Slashdot Mirror
Identity Theft and Social Networks
scubacuda writes "This Security Focus article looks at the lack of security social network sites have, particularly their lack of SSL logins, which means a user's session ID will be logged on any proxy and possibly sniffed. From the article: '[A]ccording to [Clay] Shirky, one thing is certain: "The value of each site is communally-created. Links and transactions are more important than individuals." In other words, each community creates its own kind of value. Thus, an attacker might hit Tribe to farm social networks for spam victims; and then he might exploit LinkedIn to get the contact information for a VC he wants to meet.'"
Go home, dickbutts.
Is it good, or is it whack?
Are you GAY?
Are you a NIGGER?
Are you a GAY NIGGER?
If you answered "Yes" to all of the above questions, then the GNAA (GAY NIGGER ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join GNAA (GAY NIGGER ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time GNAA member.
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the fastest-growing GAY NIGGER community with THOUSANDS of members all over United States of America. You, too, can be a part of GNAA if you join today!
Why not? It's quick and easy - only 3 simple steps!
First, you have to obtain and read the Regional Transportation Plan for the Maricopa Association of Governments sponsored by the Arizona Department of Transportation. You must take a test to verify your knowledge of the plan. The test consists of 6 questions:
1. How many lanes will US 60 be from Val Vista to Power Rd?
2. What is the scope and span of I-10R?
3. What is the Wickenberg Bypass?
4. When will the Williams Gateway Freeway be built?
5. What is planned for I-17 from McDowell to Dunlap?
6. What is planned for US-60 (Grand Avenue)? How much money is set-aside?
Second, you need to succeed in posting a GNAA "first post" on slashdot.org, a popular "news for trolls" website
Third, you need to join the official GNAA irc channel #GNAA on EFNet, and apply for membership. Talk to one of the ops or any of the other members in the channel to sign up today! >[? If you are having trouble locating #GNAA, the official GAY NIGGER ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is EFNet, and you can connect to irc.secsup.org or irc.easynews.com as one of the EFNet servers.
If you have mod points and would like to support GNAA, please moderate this post up.
I am protesting Slashdot's chronic abuse of its readers and subscribers. Please visit www.anti-slash.org and help us!
People are getting lazier, as people get lazier security goes down, deal with it.
third post
An internal server error occurred. Please try again later.
If you think slashdot is having to many of these reply to this post.
I have good luck with mine
lysol
ysoll
solly
ollys
llyso
lysol
GNAA was here YOU FUCKING NIGGERS
LYSOL
The idea of social networks is just insecure from the get-go. When people are connected, there's increased potential for security risks and flaws to be exploited and to be created. It's like broadcasting your real email and IP addresses on Usenet - a bad idea. The buggy implementations are just icing on the cake.
Slashdot: when news breaks, we give you the pieces.
TrolKore rules /. forever.
CmdrTaco prefers TrollKore's cox in his anus
to GNAA's!
Guess it doesn't matter if you just stay anonymous.
I've heard the rate at which people who commit identity theft get caught is around 1 in 7000.
So you have a much better than 99.9% chance to just do it to your heart's content and walk away with the money. That's pretty freakin' scary. A crime where you never have to see your victims, never have to face any consequences, and make tons of money. Can you imagine what would happen if a misguided Robin Hood decided to popularize the techniques and teach them to America's poor? Would the entire banking industry collapse at once? With a million people doing it simultaneously you would obviously overload the already overloaded investigative ability of the gov't and probably change the ration to 1 in 100,000 getting caught.
Why... when I was your age, karma had numbers!
...it is rather scary how little attention people pay to security. The article even states: "...site performance is our highest priority, and SSL is a pain." While it can be costly to set up security (ie, paying security consultants ;) ), if done right from the start it is less expensive than trying to fit it in after the fact.
It is certainly less expensive than having your site hacked and/or having users leave when people post their private thoughts publicly!
libertarianswag.com
and I feel damn cool for doing it. They still haven't figured it out.
Oh, wait...
One friend feared that she might lose her job when a private entry about problems with her supervisor was made public
Rule 1:
If you want to keep something confidential, don't post it on a free website.
If they aren't using SSL, they are basically saying they don't value privacy the way you value your privacy."
Duh. Unless you use encryption, almost anything you send on the internet can be intercepted. Conduct yourself accordingly.
you're far from safe. SSL connections are vulnerable /.) to realise
to MiTM attacks - we saw this with M$ Passport, hotmail
etc. The only solution to these problems, is
for people (ie the average user of
that anything they transmit over the net is sniffable
with a little effort.
In a dorm or corporate lan environment, all it takes
is one trojaned laptop running a sniffer, and all
you CC numbers are belong to us.
GNAA!
All the more reason to allow "anonymous", one-time use of purchased credits.
Like phone cards - pay cash and use it online as you wish without easy tracking.
Believe it or not, there are a lot of people online that don't have credit cards but would like to buy stuff over the internet (or people that *have* credit cards but are afraid to expose their information.
Yeah, some people are going to bring up the "you are only liable for fifty bucks, anyway" issue.
This is totally on topic!
P.S. Got internal server error AGAIN when clicking submit.
- There are people who participate in identity theft via any means possible, because that's the life they lead.
- Social security numbers in and of themselves ARE the vulnerable entry point because the information flow to and from them is bidirectional.
The only possible suggestion here is the same one that's been played over and over on the record entitled "keeping your information safe for dummies," which is "use caution and reason in any transaction you make.-- http://www.criticalassets.com
Actually, that was not offtopic (nor flamebait, nor troll.) Moderators, please read the article before moderating. (Reading the moderator guidelines wouldn't hurt either.) kthx
A lot of good has come out of the "social networking" craze. I have personally blogged about a lot of this on my personal blog that I administrate myself. You'll notice that I have discovered a very unique piece of software called "Movable Type" that allows me to blog what I want without surrendering any information to the outside world. That's right: every time you go to Friendster, LiverJournal, or another so-called "community" site, you are subjecting yourself to a host of vulnerabilities. Read the privacy policies: these sites surreptitiously save data to your hard drive through the use of so-called "cookies"; they may serve intrusive ads that interfere with your web browsing experience; and they may fall prey to black-hat "crackers" (not "hackers").
Personally, I feel that every third-party site is not to be trusted. For the greater good of the blogosphere, I believe that the future lies in individually unique weblogs connected by a perfectly synergistic system of TrackBack pings.
Sincerely,
Seth Finklestein
Social Networking Consultant
I'm not Seth Finkelstein. I still speak the truth.
In "The Cuckoo's Egg", one of Cliff Stoll's key points was that the more secure a network becomes, the less useful it is to its users, because it becomes more inconvenient to work with. In a network where the entire idea is to exchange "personal" data such as contact info, then restrictions placed to enforce good security have a way of reducing the value of the network.
But without such security, you have a "tragedy of the commons" type effect where the greedy among us abuse the good nature of others, again, reducing the value of the network.
Seems like a rather immutable Catch-22 to me...
Blogging Weight Loss, Distance Education, and more at verlin.com
It saddens me that nothing will be done until some poor fella pays very dear when someone finds the motivation to sue, gets a good lawyer and wins big.
It seems that in most things related to security, and not only virtual security, people don't start taking measures until something bad happens and they are made to pay for it...
What do we expect anyway, common sense is the less common of senses..
... y Dios vio que Linux era bueno... Genesis 99.666
As if that is our problem. That's the wild-west attitude: if you can't secure yourself, you deserve whatever you have coming for you.
Why should we invest in something that's a self-evident fundamental right (even on the net): security.
What we need here is strong action from the world governments. Make the net a safe place for everyone!
you fucking fag.
IF I EVR MEET YOU I WILL FUCK YOUR ASS!
# messages before posting your own to avoid simply duplicating what has already been said.
# Use a clear subject that describes what your message is about.
# Offtopic, Inflammatory, Inapp
Most community sites seem to be local run affairs by the kid down the hall in his spare time, not by those with the money to spend on SSL certs. That, and given the value of the Internet is to allow people to connect in new ways unencumbered by worrying how to pay for it suggests that the problem here is not how to provide technically secure transactions.
The problem here is how to create personaly security on the Internet. When you're in the mall, gals keep their bags so the flap is on the inside. Guys don't stare at other guys for too long. That is how they are personally secure, not because the mall guards have guns.
So a more interesting question is not "how can you make other people more secure?" but "how do you make yourself more secure?" Publish your results, and best practice will win.
...which cost me >$100, in order to have some password security on the bulletin board I run. phpbb would mail the password out in the clear, and didn't allow you to log in over SSL. It wasn't a big deal to hack it, but I was surprised that it wasn't an option. It may be that more people would use decent security if the software they ran supported it.
Did you know that the crime of identity theft ist virtually unknown in Europe (at least in Germany, where I live)?
And there are some obvious reasons for this:
- Nobody in Europe has mail boxes without a lock. European mailbox are usually flat, upright, rectangular boxes with a slit on the top of the front where the mailman drops the letters and they fall down a slide so you cannot get them out without using either very long pliers or, of course, the key to unlock the door at the back.
- No bank would give you a checking account or a credit without checking your ID card and making a photo copy of it and noting the number. (Remember that in most European countries (except e.g. the UK) every citizen is required to have a national ID card which you show whenever somebody has to be sure of your ID. (These cards have all kinds of witty security features to make them really hard to counterfeit.)
- All laws and courts agree that a reasonbable proof that somebody did make a business transaction is a signature on a piece of paper, or at least some computer record showing that the customer has entered a secret PIN. 'Secret' meaning, that nobody else should be able to know it. (PINs are printed out by the banks' computer systems and put in a sealed envelope without any employees being able to look at them.)
- Especially, if you told a court that a business transaction was valid because you checked the caller's identity on phone by asking for his SSN (or some lcoal equivalent of this), his date of birth or his mother's maiden name, the judge would probably only laugh at you.
While staying for half a year in California, I was quite astonished about the lax way of checking identities common in th US.
(For example, I got liability insurance for the used car I bought by just phoning the company. The guy asked for my Visa card number, then said 'Fine. Your car insurance is valid starting now, i.e. 4:13 pm.' That was great and convenient, but after all, I still prefer the European way, where they'll first ask 'So, how do we know, that this was your credit card number, and not taken from some receipt you picked out of a trash can?'. As the very least they would want proof of your address so that they can send you a court summons in case you tried a fraud.)
Make me your friend; my fans get +1 comment scores.
I had my identity stolen about 8 years ago. It suuuuuked!
In San Francisco, when some people move out, they throw all this crap they don't need anymore on the curb. I saw this thoughout the city, time and time again, so when it came time for me to move, I did the same.
I got rid of almost everything! This included, tons of old papers - possibly old pay stubs. Big NO NO! At one point, I even noticed some people looking through the big pile. "Just people who like crap", I thought.
Six months later, the Postmaster General Attorney's office in San Jose calls me saying they've arrested someone on postal fraud that had my name and info in his little black book. It was under a section that basically was ready to have a drivers license and social security card issued in my name with this guy's picture!
To make a long story short, the guy went to prison and I had to notify all agencies where I had any type of id or credit/bank card to put a watch on them for the next six months.
My lesson learned: shread everything.
However, online, this is a totally different issue and the only thing I can suggest and do about that is to check into companies and try to make sure they are responsible about how they store your credit-card information. I've personally written to all the online companies I use to ask as how they protect my information. If it ever seemed like they weren't up to snuff, I explained my concerns and asked for some sort of reassurences. Although, I must admit, that's not the best thing and sometimes letters to the BBB and other groups/agencies are necessary.
Karma karma karma karma karma chameleon, you come and go, you come and go.
you suck cock, gaiboi.
Fortunately it will never fly here in the UK. We are still human beings, not numbers.
An insecure network is useless to this user (for purposes that I deem to be in need of security), no matter how "convenient" it is.
Generally speaking, I wonder how the numbers of people who would refuse to use a given network because it is inconveniently secure compare to the numbers of people who would start using it if was no longer inconveniently insecure?
Takahashi Rumiko made beats! DON, taku, DON, taku. . .
Slashdot doesn't use or require SSL logins???
I'll have Taco's balls for this!!!! Yes siree!
Hey Taco, instead of constantly fiddling with the lameness filter and the moderation system, how about implementing basic security. Either that, or you could go home to Kathleen. [shudder]
Lameness filter encountered. Post aborted!
Reason: Your subject looks too much like ascii art.
Post above is copied from one made months ago by a different poster. Please mod accordingly.
Sure its nice to have SSL, but 90% of breakins are due to compromised email accounts, especially hotmail (where to change a password you just need a correct response to a user-generated question like "What is my favorite color"). Not to mention hotmail's past reputation with security issues.
The user is always the weakest link, the'll click/run on anything that looks tempting, and its going to take a buttload more than SSL to protect against that.
What's Reza up to these days? Judging by her photos, I'd say 600lbs!
HAW! HAW! HAW!
Parent is linking to same post in order to confuse moderators.
The question is: how do you talk her into it?
I know some of you slashdotters have "done the nasty" with your dear sis. Don't hold back. How did you do it?
I clicked on the story reference and after 10 or so irritating cookie alerts told my browser to put the referenced host onto the unconditional cookie reject list.
Referenced story looks bona fide.
WTF?
I've heard the rate at which people who commit identity theft get caught is around 1 in 7000.
So you have a much better than 99.9% chance to just do it to your heart's content and walk away with the money. That's pretty freakin' scary. A crime where you never have to see your victims, never have to face any consequences, and make tons of money. Can you imagine what would happen if a misguided Robin Hood decided to popularize the techniques and teach them to America's poor? Would the entire banking industry collapse at once? With a million people doing it simultaneously you would obviously overload the already overloaded investigative ability of the gov't and probably change the ration to 1 in 100,000 getting caught.
Money is just a piss poor patch (at best) to the
problem of people just not being able to get along
with eachother.
instead of protecting their inf..
the real threat to yOUR social system is the constaNT suck of the endlessly needy corepirate nazi marketeering execrable, if you don't couNT the georgewellian fuddite debt & disruption machines.
both 'institutions' fail miserably, & sadly enough, voluntarily, in the area of protection of personal information, unless it is their own, & even then, they just fail buy ineptitude.
consult with yOUR creators... that's it. you are entitled to some privacy. it's a huge planet.
Citibank provides disposable CC numbers for one time use only, or for use with only one merchant (i.e. subscription).
You log on to their web site with your account info and gener... Oh, wait...
Seriously, it's already been pointed out once that this post was blatantly plagiarised from an earlier one. Why are people STILL modding this regurgitated crap up?
It's never late. Getting working site under SSL is 2 hours to 2 days work. I did it few times and never had any serious performance problems.
And if performance is still a problem, isn't reasonable to consider a web-hosting? If application is done one anything that a web-hosting company can run (Perl, Java, ASP, even Zope) then both performance and SSL are even less problem - most of hosting companies provide SSL and have no performance problems. The thumb rule is: if you don't know how to do the job right - give it to people who know the drill.
Less is more !
On the other hand, I tend to think people who live through their on-line journal / blog need to find a real life.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
I'm Brad Fitzpatrick, from LiveJournal.
The reporter who talked to me obviously wanted a fun slant for her article: "Look at all this insecure crap out there!"
Things we talked about that she decided to ignore in her article:
-- we've been working on challenge/response logins in JavaScript so passwords don't go in the clear. it's like Digest auth but in JS instead. We had this working when we talked to her, and since then it's gone into final user testing on our public test site. it'll probably go live this weekend. (I remember when I talked to her I compared it to HTTP Digest Auth and I had to explain what Digest auth was to her..... this is a _security_ reporter?)
-- we never said SSL wasn't important or security wasn't a priority. we told her it HAS BEEN a priority, but performance stuff keeps getting in the way. in fact, we have SSL stuff working and it's going live at the same time as the challenge/response logins. we just told her that it's hard to do right when you have a shitload of servers.
-- we let users bind their login session to their IP, so damage from cookie theft over non-SSL is mitigated
-- we don't let users do any major action (like, oh, change the account's password) without the original password.
-- we have no many anti-hijacking measures in place to let owners of accounts restore their stolen accounts. and you know what? it's not because of SSL... it's because of people just people plain dumb/trusting/gullible. SSL isn't a magic security wand.
Anyway, please recognize an article on a security site wants a "security's terrible!" slant. Who wants to read an article saying, "Yup, security's pretty good and improving." The security situation isn't as grim as it's made out to be.
To this day, I can not figure out how to change your eBay password over an SSL connection. Sure, you can login via SSL, but you can't send you new password over SSL.
This kind of defeats the purpose of using SSL. Once it's sent in plaintext, it's not secure.
So fucking what?!
Are you so hung up on the concept of karma that you can't stand the idea of someone gaining it?
Fuck you. The post is ON TOPIC and INSIGHTFUL. It doesn't matter if it was or was not original.
It is YOU who should be modded down. Asshole.
While taking a physics class at the University of Michigan, I was required to sign up for an "online homework" website. It was 30 some dollars, and was considered homework for the class (i.e. you take the class, you sign up and pay).
Sure enough, their Terms of Service require me to prevent others from obtaining my login/password. It goes on to say that if someone steals it, there is basically no way to reverse their actions.
Fine. Except for the fact that after signing up, they immediately e-mail me my password in plaintext. There's no SSL whatsoever on the site, and no way whatsoever to change my password.
After e-mailing the company involved, I was simply informed that the site will not be changed. I complained to both the professor and the University. Apparently no one pays attention to this, or they just don't care enough to do something about it. What else can I do? (besides leave the University, obviously)
Lesson 1: no-one likes a smart-alec.
Lesson 2: no-one likes the person who points out faults in their system.
Lesson 3: no one is interested in the truth/optimal performance.
Lesson 4: EVERYTHING IS ABOUT POLITICS (this is the capital rule).
So please, for your own sake, shut the fuck up and kiss the dean's ass (or donate big bucks) if you wish to accomplish something.
Oh well... Bruce Schneier's old but well written doc always comes to mind when thinking of this topic: "Ten Risks of PKI: What You're not Being Told about Public Key Infrastructure By Carl Ellison and Bruce Schneier
Computer security has been victim of the "year of the..." syndrome. First it was firewalls, then intrusion detection systems, then VPNs, and now certification authorities (CAs) and public-key infrastructure (PKI). "If you only buy X," the sales pitch goes, "then you will be secure." But reality is never that simple, and that is especially true with PKI. (source)
Most people like fast content and often overlook security. Hell eBay out of all sites, billions in transactions, and SSL is an option! How sickening is that.
MoFscker
Being a copy isn't a bad thing in itself. Copying someone else's post and re-posting it as your own is plagiarism. I think most most people on Slashdot would agree THAT is a bad thing.
I generally like the options for moderating on Slashdot, but we really need a -1 Plagiarism moderation for posts like the parent. The parent post as well as several others under this article are being copied from a previous Slashdot article on identity theft. These accounts will be used for trolling at Score:2 later on if people keep modding them up.
THAT's pathetic.
I will keep modding these guys up because they are not offtopic, trolls or flamebaits.
Dr Howard Dean
Feeding trolls is bad.
If this is a plagiarized post, then nuke-mod him. Still, a plagiarized about identity thief is mildly funny, and certainly ironic.
One line blog. I hear that they're called Twitters now.
as they have a SSL certificate, they just 302 you instead of processing the login then 302 you
but i guess programmers know best right ?
Funny, both those documents said the user's client would display a big red warning saying: "HEY DUMBASS, THERE IS SOMETHING WRONG WITH THE SERVER'S KEY." It isn't the protocol's problem if the user doesn't understand basic security and will ignore warnings.
So because one crappy browser has a bug which may potentially be exploited, we should forget about using SSL for security? Whatever you say.
BTW, I check the cert every time I log into an important site, though an IE bug won't affect me because I use that other crappy dragon browser (for HTTPS anyway, I use Dillo for most everything else.)
I don't know what the AC's problem was (Troll? LJ is just a blog site, and the article even said the main problem was users giving away their passwords), but it is stupid to say some javascript code is as secure as SLL. Especially using windows troll logic--"there is a potential hole in X, so it negates the tonnes of glaring holes in my favorite Y. Y is clearly better." It may be more secure than nothing, but don't just make crap up.
Maybe you should've pointed out Master Fitzpatrick already said he was working on it and asked the AC troll why it wanted to break into 14 year old girl's blog accounts anyway. ;-)
it's copying.
Ben
Work Safe Porn
I'm a little wary of some of these social network tools, because social network information is incredibly valuable & sensitive. Putting my info onto Friendster seems like yielding too much of my privacy, and I guess I also don't see the payoff. In direct personal relationships, my liability is limited both in scope and in time. If I meet a vicious sociopath, there's only so much he can do, he can pretty much only get me without a lot more work, and I'm mostly vulnerable to him only when I'm nearby.
Now let's say some bad guy gets the Friendster data. How hard can that be, considering how poor data protection in general is? The marvelous thing about data security is that once the data is loose, it could go anywhere. After all information wants to be distributed on SPAM CDs.
The bad guy could be a blackmailer, or perhaps just a law & order type who believes in guilt by association, or a politician and suddenly one of my friends is on an enemies list.
It was horrifying when we heard that the Colombian cartels were getting telco records, and murdering people based on them. This is similarly sensitive information.
One friend suggested that I join up anonymously if I was uncomfortable with the privacy issues of Friendster. Unfortunately, I've still compromised the privacy of everyone else on my list, and anyone who was interested could fairly easily interpolate my identity based on all the other data that is valid. That's a side effect of one of the coolest things about Friendster. People can fake accounts, but it has little effect, because the fakes won't go anywhere much.
Sure, probably nobody will come looking for me, but I lock my doors at night anyway.
I do know people who wouldn't have gotten certain jobs if their network of friends was known.
Assembly is the reverse of disassembly.
I can tell you why banks want ID for their customers, even for a checking account.
Last year, someone opened two checking accounts using my name: one in Cyprus and one in Germany. Then they broke into my E*TRADE account and wired all the money from "me@etrade" to "me@bank-of-cyprus" and "me@some-german-bank".
E*TRADE got all the money back but it sure ruined my month. And now I have instructions on all my bank and brokerage accounts: "no outgoing wire transfers. Ever."
The point is that a bank account accepts deposit and wire transfers, which the bank then acts to collect on behalf of the customer. That's why banks want proof of identity just to open an account.
... the empty set!
YourReputation.com (https://www.yourreputation.com) is another real-world social network type of site that doesn't have such flaws. It uses SSL for its logins, and third-party, commercial-grade identity verification before people can post. We believe this is the type of service all social network sites should switch to, to protect their userbase.
Show your love for the Hacker community
HackerLogo.com
Anyone who cares about security should setup their own site for their community and close it down and have it use SSL. This way it's also not such a big strain on CPU as this is only for a few people.
In addition you set the policy and shouldn't let anyone else in, so your posts can't be leaked. (Though you should be prepared for it, as anything that is on an internet-connected device has to be considered in-danger)
In addition I'm still not sure why people and businesses still use _unsigned_ and _unencrypted_ mails. If mails would be signed from the merchant or journal site it would be much easier to catch fake mails! How hard can it be?
Consider the fact that its just as easy to get such sensitive information by installing spy cam or hidden microphone in your home, through your friends, etc with or without SSL.
Online or offline, there's always a trade-off between convenience and security and these sites are no exception. SSL tends to be slower because it requires more round trips between the server and client, much more processing power, etc and sites know that performance affects their popularity.
The rule of thumb should be: get informed about how easy it is for someone to hijack information you put on any social networking site and and don't put it there if you think someone may be sufficiently motivated to do so in your own case.
One thing social networking sites can do is provide higher security, including SSL, to those that need it and perhaps charge them more. Besides the free e-mail providers like Yahoo and Hotmail have a similar problem to solve on a much larger scale!
Jean-Luc Vaillant, VP Engineering, LinkedIn