5 ms·

Google isnt susceptible to this kind of social engineering attack. It requires the existence of a customer service in the first place. Good luck trying to call

• siglesias 14y ago
  From the article: The backup email address on my Gmail account is that same .mac email address. At 4:52 PM, they sent a Gmail password recovery email to the .mac account. Here Gmail was only as strong as the weakest password recovery email service it was linked to. I consider this a failure on Google's part.
  • myko 14y ago
    With two factor authentication enabled this shouldn't be an issue.
    • siglesias 14y ago
      Why not require it then?
      • dvhh 14y ago
        not useable in all country. Not applicable on imap, pop3. Use case where an email account serve more than 1 physical person. Unusable while you travel.
        • m_eiman 14y ago
          It's quite possible to add two-factor logins for any protocol, that works in any country with a cell phone network. Just demand a response to a challenge via cell phone before validating the password, you could even require one of those RSA token thingies if you want. Just a matter of cost and convenience.
          • ams6110 14y ago
            Not everyone has a cell phone.
          • nazar 14y ago
            I used 2 step verification for my gmail. Our cell phone operator cannot receive international sms (I know, that sucks), so I used my home phone, so every time I logged in to my gmail I received a call from google voice robot to tell me the pin number. It sounded perfect at first, but when I started to actually use it, I noticed everytime I needed to login to gmail, I wasn't home. I'd call my parents so they could say me the pin or use the backup codes that google provided me with. That was so uncomfortable I had to turn it off.
        • dnr 14y ago
          "Unusable while you travel" or in other countries is simply false: one of the two-factor authentication options is the google authenticator app on your smartphone, which requires no internet/phone connectivity at all. It's time-based. The imap/pop thing is still a legitimate concern. App-specific passwords let those continue working, but they have security issues of their own.
          • kisielk 14y ago
            And yet another option is a set of emergency use codes that you write down or print on a card.
• wklauss 14y ago
  Phone is not the only way to access customer support. And for the look of this, BTW, Mat's gmail account got hacked first and then the social engineering on Apple side took part (the password reset was sent to his gmail account). Im not suggesting that doing nothing is the same of doing something. Im just saying that not matter how secure and prepared Apple had been, this could have happened anyway. Zero incident record, in any case, seems very unrealistic. I don't know any particular case first hand but then again i'm sure this is not the first time this happens with an iCloud account either. Mat is a public person and has commented his case publicly and thats why we are openly talking about it here.
  • ralfn 14y ago
    Security is a two way street: both the user, as well as the company have a responsibility. When i claimed certain high target technological companies have a zero incident grade, im talking about the fact the companies were never themselves the weak link. If this guys account was hacked because he tattoos his password on his forehead, Apple too would be in the clear. But here, not the user, but the company screwed up. There are many, many companies which do not have incidents, or take full responsibility when they do. The type of incidents we complain about, often indicate just gross negliance. (and this is gross negliance by Apple) You are repeating the claim that there is no watertight security. This claim is wrong. Software can be provably secure. Authentification can be provably secure, just like any type of Content protection is provably unsecure. Now, you are also making the claim, that we are talking about this, because of the affected users popularity. Maybe thats why you are talking about it. But most of us are actually surprised because of the gross negliance. ICloud has no authentification, one can just call up, and take over the account. As we now know. And if this was any other company, i doubt anyone would argue against this obvious and pretty much indisputable fact. But this isnt Sony, this is Apple, and they can never do anything wrong right? Eventhough, statistically, just like any other company, they might could not excel in every way. Maybe this is just one area, where they just screwed up? Theyll learn from it, hopefully. But lets not pretend it didnt happen, or that it isnt as big as a fuckup as it actually is, back here in reality.
    • jontas 14y ago
• Tloewald 14y ago
  Microsoft and Google have zero incidents only for very large values of zero. Google "gmail account hacked" or "Xbox live account hacked" or "hotmail account hacked". In the last case, the top links are to Microsoft's FAQ pages.
  • esolyt 14y ago
    Irrelevant because those accounts are hacked by someone who acquired the password of the actual user by a keylogger etc. They were not exploiting flaws related to server side. In iCloud's case, there is nothing the user could have done to prevent this attack.
    • Tloewald 14y ago
      Nor we're they in this case -- they were exploiting server side features of Amazon ( working as intended ) and Apple's tech support policies ( working as intended ). If anything this is a policy failure. Not having any customer support worth a damn is a different kind of policy failure. (For example.)
  • itsprofitbaron 14y ago
    Just because a company can have their FAQ pages SEO'd to the top of the SERPS doesn't mean their services haven't been hacked. Most people who get hacked hardly ever report it, they just want their account(s) back.
    • Tloewald 14y ago
      I think you missed my point. If recovering a hacked account is an FAQ then presumably some accounts get hacked. Just maybe?