6 ms·

I feel bad for this guy, and twitter needs to do the right thing and return to him his handle. Then I can come back here and post nasty comments about squatter

I feel bad for this guy, and twitter needs to do the right thing and return to him his handle. Then I can come back here and post nasty comments about squatters.

reuven 13y ago
Yes, absolutely. The guy has given a clear and convincing story of what happened. I'm sure that it would be pretty easy for someone on Twitter's security team (assuming that they have one) to verify that the username was taken when he said it was. I don't know what I find more shocking -- that PayPal would actually give the last four digits of a credit-card number to a complete stranger, that GoDaddy would let someone guess a two-digit number, or that a credit-card number is all you need to identify yourself. (In Israel, it's common for companies to ask for the last four digits of your credit card number in addition to other details, but never on its own.) Actually, I'm willing to believe just about anything about GoDaddy. But PayPal is known for being surprisingly harsh and paranoid about security, shutting down accounts and holding money when they suspect problems. It's sad and rather surprising to me that they're willing to give out such information so easily, unless you specifically ask them not to. Shouldn't it be the other way around, that they refuse to provide such details unless you allow them to? I really hope that Twitter and PayPal apologize profusely to this author, and undo the damage they've done as best as possible.
- jrs99 13y ago
  Do you mean Godaddy and Paypal should apologize? I don't think twitter did anything wrong yet. They are just looking into what happened.
  - reuven 13y ago
    Yes, I meant that GoDaddy and PayPal should apologize. Twitter should look into what happened in this specific case, and somehow (if the posting is right) return the username to its original owner. But there does seem to be something terribly broken here if it's possible for someone to get another person's Twitter account, and for it to take a full investigation to get it back to the original owner. And for not having better procedures in place, I think that an apology wouldn't be unreasonable. In general, it seems to me that demonstrating empathy for your customers is a pretty reasonable strategy. Even if they didn't do anything wrong, and before they have finished this investigation, they can show that they care about the people using their system. I don't think that Twitter could go wrong by saying, "We now see that we need to make it harder for scammers to switch the ownership of a Twitter account, and are looking into how to do so without hurting our legitimate users."
    - mseebach 13y ago
      The Twitter account wasn't actually compromised. The guy was blackmailed to hand it over. It would be pretty nice of Twitter to hand it back, but it's really hard to fault them, and it's especially hard to fault them for not just reassigning the account without a very careful investigation - what if the writer of this article is actually the guy trying to steal the account from someone else, using this article to bully Twitter into a swift response?
      - owens99 13y ago
        This sounds relatively easy to verify, as the guy seems to be well known and the founder of an SF-based startup.
        mseebach 13y ago
        It's not about his identity, it's about the legitimacy of his claim to the account. Just for the record, I have no reason to believe he's saying anything less than the truth - but I can't fault Twitter for basically presuming malice until they have conclusively documented the opposite.
        louthy 13y ago
        Exactly, they're doing the opposite of what PayPal and GoDaddy did, which is correct.
- Domenic_S 13y ago
  https://www.paypal-forward.com/leadership/paypal-takes-your-security-seriously/ https://www.paypal-forward.com/leadership/paypal-takes-your-...
apl002 13y ago
Any thoughts why the attacker would tell the guy how he did it if this is the obvious solution?
- aragot 13y ago
  Yeah why is that attacker so nice and kind? No joking, it's bad for their business.
  - sdk16420 13y ago
    Maybe just 'pride' of what he accomplished.
    - dspillett 13y ago
      Or an axe to grind. Perhaps he has something against GoDaddy (many do) and/or PayPal (again, many do) so took the opportunity to make them look bad by making sure that their effective complicity in the hack is well known.
  - blueskin_ 13y ago
    The icloud guy also was (http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...).
- Zakuzaa 13y ago
  An attempt to induce Stokholm Syndrome?
- duiker101 13y ago
  The attacker was hired and once he finished the job he had no reason to be mean to the guy or not help him to improve his security. Maybe he even is a security expert that was in need of a bit extra cash and picked up this job.
- kybernetyk 13y ago
  I guess it's that "security researcher god complex" many security people show. They come around, fuck up your daily routine and expect you to be thankful for making your day hell.
aragot 13y ago
The problem is stealing @N is, someone will have to use it one day. How can they hope not to be traced?
- Houshalter 13y ago
  The hacker sells it anonymously to someone who isn't aware of the controversy or who doesn't care. It will probably shrink the value of the username but I bet it's still worth something.
  - paulgb 13y ago
    Selling is prohibited by the TOS, so if the buyer does their due diligence they know what risk they're taking
    - e12e 13y ago
      So is selling accounts in MMOs etc. Doesn't mean it doesn't happen.
aptwebapps 13y ago
Might piss off the attacker pretty bad, though. Not saying that's wrong, just that resulting shenanigans might be a little asymmetric.
- dunk010 13y ago
  "that resulting shenanigans might be a little asymmetric. " - What does this statement even mean? You should think before you just throw a load of cliches into a sentence.
  - 67726e 13y ago
    As in the attacker would be able to pop up and attack the original user of @N at will for what might very well be a vicious attempt to take over or destroy as much of his digital holdings as possible. The grandfather post is referencing asymmetric warfare[0] which would be a pretty decent name for what could happen. I don't think he just threw some cliches into a sentence. [0] http://en.wikipedia.org/wiki/Assymetrical_warfare http://en.wikipedia.org/wiki/Assymetrical_warfare
    - pavel_lishin 13y ago
      Naoki has already made changes to prevent this type of attack from working again (e.g., removing credit cards from Paypal, moving his domains from GoDaddy, etc.)
      - dpritchett 13y ago
        Hopefully the attacker didn't back up a decades' worth of his emails.
        ytjohn 13y ago
        The attacker never got access to the victim's email accounts. He changed dns records to point to a different server. So he would have gotten some new email emails during the time he had the MX records pointed at his server (and he could have used that time to gather additional information), but he couldn't get to any existing emails.

I feel bad for this guy, and twitter needs to do the right thing and return to him his handle. Then I can come back here and post nasty comments about squatters.

reuven 13y ago

Yes, absolutely. The guy has given a clear and convincing story of what happened. I'm sure that it would be pretty easy for someone on Twitter's security team (assuming that they have one) to verify that the username was taken when he said it was. I don't know what I find more shocking -- that PayPal would actually give the last four digits of a credit-card number to a complete stranger, that GoDaddy would let someone guess a two-digit number, or that a credit-card number is all you need to identify yourself. (In Israel, it's common for companies to ask for the last four digits of your credit card number in addition to other details, but never on its own.) Actually, I'm willing to believe just about anything about GoDaddy. But PayPal is known for being surprisingly harsh and paranoid about security, shutting down accounts and holding money when they suspect problems. It's sad and rather surprising to me that they're willing to give out such information so easily, unless you specifically ask them not to. Shouldn't it be the other way around, that they refuse to provide such details unless you allow them to? I really hope that Twitter and PayPal apologize profusely to this author, and undo the damage they've done as best as possible.

jrs99 13y ago
Do you mean Godaddy and Paypal should apologize? I don't think twitter did anything wrong yet. They are just looking into what happened.
- reuven 13y ago
  Yes, I meant that GoDaddy and PayPal should apologize. Twitter should look into what happened in this specific case, and somehow (if the posting is right) return the username to its original owner. But there does seem to be something terribly broken here if it's possible for someone to get another person's Twitter account, and for it to take a full investigation to get it back to the original owner. And for not having better procedures in place, I think that an apology wouldn't be unreasonable. In general, it seems to me that demonstrating empathy for your customers is a pretty reasonable strategy. Even if they didn't do anything wrong, and before they have finished this investigation, they can show that they care about the people using their system. I don't think that Twitter could go wrong by saying, "We now see that we need to make it harder for scammers to switch the ownership of a Twitter account, and are looking into how to do so without hurting our legitimate users."
  - mseebach 13y ago
    The Twitter account wasn't actually compromised. The guy was blackmailed to hand it over. It would be pretty nice of Twitter to hand it back, but it's really hard to fault them, and it's especially hard to fault them for not just reassigning the account without a very careful investigation - what if the writer of this article is actually the guy trying to steal the account from someone else, using this article to bully Twitter into a swift response?
    - owens99 13y ago
      This sounds relatively easy to verify, as the guy seems to be well known and the founder of an SF-based startup.
      - mseebach 13y ago
        It's not about his identity, it's about the legitimacy of his claim to the account. Just for the record, I have no reason to believe he's saying anything less than the truth - but I can't fault Twitter for basically presuming malice until they have conclusively documented the opposite.
        louthy 13y ago
        Exactly, they're doing the opposite of what PayPal and GoDaddy did, which is correct.
Domenic_S 13y ago
https://www.paypal-forward.com/leadership/paypal-takes-your-security-seriously/ https://www.paypal-forward.com/leadership/paypal-takes-your-...

apl002 13y ago

Any thoughts why the attacker would tell the guy how he did it if this is the obvious solution?

aragot 13y ago
Yeah why is that attacker so nice and kind? No joking, it's bad for their business.
- sdk16420 13y ago
  Maybe just 'pride' of what he accomplished.
  - dspillett 13y ago
    Or an axe to grind. Perhaps he has something against GoDaddy (many do) and/or PayPal (again, many do) so took the opportunity to make them look bad by making sure that their effective complicity in the hack is well known.
- blueskin_ 13y ago
  The icloud guy also was (http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...).
Zakuzaa 13y ago
An attempt to induce Stokholm Syndrome?
duiker101 13y ago
The attacker was hired and once he finished the job he had no reason to be mean to the guy or not help him to improve his security. Maybe he even is a security expert that was in need of a bit extra cash and picked up this job.
kybernetyk 13y ago
I guess it's that "security researcher god complex" many security people show. They come around, fuck up your daily routine and expect you to be thankful for making your day hell.

aragot 13y ago

The problem is stealing @N is, someone will have to use it one day. How can they hope not to be traced?

Houshalter 13y ago
The hacker sells it anonymously to someone who isn't aware of the controversy or who doesn't care. It will probably shrink the value of the username but I bet it's still worth something.
- paulgb 13y ago
  Selling is prohibited by the TOS, so if the buyer does their due diligence they know what risk they're taking
  - e12e 13y ago
    So is selling accounts in MMOs etc. Doesn't mean it doesn't happen.

aptwebapps 13y ago

Might piss off the attacker pretty bad, though. Not saying that's wrong, just that resulting shenanigans might be a little asymmetric.

dunk010 13y ago
"that resulting shenanigans might be a little asymmetric. " - What does this statement even mean? You should think before you just throw a load of cliches into a sentence.
- 67726e 13y ago
  As in the attacker would be able to pop up and attack the original user of @N at will for what might very well be a vicious attempt to take over or destroy as much of his digital holdings as possible. The grandfather post is referencing asymmetric warfare[0] which would be a pretty decent name for what could happen. I don't think he just threw some cliches into a sentence. [0] http://en.wikipedia.org/wiki/Assymetrical_warfare http://en.wikipedia.org/wiki/Assymetrical_warfare
  - pavel_lishin 13y ago
    Naoki has already made changes to prevent this type of attack from working again (e.g., removing credit cards from Paypal, moving his domains from GoDaddy, etc.)
    - dpritchett 13y ago
      Hopefully the attacker didn't back up a decades' worth of his emails.
      - ytjohn 13y ago
        The attacker never got access to the victim's email accounts. He changed dns records to point to a different server. So he would have gotten some new email emails during the time he had the MX records pointed at his server (and he could have used that time to gather additional information), but he couldn't get to any existing emails.