5 ms·
> My Apple, Twitter, and Gmail passwords were all robust—seven, 10, and 19 characters, respectively, all alphanumeric, some with symbols thrown in as well—but t
by debacle 14y ago
> My Apple, Twitter, and Gmail passwords were all robust—seven, 10, and 19 characters, respectively, all alphanumeric, some with symbols thrown in as well—but the three accounts were linked,
No, you had one 'robust' password, one good password, and one godawful password that you should feel bad about not securing better.
And then you linked all of the account together, basically putting all the keys in the kingdom in the weakest safe you had.
It was a poor decision, and has nothing to do with the strength of passwords as a data protection mechanism.
- _djo_ 14y agoI seem to recall that Honan's accounts were hacked not because of his password strength, but because Amazon and Apple at the time had flawed password-recovery options that allowed an attacker to reset his password.
- debacle 14y agoSo this fluffy piece of linkbait is even less relevant? Fantastic.
- masklinn 14y agoThat is also my recollection of the event. Basically, the recovery process for one gave away the secret allowing resetting the password on the other one, something along those lines.
- mitchty 14y agoThat and being able to add any credit card to an Amazon account with a little social engineering. That was rather important.
- innguest 14y agoWhat does he mean by "the accounts were linked"? Does registering for Twitter with a Gmail email qualify as linking? How can a hacker get a password to my Gmail via hacking into my Twitter account; and most importantly, how do I "unlink" those two things? I'm missing something here...
- indiecore 14y agoIf the hacker can get your gmail password he can use the reset pass option for every service that you used gmail to sign up with.
- innguest 14y agoOf course, but I'm talking about the opposite way - after all his strongest password was his Gmail password. Some comments here seem to imply that having a strong Gmail password and having a weak Twitter (or whatever) password will somehow make it easier for a hacker to get into your other accounts. It all hangs around that word "linked" that I don't quite understand. But I see from other comments that the story is that the offenders went through Amazon to get someone's Apple password. That makes sense after reading the full story.
- pyre 14y agoHis weakest password was on his Apple account, which was his 'backup' email for his Gmail account. That link effectively made his 19 character Gmail password a moot point.
- hmahncke 14y agoHe means that his gmail account was set up to mail a password reset link to a backup email account, which was in this case his apple mail account. After that, all his other accounts were reset by clicking on "forgot password" or the equivalent, which sent password resets to his apple or gmail account.