22 ms·

Notes on the Celebrity Data Theft

• rayiner 12y ago
  I wrote this in the other thread on the leak before it died: > Even if the leaks result from one at a time social engineering, it still really calls into question the practical security of the cloud. I doubt it's much harder to steal, e.g. confidential business documents from executives' cloud accounts than it is to steal pictures from celebrities' cloud accounts. > If I were a big organization with confidential information, I'd really be thinking hard about my cloud policies and my BYOD policies right now. The policy at my previous employer (we handled a lot of extremely sensitive information), was pretty draconian: data never leaves a company desktop, laptop, or blackberry. The fact that the users may be the biggest security leak is more alarming than it is relieving. Software bugs can be fixed. Getting users to follow proper security practices is much harder. And frankly, it doesn't help that the industry is actively user hostile. I gmail my passwords to myself because every site has different password rules and force me to change my passwords too often.
  • harryh 12y ago
    Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.
    • eyeareque 12y ago
      I'm sure it is useful, except for when 1Password attacks take place.
      • LeoPanthera 12y ago
        1Password is not a cloud service.
        • JTon 12y ago
          True, but afaik it has the option to use dropbox for device syncing
        • eyeareque 12y ago
          I didn't say anything about how it is implemented. It is software, there is always a way to attack it.
    • anigbrowl 12y ago
      aka 1PointOfFailure. Having spent several years maintaining and repairing computer systems for corporate and professional clients, I can tell you from experience that it is trivially easy to social engineer someone's credentials out of them.
      • Micaiah_Chang 12y ago
        I'm currently having a failure of imagination here, but how would you social engineer a password manager? The tricks I'm thinking of involve fooling the user into thinking a site is something it's not or guessing some sort of personal information. But with a separate application the former seems unlikely and the latter is stopped if you use a scheme such as diceware (https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware). I understand that naive, theoretical musings on security are no match for experience, so how would you break that set up?
        • anigbrowl 12y ago
          By getting the user to give me control of it, same as if the user was moving everything to a new computer. You don't have to do this via a website; you use a website to create a problem and then make yourself available to fix it. Not that I'm into this sort of thing, but I've had a few people attempt to co-opt me into criminal activity in the past so I wouldn't be at all surprised to read about such attacks.
      • jsmthrowaway 12y ago
        AKA 1FailureToUnderstandTheThreatVector, the common antisecurity argument of lazy or pedantic people. A password manager is not defending against a social engineering attack (how could it?), it's defending against Joe's Blog getting knocked over and your re-used password on Wells Fargo being disclosed. Your comment is a really lame excuse for not using a password manager and is quite a bit of FUD; there is no technical solution to a social engineering attack, so it's a clever way out as an excuse to avoid doing something difficult. You are not the first person to try it on me. You also sound like you're making the case for social engineering control of their machine, at which point what does the password manager matter? You have physical. Game over. I have this conversation regarding self-signed certificates and MD5 hashing as well. "But they don't authenticate," or "but MD5 is insecure!" Yep, I know. Do you understand the threat vector for my usage of either? You sure? Just use one. Seriously.
    • wyager 12y ago
      >Dude. 1Password. Password managers only protect against certain kinds of attack. Many cloud services do not or can not properly encrypt their users' data, so having a strong password won't help in the event that your cloud provider's datacenter gets rooted.
      • smokinjoe 12y ago
        I think the main point is that while no platform is 100% safe, you can help alleviate the issue by reducing risk (in the case of the original commentor, they were emailing passwords to themselves). Of course there are limits to any measure of security, but 1password does a great job in helping people manage themselves. Personally, it's helped me a lot in just keeping my various usernames/user accounts organized (I sign up for just about anything).
      • sigzero 12y ago
        It "eliminates" one attack vector.
      • marcosdumay 12y ago
        You can't, but if you use a password manager, you can actually use different passwords on every service. And you can use stronger passwords (if the service permits), thus if they only lost the passwords datbased (assuming it's hashed) you are still safe.
        • ldng 12y ago
          No because say your cloud provider recycle your hard drive to another client with a bad password, then the attacker not only can access the data of the other client but can run a file recovery tool and get some of your files. Most providers don't erase disks properly. Takes too much time.
          • __P 12y ago
            Don't use Password managers because someone can always root a server and unerase deleted files. Logic. Win.
    • osuritz 12y ago
      Couldn't agree more: I look at the max allowed number of characters on website X and I ask 1Password to generate a password of that length with whatever complexity the website allows (so preferably numbers and symbols if allowed).
    • rayiner 12y ago
      Installed! I guess I knew I should use a password manager, but the analysis paralysis of figuring out which one to use is crippling. I just want someone to tell me what to do!
      • marcosdumay 12y ago
        For everyone suffering from analysis paralysis: KeepassX, KeepassDroid, and KeepassWhateverYourPlataform. It's not my favorite manager by any dimension, except for portability... but portability is just killer for it.
      • gaelian 12y ago
        Another happy 1Password user here. I've been using it for probably about 18 months now and I can never go back to manual account management. It took a bit of upfront time investment to migrate all my existing accounts into the tool but once that was done, it's been a pretty seamless experience overall. There's browser add-ons you can use to auto-populate your login details that work well for most login forms with mostly no or minimal configuration required. It can get a little annoying when the login form has a CAPTCHA or some other non-standard requirement, but generally all that means is a few extra clicks. When creating new account details, configurable (e.g. length, allowed characters, etc.) password generation is built in. You can keep your encrypted data store file on a cloud service for syncing between devices, should you wish. Which brings me to the 1Password mobile apps, which allow you to take your details mobile. Probably the greatest friction point I've encountered has been when I'm on a foreign computer that doesn't have any of my 1Password support tools installed on it. In this case I usually just pull out my phone, navigate to the login details I need and enter them manually. But I take this as a small price to pay for markedly greater peace of mind. I really can't recommend using a password manager enough. If 1Password is not it for you, then use some other password manager. But just use one.
      • hisyam 12y ago
        There was a reddit thread that reviews a bunch of password managers out there: http://www.reddit.com/r/apple/comments/1psfmt/1password_vs_lastpass_vs_keepass_vs_dashlane_vs http://www.reddit.com/r/apple/comments/1psfmt/1password_vs_l...
    • vhost- 12y ago
      1Password and last pass are pretty awesome. Some people don't want to use a 3rd party and for those, I suggest KeePass databases at the very least. I have all my two-factor reset keys in KeePassX at home and all normal passwords in last pass. I actually lost a two factor code for Linode when I lost my phone with the Google authenticator app on it and having those reset codes in KeePassX was a life saver.
      • flinkblink 12y ago
        Agreed. Keepass + A fileshare service to sync your database to all devices is heavenly.
      • kyrra 12y ago
        I've seen this argument come up before and I don't understand it. Why do you trust KeePass more than 1Password? In both cases you are sharing the datafile however you'd like (Dropbox, thumbdrive, etc...). The primary difference is if you have access to the source code or not. If KeePass purposefully injected a vulnerability, it would just be that dev/project that would fail. If 1Password were to do the same, that company and all the people that work for it would go down. I'd personally see this as more of a reason to trust 1Password over KeePass. The primary argument is that the code is open and you can audit it, but in reality that doesn't really happen unless there is a real drive to do it (like we saw recently with TrueCrypt). I trust/distrust both about the same amount. But 1Password has more resources behind it so they are doing more to try and secure the data within the encrypted store.
        • r00fus 12y ago
          Well, Keepass is free as in beer too, so from a licensing perspective, that's a factor (mainly for adoption) though, 1Password is a totally affordable and solid investment for 99%+ of folks on this board). Free allows much more organic adoption - I can recommend a friend to use KeePass without worrying a bit that he doesn't think 1Password is a good investment. I can mandate it for my team at work without having to get it expensed.
          • 12y ago
    • err4nt 12y ago
      Agreed! At first I figured that if I could save one piece of information for each dollar I had spent on the software, it would be worth my money. By day two of using 1Password I had 70 entries, and was blown away at how much peace of mind I had. There were seventy things I never needed to _worry_ about forgetting. It was like my brain was holding onto each of those and now I felt more able to just focus on working, it's insane how since I didn't know any better I waited years to finally try it. Second thing I did, buy a copy for my cousin for his birthday! Hope he has a great year with more brainspace for ideas and less spent trying not to forget things :)
    • deleted 12y ago
      [deleted]
    • tlrobinson 12y ago
      While I think using password managers with random passwords is far better than sharing the same password between every account, I've never really gotten comfortable with storing passwords in a file on my computer. What I'd really like is a password manager hardware dongle of some kind, like the Bitcoin Trezor wallet.
      • nwh 12y ago
        It doesn't matter. If you have malware lurking in your computer it will just snarf your passwords from the wire and then you're owned all the same. If you use some sort of auth signing system, the request can just be intercepted and modified on the fly.[0] The Trezor is next to useless even for bitcoin for this very reason. Sure they can't steal your money directly, but just replacing the addresses you see and send to accomplishes exactly the same thing. If your platform isn't trusted, no amount if smart crypto or hardware dongles can make it safe.[1] [0]: The rebuttal for this will be signing every request with details of it with a hardware dongle, but would you want to do this for every action in your email client? If the answer is "no", you're owned. Ultimate security is unusable, and doesn't really solve anything outside of the most astute of professional users. Just writing this post I would need 4 signatures, one to log in, one to post, one to fix a typo, and yet another to add this footnote. Would I be able to handle that? No way, I'm far too lazy for that. [1]: The issue is that perfect compromise is impossible to detect. I can be reasonably confident on a heavily sandboxed device like an iPhone that there's little in the way of malware that would affect me. The downside being that I have no tools or methods of analysis if I thought it was compromised. There's no such confidence on the computers I use on a daily basis. I've always thought we have confirmation bias with malicious software. We only notice the dumb stuff while the smart goes unnoticed.
        • tlrobinson 12y ago
          For passwords you're right, but at least it prevents theft of every password all at once. For Bitcoin hardware wallets like Trezor, IIRC they either do or will support BIP-70 "Payment Protocol" payment requests that are signed with an X.509 cert, allowing you to verify the request on the dongle's screen.
    • genwin 12y ago
      Or a text file or spreadsheet containing passwords, in a TrueCrypt container (I still trust it).
      • corford 12y ago
        Yep, I do the same. Master truecrypt container on a USB stick that just contains a text file with all my logons. Then whenever I change that file I backup the truecypt container to Spideroak so I'm not hosed if I my stick gets lost/broken/stolen.
        • ptwiggens 12y ago
          That is completely unusable on mobile. As someone who consistently needs my passwords on the go, a password manager is really the best way to go.
          • genwin 12y ago
            Do you have to trust that the password manager doesn't upload the passwords? I trust TrueCrypt since it isn't specifically for passwords.
      • vellum 12y ago
        Don't you run the risk of getting the text file or spreadsheet cached to the temp directory?
        • genwin 12y ago
          Good point. I doubt Notepad caches anything on a different drive, but Excel would if auto-save is enabled.
    • dreamfactory2 12y ago
      I got screwed by a password manager that got deleted during upgrading a hard drive. Never again
      • sbarre 12y ago
        1Password lets you store your (encrypted) password keychain on Dropbox to sync across devices. You didn't get screwed by a password manager, you got screwed by a bad backup policy.. Sorry to be pedantic - and I feel your pain for losing your data - but there you go..
        • dreamfactory2 12y ago
          It was definitely my stupid fault but the fact is that it introduced a bunch of fragility and less control into password management for me and wasn't a great solution. But it seems increasingly clear to me these days that internet-connected devices are simply unsuitable for anything which requires privacy in any case.
      • cheald 12y ago
        That's more or less why I use LastPass. Same concept, only decrypts client-side, but is automatically preserved across machines and hardware failure.
        • tim333 12y ago
          I use Lastpass. I just logged in online and can see all my passwords so it doesn't seem terribly secure. I there was key-logging malware on my machine it could have got my master password and hence all my passwords off Lastpass. It seems handy for all the crap passwords but I would not want to rely on it for anything that lets people nick money. Unless I'm missing something...
          • cheald 12y ago
            LastPass uses your master password to decrypt your key store clientside. What's stored on their servers is an encrypted blob to which they don't have the key. It is an actual zero-knowledge system. If there was key-logging software on your machine, you're pooched any way you slice it (since such malware can just snarf decrypted keystores out of memory anyhow). However, with LastPass you can use Google Authenticator or a Yubikey or similar to enforce second-factor logins, so that even if you have malware on your machine, there is a drastically-smaller window in which to attack you. On the upside, you get phishing protection (LP won't fill passwords for sites that don't actually match the site that you've saved passwords against), password duplication detection and strength auditing, notifications of when your passwords may have been compromised by major breaches, secure transport of passwords to other people, and transparent synchronization across devices. It's quite good.
    • oliyoung 12y ago
      My problem is that 1Password et al are curing symptoms, not solving causes. Personal infosec hasn't evolved quick enough to match the technology it depends on. Sure we're comfortable with 12 character, 3 month rotation passwords, but the average 'civilian'? Probably doesn't even have a passcode on their phone despite the massive personal security risk they're carrying around with them. We need to educate and/or provide easier authentication.
      • dredmorbius 12y ago
        12 character? Please! ;-) (Most of mine are markedly longer.) Though I'll admit to being a tad less aggressive on the rotation than I ought to be.
        • rquirk 12y ago
          A lot of sites don't allow more than 12 chars. Of the top of my head, Nintendo's rewards scheme has a limit on the number of characters, it lets you use more but actually truncates the password to 12 or so. Some sites truncate it on the sly then say "incorrect username or password!" when you enter your stored 16+ character password. Other sites silently break if you use characters outside A-Za-z0-9. e.g. you set a password with } or @ in it, then can't log back in again. Ebay wouldn't let me paste a password into the password field recently, I had to type it out, and the keepassx "autotype" feature was thwarted by their focus-altering javascript code on the form. I also think they silently dropped special characters - I know it took me 4 or 5 password reset emails to get the new stored pw to stick. Paypal requires that you enter a credit card number to change the password, so rotating it is tricky if you don't have the card on hand. I'm undecided if this is good or bad, since this sort of 2 factor makes it harder for someone to hijack your account. There are a lot of ways that sites try and make life hard if you are doing things the right way and using a pw manager. It feels like there's this big conspiracy driving us to use the same "Monkey123" password everywhere.
          • dredmorbius 12y ago
            Oh, I know. God do I ever know. I use a password generator. My defaults are _long_. But the nice thing is that I can pass it most constraint rules reasonably readily to create a valid password if I need to fit another use-case. I don't use Ebay, but that sounds particularly annoying. Conversation on G+ suggests that the copy/paste defeat is to combat copy/paste exploits elsewhere, though by that point you might as well declare game over anyhow. I'm definitely _not_ using "Monkey123" everywhere. But a lot of sites get a perfectly cromulent password ... and a mailinator.com email address (also randomly generated). I never use the same tokens twice (mostly registration-required but no real utility / long-term state storage).
    • prawn 12y ago
      I currently use PasswordSafe which is clunky as hell but generally works OK. I checked the 1Password site and it seems like a bit of a bait and switch. Download links without any mention of a price or trial anywhere on the product pages until you create a vault and see a License link in the menus. Then $50+ and another $10 for the mobile app. I'm sure it's worth it, but I'd much rather they spell out their pricing up front.
      • jwcooper 12y ago
        They have a 'store' link [1] right in their header with all the pricing. They could maybe be a little more upfront about it, but it's not really a bait and switch. Also, the prices do seem fairly reasonable for what it does. The only thing holding me back has been not having great mobile access (as far as I can tell) on Safari on iOS. Looks like iOS 8 will change that. [1] https://agilebits.com/store https://agilebits.com/store
        • eridius 12y ago
          I've used 1Password for years, and password access in Safari on iOS has indeed been a pain point, but still been manageable. iOS 8 will make it much nicer, with the 1Password extension.
        • prawn 12y ago
          I think they purposely avoid putting a "Buy" link on their product page because they want to get people started before revealing that the software costs money (and a lot of money for a password safe). IMO it's not far off the equivalent of how tourist trap restaurants in Europe put out bread on the table (something provided for free in many restaurants) and then charge you if you touch any. FWIW, that's considered pretty slimy behaviour.
    • mr_sturd 12y ago
      I started using Mitro, recently for the same thing. I had been slowly working on a system which would store pseudo-randomly generated salts and store one for each individual domain. It would detect which site I was entering my password into, take the relevant salt and digest it against the password I had entered - sending a stupidly long, digested passwords to the sites which would allow for it. The password itself would never leave my computer. Progress was slow, though, and other projects took priority. With Mitro, I've done a similar thing by pseudo-randomly generating 64-character base64 strings to store as the passwords for my accounts.
      • decode 12y ago
        > I had been slowly working on a system... If you're still interested in this type of system, PasswordMaker has been around for quite a while and does essentially the same thing: http://www.passwordmaker.org/ http://www.passwordmaker.org/
    • Kiro 12y ago
      Stupid question but what happens if you forget the master password or someone steals it?
      • cpach 12y ago
        Then you have to reset every password and start over.
      • mikerastiello 12y ago
        >1Password creates your data file using the password you provided when you first launched the application. This password is not kept anywhere and it is never logged. Furthermore, there is no “back door” mechanism to recover your data or password. This approach is very important in order to be able to say that 1Password keeps your data safe and secure. However, because of it, once your password is forgotten, there is nothing we can do to help you recover it. https://help.agilebits.com/1Password3/forgot_password.html https://help.agilebits.com/1Password3/forgot_password.html I have my master password written on a piece of paper that is stored in a safe location, mostly so my wife can access my information if anything ever happened to me, but it also works as a backup if I ever forget my master password for some reason.
    • lsaferite 12y ago
      Looks like they still don't have a native Linux client though.
      • jbrechtel 12y ago
        pass - http://www.passwordstore.org/ http://www.passwordstore.org/
        • lsaferite 12y ago
          Well, my point was more that I do want a single password storage solution across the board. I use Linux, Windows, OSX, and Android regularly. I tried 1Password in the past but dropped it as it didn't have a Linux client. I now use KeePass as I can sync my DB across all my devices.
    • baby 12y ago
      What if you're not on your computer and you want to check something on gmail, or facebook, or airbnb, etc...
      • alexgaribay 12y ago
        They have a mobile version that syncs your passwords across devices. I use the iOS app frequently.
        • baby 12y ago
          Yeah but still, if you don't have a smartphone, or you don't have your mobile, or you can't use your mobile (different country, no wifi). You're pretty much kicked out of your own accounts.
  • jacquesm 12y ago
    > data never leaves a company desktop, laptop, or blackberry. That's not all that draconian. Data never leaves the servers, full stop. (Other than for back-up purposes and those had better be encrypted.)
    • lrem 12y ago
      Seconded. Corporate network only as the place from where company managed clients are allowed to access production network, where the data stays. Even when someone manages to steal all the electronics from the office, he still doesn't get any data/source code/whatever. Easier said than done though.
      • jacquesm 12y ago
        And you're still going to have to do a lot of work to prevent exfiltration from the servers other than for backup-purposes and track your back-ups and who has access to them.
  • Corsariuster 12y ago
    You are so right on the money. We used to see hacking into celebrities' gmail inboxes, social accounts, dropbox stores - all through social engineering. We now see hacking into icloud. Next we will see hacking into gdrive, onedrive or some samsung cloud - if enough celebrities start using Android or Winphone. The pattern is the same, so is the weakest point - the actual user. Maybe it's time to educate people more instead of writing more security software.
  • michaelt 12y ago
    I'd really be thinking hard about my cloud policies A lot of social engineering attacks involve things like security question password reset, lost second factor reset, lost access to backup e-mail/phone, and things like that. Don't most enterprise cloud offerings dispense with things like that, because users can visit a helpdesk in person?
  • atmosx 12y ago
    > The policy at my previous employer (we handled a lot of extremely sensitive information), was pretty draconian: data never leaves a company desktop, laptop, or blackberry. Really? And how do these devices inter-communicate if data never leaves from anywhere to anywhere? Burying a laptop to the ground would make it safe enough to keep out the bad guys.
    • gnopgnip 12y ago
      You can use citrix or terminal services so the sensitive data never leaves the servers.
      • gaadd33 12y ago
        Couldn't someone just screenshot the citrix or terminal services session while the user is using it?
        • rayiner 12y ago
          Sure, but that only gets you one screen of a sensitive document, and is a lot harder to do inconspicuously than to surreptitiously look at a file that a user saved to his personal laptop's desktop with the filename "Details of Unannounced IPO.doc."
    • tripzilch 12y ago
      > Burying a laptop to the ground would make it safe enough to keep out the bad guys. That will just drive the bad guys underground.
  • yarou 12y ago
    I think this points to the inherent weaknesses in the concept of "username/password". Why do we still have this paradigm? It worked in the 80s, but I think there needs to be a new paradigm in place today. Ideally you'd want a system like public key authentication, with some bio-marker used for identity management.
• nodata 12y ago
  Why is nobody talking about password reset questions?
  • spindritf 12y ago
    Google dropped them. We no longer support security questions as a way to access your account. https://support.google.com/mail/answer/183723?hl=en https://support.google.com/mail/answer/183723?hl=en
  • raverbashing 12y ago
    Yes Hopefully the idiots who call themselves security experts will stop making me answer "what's my mother's maiden name". If they really want to make it safe, one easy option would be to make the question arbitrary. Of course then average people will have no idea what to put it there. Of course, don't put "What is Love?" with the trivial answer...
    • fabulist 12y ago
      > Hopefully the idiots who call themselves security experts will stop making me answer "what's my mother's maiden name". This is done by developers, not security experts. If security experts had their way, it would be equally bad but for the right reasons, ie client-side certificates or smart cards. Calling them idiots is also wrong. Its a bad solution to a hard problem, but it works and scales and users have been trained to expect it.
  • r721 12y ago
    It seems attackers used them somehow: "After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet. None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone." http://www.businesswire.com/news/home/20140902006384/en/Apple-Media-Advisory http://www.businesswire.com/news/home/20140902006384/en/Appl...
  • ufmace 12y ago
• karlick88 12y ago
  While I am complete appalled by the data breach and hope that similar things never happens to anyone again I would like to propose a purely thought experiment: The hacker reported sold the nude photos of Jennifer lawrence for a mere sum of $130 using bitcoin. If we apply game theory here, these kind of data is very difficult to monetize. If you sell one copy of the data, it is then immediately distributed online for free. Although, nude photos of celebs are arguably very valuable. The question is: What is the ideal path for these people to maximize profits? I think the better alternative would have been a kick starter type model where the attacker will only release photos if reaches a funding goal (let's say $50k). The attacker might release less revealing photos to build interests in the goal funding. I often hear about decentralized kickstarter models with bitcoin (mutlsig; or ANYONE_CAN_PAY hash type). But I always thought of them as gimmicky. This is actually a use case for it. So going beyond, celeb photo breach, this similar model should be applied to many more scenarios. ie. 1. you have a valuable asset, 2. but it loses value immediately after the first distribution 3. so you must capture all of the value at distribution Note: Anyone can pay: https://bitcoin.org/en/developer-guide#term-sighash-anyonecanpay https://bitcoin.org/en/developer-guide#term-sighash-anyoneca...
  • 33W 12y ago
    I believe that this applies to many products using digital distribution that meet the following: 1. The asset takes requires a significant amount of resources. 2. The asset will require all resources in order to distribute. 3. No further resources are required after distribution. Music, books, art, and even software that does not require updates would fall into this category.
    • to3m 12y ago
      See, for example, perhaps, this album from the Wu Tang Clan: http://www.forbes.com/sites/zackomalleygreenburg/2014/05/06/unlocking-the-wu-tang-clans-secret-album-in-morocco/ http://www.forbes.com/sites/zackomalleygreenburg/2014/05/06/...
      • 33W 12y ago
• brador 12y ago
  Icloud hacking was mentioned and everyone has jumped on it. Many cell transmissions are unencrypted. MITM attacks should not be thrown out as a possibility. Malware is also a vector, including apps.
  • GVIrish 12y ago
    One of the victims stated the pictures were from several years ago. Unless the hacker was extraordinarily patient and persistent, I have to think a MITM attack on a cell tower is unlikely. More likely a cloud service (email, social media, storage) of some sort was compromised.
    • brador 12y ago
      Another possibility is purchasing an old phone from Ebay and extracting deleted files. Or a local mac/pc/phone repair shop pulling the data during a repair. Then theres the nsa/border sec vector too. Photos uploaded to a mac or pc could also be malwared or malicious apps. Theres the ex/friends/family as possible weak points too. Plus we have no idea how long these photos have been traded within that private group. What i'm saying is there are lots of ways this could be done and we shouldn't get so hung up on the icloud idea.
• deleted 12y ago
  [deleted]
  • deleted 12y ago
    [deleted]
    • codezero 12y ago
      I'm just guessing here: there wasn't a security breach. Phishing is different from someone breaking into the iCloud service as a whole.
      • deleted 12y ago
        [deleted]
• foobarqux 12y ago
  Even celebrities don't matter enough. Everyone will get real security once hackers start targeting private equity and hedge funds.
• eknkc 12y ago
  I use strong passwords generated by 1Password for everything.. except for iCloud. There I have an idiot password. Why? Because freaking iPhone asks for that when I want to download something from App Store. How do you guys handle that?
  • gyardley 12y ago
    I've memorized a non-idiot password I use solely for iCloud.
    • deleted 12y ago
      [deleted]
  • aaronbrethorst 12y ago
    TouchID.
    • eknkc 12y ago
      Yeah, how about the first time? I mean, I do not buy apps all the time, maybe once a week. And I'd have my battery dead or something like that in between those attempts. So, I never had a chance to just hold my thumb on the home button and go my way.
      • robszumski 12y ago
        I have this problem all the time. My current process is to: 1. open the App store but don't click on anything 2. hit home button 3. launch keepass client 4. navigate to apple account entry 5. copy password 6. double tap home button to bring up multitasking menu 7. tap app store 8. click install 9. paste password It feels really stupid doing it, but you can get pretty quick at it. I can't wait for my next iPhone upgrade with touchid.
      • ptwiggens 12y ago
        This is really easy. You have one good password for 1pass, and one good password for iCloud. If you can manage to memorize one, you can memorize two.
• stevenh 12y ago
  Reddit should not be listed among the sites hosting the stolen images, as reddit does not support image uploads. Imgur is the primary site hosting the stolen images in that case.
  • ahelwer 12y ago
    Are we still unable to move past this pedantic hosting-vs-linking nitpicking? It's like you willfully ignore how content discovery works on the Internet.
    • Systemic33 12y ago
      Just to be pedantic: By the same logic, Google is also grossly hosting tonnes of illegal material.
      • ahelwer 12y ago
        The differentiation is knowledge & intent. Nobody types in random photo GUIDs after the imgur url to find content, just like nobody generates SHA-1 hashes hoping to find valid magnet links. Users follow a route of links through search engines and content aggregators to find what they're looking for. Look, I know it's easy to take this whole issue to ridiculous logical extremes[0], but the argument that you don't have culpability by hosting links is really, really weak. To head off the probable route this discussion will take, linking to Google or Reddit as a whole does not incur the same culpability as those sites do by linking directly to the material, as finding the offending link requires additional knowledge. If you linked to Reddit along with instructions like "go to <subreddit> and click the third-highest link for the week" then it would incur culpability as it's functionally identical to linking to the content directly. [0] http://en.wikipedia.org/wiki/Illegal_number http://en.wikipedia.org/wiki/Illegal_number
      • blatherard 12y ago
        Google doesn't have moderators posting messages like "uh-oh your illegal content is being taken down. Here's a list of other places to post it." Meanwhile, Reddit has precisely that. Warning: link to NSFW board, though this post isn't itself NSFW. http://www.reddit.com/r/TheFappening/comments/2fa2a1/meta_effective_immediately_any/ http://www.reddit.com/r/TheFappening/comments/2fa2a1/meta_ef... In which the mods write: "On another note: please use other hosting sites besides imgur.com. We have a large list of whitelisted domains listed here that you should be uploading to besides imgur. Do not put all of your eggs in one basket."
• shouldbeworking 12y ago
  Isn't showing partially blacked out private photos still a violation of privacy? If the author of this post really wants to be white hat, he should modify the image (above 14) to obscure the non-blacked out part of the photo with a different color. I'm unfamiliar with that celebrity in the picture but if I was familiar with her work, it would feel creepy to look at it.
  • nikcub 12y ago
    thanks - fixed. didn't notice I picked the wrong image out when uploading.
• julianpye 12y ago
  The average user does not know much about security. They trust Apple's brand more than they trust their friends (with secrets and health apps) and they will now likely stop using many services rather than step up security. What is interesting is that the perception among normal people I heard speak about this is that all of iCloud has been breached, i.e. everyone's photos are in the hands of hackers and they only released the pics of celebs. The reality is of course likely that an attacker was able to hack one phone which among photos hosted contacts and mail addresses of other celebs and from there on they got their hand on more accounts to directly target. Anyway, my point is that to average consumers it does not mean that they need to use stronger security or that they would understand about targeted attacks. They will believe Apple has been breached and they will think more before creating private selfies or putting health data onto their until now so trusted companions.
• city41 12y ago
  > Password reset is answering the date of birth and security question challenges (often easy to break using publicly available data – birthdays and favorite sports teams, etc. are often not secrets) I really dislike this trend of "personal questions" to reset your password. The first car I owned or where I'd like to retire is easily obtained information. When are websites going to stop doing this? I answer these questions using passwords generated from 1Password. So basically I have 4+ passwords per sites that use these questions. Very annoying.
  • shampine 12y ago
    What about just using a basic cipher for your questions? It is what I do. So if the question is "What was your first car?" Answer could be: Ford Instead it is Enqc or droF or Gpse
    • TeMPOraL 12y ago
      Well like many such website "security" practices, if you know why they're bad, they are no longer a problem for you. But normal people don't know why security questions are a stupid idea, so when an otherwise reputable website (like an e-mail provider) asks you for your first car or favourite toy, they assume it's how things are supposed to be on the Internet.
  • ja27 12y ago
    I'm moving to nonsense and random answers stored in Lastpass but what I had been doing is just answering them as if I were one of my friends. I have a dozen friends where I know most of those answers.
• menriquez 12y ago
  i have to laugh at all this shit. these celebutards have been posing nude of decades and crave the attention and the “me too” sluttiness of it all. all it takes is for ANY women to catch their fuck-partners with nudies of some other freak for a women to join the party and start snapping away. in fact, every chick i know loves taking butt-naked selfies of their twats and asses and sends them to every dude they are interested in dorking. its a cootche arms race, plain and simple who in the hell in this day, ESP CELEBRITIES, and age thinks digital privacy exists??
  • serve_yay 12y ago
    Please don't post
    • menriquez 12y ago
      why does reality somehow offend you?
• lambdasquirrel 12y ago
  The thing that bugs me is that you could have good password practices. But if you're having a party, having a fun time (and lets face it, people are going to do shit...), and one of your friends is snapping photos of you, and they have bad password practices, then you are kind of screwed. People don't typically make friends on the basis of: do you have good password practices.
  • ddrmaxgt37 12y ago
    Yup. And that very reason is why many people don't have social networking accounts. You can control what you share, but you can't control what your friends share.
    • TeMPOraL 12y ago
      How not having a social networking account helps with that? Not only you still can't control what your friends (that is, the real-life ones) share, now you're the last to know if they share something about you.
      • DevoAKA 12y ago
        Perfect example is Facebook. You don't have to be on it for them to know your phone number. If 2 of your friends have the "Share your Contacts with Facebook" option turned on, chances are Facebook has your phone number/whatever else your friends store on their friend about you.
  • sib 12y ago
    OTOH, if you're a celebrity at a party, and you "do shit" and someone takes a picture of it, the horse has pretty much already left the barn as to whether that picture is going to show up on reddit and it's just a question of when...
  • hrabago 12y ago
    Information my friends have is something I've had to accept letting go. I once resisted signing up to Viber because it required that I upload my entire address book. However, I found out how many of my friends are already on Viber, which means the likelihood that Viber didn't already have someone's contact information was very low. It also meant Viber already had all of my contact information. Another scenario is Facebook's tagging. Even if I don't confirm all (or any) of my friends' tags on my face, the fact that they manually tagged the face as mine likely counts a lot for FB, so that battle is already lost.
• abalone 12y ago
  Choice quote: To reiterate what the main bugs are that are being exploited here, roughly in order of popularity / effectiveness: Password reset (secret questions / answers) Phishing email Password recovery (email account hacked) Social engineering / RAT install / authentication keys Note: Not weak passwords.
  • parliament32 12y ago
    Here's a question: How did the attacker get the usernames of the celebrities? Those aren't exactly public info (unless they used the same name as their Instagram account or something).
    • abalone 12y ago
      The article discusses this very point in some detail (see especially point 7 about iCloud email testing).
• DanielBMarkham 12y ago
  So if I'm understanding this from a technical perspective, the real story is that this is/has been going on for quite some time, and there's an entire ecosystem devoted to it. The general public rarely ever sees behind the curtain, but somebody got greedy in this case and we ended up in a race to the bottom. If true, interesting that such a layered economic structure can exist without much press or public comment -- until something like this happens. Fascinating. Makes you wonder what percent of the total activity these 100+ celebrity invasions represent.
  • TeMPOraL 12y ago
    Well the fact that JenLaw's photos went for the extremely huge amount of $130 suggests that either there's a lot more of it out there, or that the guy who stole them couldn't fence them (per [0] thread). Anyway, you summed up the take-away from the article perfectly. Since this seems to be going on for some time, I wonder how the whole ecosystem kept coordinating this well so far, that it's the first time we hear about such big (but still lousy one) defection. [0] - https://news.ycombinator.com/item?id=8260233 https://news.ycombinator.com/item?id=8260233
    • DanielBMarkham 12y ago
      Yeah, there's some hard-to-accept math in that story. If JenLaw's photos were worth $130 or so, that means that any photos that any of us have are associated with a market value. And it ain't that much.
      • TeMPOraL 12y ago
        Well, that our photos have a price tag is kind of obvious. Everything has one. But I'm very surprised by the amounts we're talking about. I'd expect JenLaw to be extorted for hundreds of thousands of dollars, or at least those photos going for many $k (and THB, some other celebs have much worse photos/videos in this leak). So them going for $130 implies that either celeb sex tapes are really common/cheap in the darknet, or we have no frikkin' clue what's going on out there.
• elwell 12y ago
  Just to give OP a heads up: the article's font is rendering terribly in Windows Chrome.
  • diegomsana 12y ago
    yep, i kept reading, but the font made it painfull
  • DonaldH 12y ago
    I've noticed this with my own websites. Fonts consistently look great in FF and IE but terrible in Chrome. What can be done to fix this?
    • dublinben 12y ago
      Use Firefox? Chrome has bad font rendering consistently, it's nothing you've done.
    • coffeedrinker 12y ago
      Turn of the DPI scaling in Windows. http://support.microsoft.com/kb/2900023 http://support.microsoft.com/kb/2900023 Google around for the actual steps.
      • elwell 12y ago
        I'd rather not do a fix like that; I want to notice if sites I code have the issue.
        • coffeedrinker 12y ago
          I agree, but until Google gets the fix in you can have no way of knowing what it will look like because it all depends on the hardware and how it has been scaled. I only came across this because my daughter's new laptop with an HD screen made Chrome look awful and I didn't understand why since it looked good everywhere else.
  • sundvor 12y ago
• api 12y ago
  Read the comments to this blog post. The misogynistic mouth breathers are out in full force as usual.
  • TeMPOraL 12y ago
    Just wait for the misandristic crowd to show up, as they always do. I'm just starting to see first articles in my Facebook feed trying to spin this celebrity leak into women oppression problem.
    • api 12y ago
      Both groups certainly exist, but one is larger than the other by a few orders of magnitude.
      • TeMPOraL 12y ago
        (disclaimer: not meaning to start any kind of flame-war) To be honest, the one I perceive (as a straight, white, middle-class, educated male) larger is the misandristic one. As a person who strives to be good and helpful to every human being equally, regardless of race, gender, orientation or whatever, I get everyday on the Internet and I get flooded by articles and comments saying that everything I do or think is misogynistic, wrong and overprivileged. Honestly, I think that (and I never thought I'll say something like that ever) UrbanDictionary's definition of "social justice" sums it up perfectly: Promoting tolerance, freedom, and equality for all people regardless of race, sex, orientation, national origin, handicap, etc... except for white, straight, cisgendered males. Fuck those guys, they're overprivileged no matter what. "In the name of social justice, check your privilege." ( http://www.urbandictionary.com/define.php?term=social+justice http://www.urbandictionary.com/define.php?term=social+justic... ) I'm not saying the world is fair to women or minorities, it's sure as hell not. But SJWs are overplaying it by many orders of magnitude. In my opinion, the reason this leak contains only women celebrities has nothing to do with misogyny, and everything to do with the reason why celebrity magazines are focused on women-celebrities, why most porn is targeting males, why most women dress in various cuts and colours while for a man just a suit will do, etc. Not saying it's good or bad, it's just how the culture evolved - but the point is, there's nothing new/important to see here. Also, to risk being accused of victim blaiming, et al., when you become a celebrity - be it an actor, a model or a politician, you implicitly accept that all your life becomes a public matter and is subject to scrutiny by random actors. And to be honest, I think that those celebrities actually would agree with me on that. See, it's not the victims that are making a big scandal out of this leak, it's the media and the general public, who are doing it "in their defense".
• vram1994 12y ago
  If one use Personal Cloud services like owncloud and Tonido the probability of social engineering hack goes down further. First of all the data is stored in your device and one needs to guess both the username and password. Still one need to be careful what username and password to choose and how to safeguard them.
• fpgeek 12y ago
  > 6. iCloud is the most popular target because Picture Roll backups are enabled > by default and iPhone is a popular platform. Windows Phone backups are > available on all devices but are disabled by default (it is frequently enabled, > although I couldn’t find a statistic) while Android backup is provided by > third party applications (some of which are targets). Fragmentation, for the (security) win! </sarcasm> Not really, of course. The big win (shared by Windows Phone) is simply not turning on the security-sensitive cloud service by default. That being said, it is worth noting that enabling/encouraging third-party service competition can create an extra hurdle by discouraging cloud-service monocultures.
  • yaeger 12y ago
    Does Android really not provide an auto upload of snapped pictures to the cloud? I was under the impression that they did this way before iCloud even came up. First it was to Picasa or some place, then to the google+ place somewhere. Either way, I don't even remember if the iCloud upload was default or not. When it was introduced I took an interest to find out how to deactivate that in case it was enabled by default. Don't remember if it was. All I know is, it is disabled on my device and it'll stay that way because I really didn't want to use this.
    • tripzilch 12y ago
      Dropbox does it for you. Plus you get a free 50GB dropbox account with many Android devices, so the incentive is there.
    • deleted 12y ago
      [deleted]
    • king_jester 12y ago
      > Does Android really not provide an auto upload of snapped pictures to the cloud? I was under the impression that they did this way before iCloud even came up. First it was to Picasa or some place, then to the google+ place somewhere. When you sign into Google+ or Dropbox (among others), you are presented with a screen where you can enable photo uploads to those cloud accounts.
• ams6110 12y ago
  I think the cloud has proven to be untrustable. One must assume that any data on any public cloud service (including email, photo libraries, documents, mobile device backups, etc.) will become public, and use the cloud with that mentality.
• uladzislau 12y ago
  I'm wondering if simple GeoIP check can prevent lots of intrusion attempts - if the user consistently logs in from one location and then suddenly tries to log in with the wrong password from the distant one, that's the red flag that warrants temporary account lockout at least.
  • treyp 12y ago
    problem #1: GeoIP isn't accurate enough
    • rtkwe 12y ago
      problem #2: Travel becomes more of a pain because your apps/phone stop working.
  • ja27 12y ago
    I swear Apple did this to me repeatedly last year while I was travelling for a month. I could never purchase apps. One problem with this is VPNs. I regularly VPN (both to my house and via a service like Private Internet Access) so my location can change quit a bit.
• ksec 12y ago
  Why doesn't platform maker like Google, Microsoft and Apple have their Password manager and forces the usage of it?
• theDustRoom 12y ago
  I use a Yubikey with a generated key. This is only half of my password; the first part is a password I can remember easily with numbers and letters, the second is the generated key. This means that even I don't really know my password and if someone found my Yubikey then it's useless to them without the other half that only I know. (I do have a printout in a safe place of the key and also a backup Yubikey) I use this password for my computer as well as my 1password vault which is generally filled with randomly generated keys for each website. Might sound a bit overkill but if you can; why not?
  • coldpie 12y ago
    What's the advantage to this over simply using 1password?
    • theDustRoom 12y ago
      It's mainly for my laptop to be honest but as it's just a tap away why not secure my 1password vault more securely at the same time? I also run software on my MacBook Pro so that when I pull the Yubikey it automatically engages the screensaver which in turn requires the password to disable.
  • amvp 12y ago
    That sounds secure, but help me understand: Is it the same password everywhere? How do you manage the different passwords for different services? How do you enter your password to login on an ipad, or on your phone? My biggest problem with the Apple's password policy is that I'm required to enter it periodically on an ipad or iphone - meaning I can't keep it lastpass and that complex alphanumeric passwords are even harder to enter.
    • theDustRoom 12y ago
      My iOS accounts are, unfortunately limited to a password that I can remember but I use one with numbers and letters and a mixture of uppercase and lowercase characters. Most of my website passwords are generated keys; each different - all stored within 1password, should there be an issue at any point (doubtful) I can always go through the "forgot password" features on any given website to reset it to something temporarily that I can use easily.