABLE. While I was fearing it, it came, But came with less of fear, Because that fearing it so long Had almost made it dear. There is a fitting a dismay, A fitting a despair. 'Tis harder knowing it is due, Than knowing it is here. The trying on the utmost, The morning it is new, Is terribler than wearing it A whole existence through. XVI. A BOOK. The ---------------- Yer fucked ROFLMAO

0x12 15y ago

Painful. Great they got their stuff back but apparently it takes knowing people at google to get stuff done beyond the 'sorry we can not answer further emails about this'. I understand that there are limits to what technical support you can offer your end users but the fact that someone is a reporter with 'access' should not be the determining factor in who does and does not get back their email after a hack (which is a large word, account compromised would be a better description) like this.

01Michael10 15y ago
I think it's incredible anyone would think a free service should be expected to recover six years of email. I would rather Google delete my email permanently when I empty my trash and do my own backups.
- eli 15y ago
  Err, I wouldn't. If you don't trust Google with your old messages, then why do you have a gmail account at all?
  - sliverstorm 15y ago
    So they must either be the Fort Knox/Iron Mountain of email, or else there is no reason whatsoever to use them?
    - eli 15y ago
      No, but I can't think of any additional threat that Google keeping backups of your mail exposes you to that just using Google as your email provider doesn't also expose you to. If you don't trust them to keep your email backups safe, you shouldn't be using them.
- tsycho 15y ago
  I agree with you, but I think that this was within the 30-day permanent-delete-from-trash window. If you are saying that the the 30-day window is too long, that's a reasonable opinion. Maybe Gmail could offer a user-settable window length, with the default at 30, while more savvy users who trust their own email management could set it to zero. Update: I would even be willing to pay Google for extra features such as the above, and more importantly, for guaranteed/quicker support from them if anything goes wrong.
  - alttag 15y ago
    But the problem with a user-settable window is that a supposed hacker could set it to zero, then delete--which is exactly one of the use cases the "undelete project" desires to handle.
    - carussell 15y ago
      Don't allow the new window to take effect until the length of the old window has lapsed. I.e., make the window apply not just to deletion, but also to the window setting itself.

mixmax 15y ago

For reasons too complex to explain here, even some systems, like Gmail’s, that don’t allow intruders to make millions of random guesses at a password can still be vulnerable to brute-force attacks. I'm curios as to what the reasons are? How do you bruteforce a gmail account? Surely Google will not allow you millions of tries?

Joakal 15y ago
It's seemingly infinite amount of tries because after 2-3 failed password attempts, you get a captcha to do.
rdl 15y ago
Password reuse by end users puts even a relatively well secured site like gmail at risk of user passwords being brute forced. Break into a less-well-secured site, steal the password file, which may use something like md5. Brute force offline. Then, try that password and username on a more secure site like gmail.
- sausagefeet 15y ago
  I'm glad I switched to 1Password and switched all of my accounts to a different randomly generated password. I'm sure I'm using it in some insecure way but at least all of my passwords are different.
- ajross 15y ago
  This. I continue to be saddened at the extent to which "DON'T REUSE PASSWORDS EVER" isn't the first sentence and summary to any discussion of this stuff. Even people who should know better (c.f. posters right here on this site) don't, and those who do get distracted talking about more "interesting" stuff like GPU hashing algorithms instead. Just don't do it. And tell all your friends.
  - sukuriant 15y ago
    But it's so hard to. Really. Most people aren't willing to spend the time (I know I'm not). It takes more memorization (unless you use exploitable tricks) and most people think they're mostly safe, so "what's the point?", they think.

beej71 15y ago

The first thing I did was to back them all up onto her hard disk, with Thunderbird—and then back up those archives elsewhere, just in case. If you care about your mail, you should be doing some kind of personal backup with any service like this. I just fire up Thunderbird, like the author, but I'm sure there must be a lot of scripts and programs out there to do local gmail backup.

mknod 15y ago
I use getmail on linux. All it really does is backup the mail in mbox format, but it'll be really handy one day I'm sure. This person's tale should be a warning to those who have not done a backup recently. Harddrives have never been cheaper in terms of price per byte. It only takes a couple of steps to set it up so that it's done automatically.

DevX101 15y ago

Today's security model is broken. And most people, included readers here at HN equate safety with a low probability of being hacked. I've signed up for at least 50 sites, probably more. The chances are good that not all of these sites have great security. And if anyone gets my password from that weak link, many of my other account are at risk. Worse is if someone manages to get malicious software directly to my computer. At that point I'm screwed, and everything including email/bank accounts are an open book. I don't know what the answer is but I sure hope someone would fix it.

Simucal 15y ago
I've started using two-factor authentication with my Google account and it isn't that bad. The mild pain of having to type in my authentiation number occasionally is offset by my increase peace of mind. It does require you to use an authenticator app on your smartphone though, so for some it might not be an option.
- graeme 15y ago
  Two-factor authentication is nice. I know many of my different logins are vulnerable, but they're also for sites that aren't very important, even if comprimised. Gmail is a different story. Anyone with access to that gets access to most other things. So the inconvenience of inputing a text message code once a month pales in comparison to the hurdle it adds to accessing my account.
- dos1 15y ago
  I feel like I should turn in my nerd card, as I had no idea Google was currently offering two factor auth. Thanks for mentioning this!
- morsch 15y ago
  You can use SMS notifications, so a smartphone isn't strictly required. Is the authenticator app experience much better? Using SMS is fairly painless, as far as possible with two-factor auth.
sneak 15y ago

sunsu 15y ago

Just another example of why you should enable 2 step authentication on your Google account. Seriously...do it today!

cheald 15y ago
For real. Unique, strong password and two factor auth. Your email account is the master key to everything you do online. Protect it accordingly.
- itsnotvalid 15y ago
  Unless you don't use the same email account for password recovery, your email address is as important as it seems. However many sites won't allow you to have a different email account just for password recovery, that is insecure, as people would then know where to go for.

ChuckMcM 15y ago

As it turns out my father-in-law had the same thing happen to him (and the same mugged-in-madrid form letter). It is a tragedy, and soon email will cease to be viable for a large portion of the community. That being said, I've pushed off and on some development for a network identity device. Not the big 'Identity' problem that most people run away screaming from but a much reduced (and tractable) part of the problem. A device which can prove that the person making a request is in physical possession of the identity device they had when they created the account. Such a unit prevents people in Lagos from exploiting your password even if they get it as they don't have the device.

simoncion 15y ago
Isn't Google already doing this? http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...
- joebadmo 15y ago
  Yes, and it's a bit of a hassle, but does provide some peace of mind. I remember that when my wife was in school in the Netherlands, her bank there gave her a fob that created a second factor for sign in, too.
- ChuckMcM 15y ago
  No, if they were then you wouldn't have to type extra numbers into your browser. That seems kind of like a 'nit', I know, but if we learned anything from Steve Jobs it is that there is a difference between providing an answer and providing a solution. The elements that will be present in a solution include; 1) You won't have to type anything else, a program will have an API which can definitively tell it you are making this request or you are not. 2) The 'key' won't be anything else, it won't be an app on your phone or a plug-in to your browser. 3) It will work with any service you care to use it with and if it has not been implemented there will be no legal/enumberance/techincal barriers to doing so. 4) It will not degrade your privacy options. Google's two factor authentication fails on a number of these, not the least of which that it requires that you own a 'smart phone' which is something my father in law will never do before he dies. So no, Google doesn't do this yet.

RockyMcNuts 15y ago

good article on how to fix insecure passwords - http://www.slate.com/articles/technology/technology/2009/07/fix_your_terrible_insecure_passwords_in_five_minutes.html http://www.slate.com/articles/technology/technology/2009/07/... take a phrase - ask not what you can do for your country -> Anwycd4yc for each site mix in some letters from the domain, ie 2nd two letters of amazon -> maAnwycd4yc bingo - easy to remember - strong - unique for each site password safe like keypass is also good. occasionally you get services with silly password rules where your generator function doesn't return a valid password. still important to have 2 factor on that one email account that has your banks etc., otherwise one encounter with one of these bad boys and it's all over - http://www.google.com/search?q=usb+keylogger&tbm=isch http://www.google.com/search?q=usb+keylogger&tbm=isch

RyanMcGreal 15y ago
Why not just make your password 'AskNotWhatYouCanDoForYourCountry'? That seems pretty strong to me.
- corin_ 15y ago
  If someone gets hold of your password from one source, the goal is that they won't be able to use it in other places, hence the "ma" from Amazon in his example. If I have maAskNotWhatYouCanDoForYourCountry then someone seeing it could possible guess the relevance of the ma, and try ew or hn, etc. on this site. Woth maAnwycd4yc on the other hand, without being told, are you going to guess that maybe it's a generic password with a small site-specific portion?
- noahc 15y ago
  Some websites cut your password off at twelve or even six characters. What this means is that your long password when you enter it into the password form is only 'AskNot'. That's not so hard to brute force. To avoid confusion some websites let you type in x characters, but only take the first y characters.
- RockyMcNuts 15y ago
  That works too. My main reason is: a pain to type on a mobile device As others mentioned: may also get truncated or not accepted as a valid password due to length; if you added Amazon in there somewhere it might be easy to reverse engineer for other sites

Timothee 15y ago

I'd be curious to read what people on HN think of one particular aspect of the story: she's not planning on using her old Gmail address anymore, which made me think of the longevity of one's email address and what one can do to keep control of it. In particular, I'm thinking that backups of all your "cloud" data mostly takes care of the fear of losing it like written in the OP. However, to not lose your email address itself, you have to have your own domain, but is that really sufficient? In the end, you mostly lease it rather than owning it, so can it just be assumed that a .com address won't be messed with (as long as there aren't any trademark issue)? (as opposed to, say, a .ly) Do you use your own domain for email? Do you think that email addresses have some inherent risks that make them potentially disposable after 5-10 years? A bigger question is how could anyone (that is: people who have currently no idea what a domain really is and how to get one) take control of their addresses in a similar way? As far as I'm concerned, I haven't used my own domain yet for emails but my alumni association gives me a lifelong forwarding address. I haven't been super strict with using it everywhere though, so it's a bit all over the place. The truth is too that my Gmail address is much easier to type and give away than either my alumni one or my own domain…

sneak 15y ago
I think that at some point in the future (after DNSSEC takes hold), FQDNs will be used both for identity and messaging (both realtime like IM/voice and non, like email). We're already seeing some of this in the form of *@personaldomain.com addresses. I wrote about this a while ago: http://sneak.datavibe.net/20100227/the-future-of-the-internet/ http://sneak.datavibe.net/20100227/the-future-of-the-interne... I think that most people's FQDNs will be third-level or deeper, granted by some identity provider, though once the whole user@host format is abandoned I'm guessing that there will be lots of identity/email providers that allow one to one-stop register a domain and integrate it with the service (something that's beyond most casual users of email today).
- jaylevitt 15y ago
  I thought one of the big lessons of OpenID is that the non-technical world thinks FQDNs are for web sites (or something you type into Google!) and user@host is for identity? I still have trouble explaining that jay@jay.fm is my entire e-mail address, and that there is no .com at the end of it. I think there was a point where everybody wanted to blog, and thus might have an URL that they considered "me", but that's gone away with Twitter and Facebook. Come to think of it, many people have a Facebook claimed URL, but I've never typed or clicked one, and I don't even know my own.

Shenglong 15y ago

Has anyone ever wondered why spammers don't use proper grammar? Is it because the majority of people they target can't type with proper grammar, or because they're foreign?

hugh3 15y ago
Almost certainly because they're not native English speakers.
- ehsanu1 15y ago
  I seem to remember spammers doing this in order to evade naive spam filters. For example, substitute "v1agra" for "viagra", and get through to the inbox. Though once you use a trick like that and it gets marked as spam a few times, you can't use it again. So yeah, perhaps your reason is more sensible.
- jarek 15y ago
  Not that native English speakers always use proper English grammar in situations where proper grammar is not required for business success (and spam is obviously one).

josephcooney 15y ago

A friend of mine got his gmail hacked - he believes through POP password brute forcing vulnerability. The person or persons who stole it used it to steal his domain. Fortunately he was able to get it back. I turned on 2-factor auth for gmail soon afterwards. http://secretgeek.net/sg_hijack_1.asp http://secretgeek.net/sg_hijack_1.asp http://secretgeek.net/sg_hijack_2.asp http://secretgeek.net/sg_hijack_2.asp

DeanCollinsLCC 15y ago

i laughed at reading the end of this it was still incconcievable that the author and his wife were personally responsable fo rthe mess they find themselves in. using crappy passwords,using unprotected computers,not backing up..... i want my 10 mins back.

DeanCollinsLCC 15y ago

pbreit 15y ago

OT: is it me or has The Atlantic made a concerted effort to use HN to expose its move into tech news?

michael_dorfman 15y ago
It's you. James Fallows has been writing tech stuff for the Atlantic for decades.

rsanheim 15y ago

Does anyone have any suggestions for backing up 6 GB of gmail data to somewhere easily? I have my own personal domain I could sync it all to, somehow, I suppose. Then I need a linode box, scripts, etc, etc... I don't really want maintain or worry about a local backup of 6 GB (and growing) of mail grom gmail...

RockyMcNuts 15y ago
Get Thunderbird (or any email client), on local or hosted box. Or hosted mail service that can fetch POP. Set it to download Gmail via POP, leave copy on server.

Uchikoma 15y ago

Can anybody explain how this makes sense: "The account had seemed sluggish earlier that morning because my wife had tried to use it at just the moment a hacker was taking it over and changing its settings [...]" It does not sense to me that GMail is sluggish when someone else changes the settings.

Pahalial 15y ago
More likely it was in the midst of the mass-deletion later referred to - deleting 6 years' worth of email could certainly make gmail sluggish.

geekytenny 15y ago

no one is speaking about how we can get this hacker..

tlrobinson 15y ago

Expecting average users to use unique sufficiently complex passwords, or even just a few "tiers" of passwords, will never work because users just don't care... until it's too late. Single sign-on systems are the only reasonable solution. Of course that introduces a single point of failure, so they need to be extremely secure, but at least it's easier to secure one system with two factor authentication, advanced monitoring, etc than every site on the web.

muratmutlu 15y ago

Sounds like this is becoming a bit of a problem, another article from someone at the Guardian who experienced the same thing http://www.guardian.co.uk/technology/2011/oct/16/email-hacker-identity-rowenna-davis http://www.guardian.co.uk/technology/2011/oct/16/email-hacke...

tsycho 15y ago

>> On Google’s side, one explanation involved complexities of the law. My wife and I might think that Google had a “duty” to be able to find her messages after some hacker had erased them. But according to Google’s legal department, its higher and more stringent duty is to ensure that messages are erased, if whoever is in charge of an account wants them gone. That is a good reason. Moral of the story: make your own personal backups of everything that you wouldn't want to lose.

lapost1979 15y ago

Ever hear of two-factor authentication???