Man Mines Facebook For Security Questions, Nabs Nude Photos From Email

itwbennett writes "George Bronk, 23, has pleaded guilty to charges that he broke into the e-mail accounts of thousands of women, scouring them for nude photos that he then posted to the Internet. How he did it: He searched his victims' Facebook pages for answers to common security questions and then logged in to their e-mail accounts. In one case he persuaded a victim to send him even more explicit photographs by threatening to post the ones he'd stolen if she didn't. Bronk faces 6 years in prison on felony hacking, child pornography and identity theft charges."

Comments

Obligatory

[Anonymous Coward]

Pics or it didn't happen

Re:Obligatory

[ian_from_brisbane]

Pics or it didn't happen

Here you go... http://www.msnbc.msn.com/id/41082627/ns/technology_and_science-security/

Re:Obligatory

[macraig]

Not THAT one! My eyes, my EYES!

All I can say is

[drinkypoo]

Torrent?

(ObDisclaimer: No, I don't want to receive child porn.)

Think of the children too

[Anonymous Coward]

Well, I sure hope all of the girls who took pictures of themselves got child pornography charges against them too.

Re:Think of the children too

[Anonymous Coward]

Well, I sure hope all of the girls who took pictures of themselves got child pornography charges against them too.

Why would you hope that? Are you yourself into hacking computers, and hoping that some victims would be afraid to be witnesses against you in a court? I cannot imagine any other reason.

That is what has happened in past. Kids taking photos of themselves and sending them out to other kids of own age were charged with CP. The poster is being sarcastic.

Re:Think of the children too

[crow_t_robot]

No, because producing child pornography and distributing it on the internet is producing child pornography and distributing it on the internet. If a 16 year old girl sends a picture of her tits to your phone you are now in possession of child pornography and in direct danger of having your life destroyed and everyone you know hating you.

This is akin to weaponry. This shit needs to stop.

Re:Think of the children too

[Anonymous Coward]

Because he doesn't believe in stupid "think of the children" bullshit, perhaps?
These kids are breaking anti child porn laws as much as he was, and should be punished just as equally for them.

I don't give a damn if they are 8, or 16, facts are, they took pictures of themselves in an illegal manor and were distributing them.
If he gets punished, they should get punished.
Ignorance of the law is no excuse, neither is the innocence of childhood an excuse, children are innocent and regularly abuse their position in law. (from reckless endangerment to rape, it happens and it is wrong)

Re:Think of the children too

[CAIMLAS]

You have very little imagination.

Girls have boyfriends. They also have female friends. They are not solely keeping these pictures on their hard drives and cameras for personal use (more than likely).

Funny thing about pictures on the Internet: they're trivially copied. Boyfriend copies the picture to his friends (or just one friend), or posts it to a forum: the picture is out, and will live forever on hundreds of 'porn agregators' (lacking a better term), presuming the girl isn't a skag. Likewise, girls are/can be catty: what's stopping them from spreading the nude pictures in a bitter attempt at becoming more popular themselves (thinking it would ridicule the origin)? We're talking about virally social teens, here, not top secret data on government networks: there's literally a thousand and one ways for such pictures to spread to the Internet At Large.

So, in short: it's entirely possible that hundreds of thousands of men and women have viewed, downloaded, etc. child porn and not even be aware of the fact that it is child porn, simply on the basis of "some women look like children and some girls look like women". I recall a couple girls in high school who looked significantly older than 16-18 - and no, I'm not just talking about curves (though that applies too).

It's just like "honest, I thought she was 18, officer!" scenario, except the evidence never disappears and the so-called 'victim' can never grant consent. I would not be surprised if there is legal child porn floating about the internet right now, on "valid" sites which the US federal law enforcement agencies knows about, but allow to exist -so that they can use it as an added charge for someone down the line, if they ned something to vilify them further/want to make sure the charges stick.

Re:Think of the children too

[Dunbal]

No I think OP was referring to the notion of a fair and balanced justice system that applied the law to everyone instead of the one we have now which consists of "lets throw everything we can dream up at the guy and see what sticks".

After all, it wouldn't be the first time a teenage girl was accused of child pornography for taking pictures of herself and posting them online. Not that I agree with THAT one, either.

Re:Think of the children too

[Anonymous Coward]

Pictures of naked people should not be classified as porn simply because of the lack of clothes.

Re:Think of the children too

[Starfleet Command]

>>>they took pictures of themselves in an illegal manor Perhaps if they had photographed themselves in a chalet, or perhaps even a brownstone walk-up?

Re:Think of the children too

[freedumb2000]

You are kidding, right?

Re:Think of the children too

[Anonymous Coward]

16 year olds are not children. That is the most insane part of all of this. Naked pictures of 6 year olds on your phone, sure, those are children at least. A 16 year old is most definitely not a child though.

Re:Think of the children too

[Anonymous Coward]

You keep using the word "children" when talking about 16-18 year olds. I do not think this word means what you think it means.

Re:Think of the children too

[TFAFalcon]

No, but it might cause enough outrage to get the laws changed. As long as teenagers can be prosecuted for taking pictures of themselves, there is something seriously wrong.

Re:Think of the children too

[the_womble]

Congratulations! You think the right way to be a politician! You must punish people to protect them from themselves!

Re:Think of the children too

[Tanktalus]

Legally speaking, 16 and 17 are children. When talking about the law, we have to use legal definitions. Full stop.

Re:Think of the children too

[martas]

Give up hope now, save yourself a bunch of turmoil. It won't stop, simply because laws on topics like CP tend to be more powerful than the lawmakers themselves. At this point, I doubt anyone has the political arsenal necessary to "stop this shit."

Re:Think of the children too

[Pharmboy]

Pictures of naked people should not be classified as porn simply because of the lack of clothes.

If God® wanted you naked, he would have made you born that way.

Re:Think of the children too

[Shikaku]

What happens when you turn 18 that magically makes you an adult?

Re:Think of the children too

[Eightbitgnosis]

Ummm, blackmailing a 15 year old for pictures of her bush is in no way equal to her taking those pictures of her own free will

Re:Think of the children too

[Anonymous Coward]

RTFA linked to in TFA. If you go a little further, you'll read that authorities found CP on his computer that appears to be unrelated to the hacking.

Re:Think of the children too

[rwa2]

Um, you have to register with the selective service so they can decide to throw your ass in a war? Something like that.

You're innocent until you're old enough to vote and (legally) kill people.

Re:Think of the children too

[Rockoon]

It becomes legal to look at your boobies

Re:Think of the children too

[Grimbleton]

Only if you have a penis.

Re:Think of the children too

[milkmage]

same thing that makes you a responsible drinker at 21

Re:Think of the children too

[Schadrach]

Actually, legalize possession of child porn, and step up the penalties for production (or just for child abuse, since using a child to produce child pornography is itself abuse) and purchase/sale. That removes the "weaponry" portion of child porn (if I send you a CP picture, you have committed a crime is a *bad* thing) and makes those who receive such pictures accidentally (mislabeled P2P files, for example) or against their will (as in the sending a picture to your phone example) more willing to openly provide them to authorities as a way to help the producers get caught, as well as making being involved in the financial promotion of the production of child pornography still a crime.

Re:Think of the children too

[rwa2]

Well, vaginas got to vote in the US with the 19th Amendment in 1920, but yeah, point taken ;)

But they can still join the military at 18 (17 with parental consent... hmm, maybe that's the ticket for "underage" porn as well...)

Anyway, car insurance companies don't trust anyone's decision making abilities until they hit 25, so I wouldn't be surprised if the age of consent keeps rising :P

Re:Think of the children too

[Schadrach]

Interestingly enough, I've actually met a "slutty little girl" as you described it. She was a friend of one of my nieces several years ago. Girl was ~10, and was....precocious and direct. Very, very, direct regarding what men she found attractive and exactly what she wanted from them (or more specifically wanted them to do to her). It was actually really creepy. She moved a couple months after her and my niece started hanging out though, so I don't know what happened to her in the long run, or any real details as to her background.

I'd never found a girl coming on to someone quite so disturbing though, before or since.

Re:Think of the children too

[witherstaff]

They're children unless they're being prosecuted, then they're usually adults. I don't get that double standard.

Re:Think of the children too

[Grimbleton]

I meant this, actually: "Um, you have to register with the selective service so they can decide to throw your ass in a war"

Speaking of car insurance, I turn 25 in April, my fiancee (also on my plan) turns 25 in March, our renewal is next month for the policy, and we just dropped $20/month on our rates. I hope it's a continuous trend.

Re:Think of the children too

[Anonymous Coward]

If they get charged for production of child pornography for cell phone/mirror naked self shots, they should be charged as adults. That would teach them a lot about our legal system!

Re:Think of the children too

[wumpus188]

in this case, shouldn't 16 year old girl's life be destroyed instead, because it is she who is producing and distributing child pornography on the internet?

Re:Think of the children too

[Hopium]

Why dont you you take a seat over here Mr.Schadrach. I'll get ya a towel... ~ C.Hansen

Re:Think of the children too

[Lord Kano]

Actually, legalize possession of child porn, and step up the penalties for production (or just for child abuse, since using a child to produce child pornography is itself abuse) and purchase/sale. That removes the "weaponry" portion of child porn (if I send you a CP picture, you have committed a crime is a *bad* thing) and makes those who receive such pictures accidentally (mislabeled P2P files, for example) or against their will (as in the sending a picture to your phone example) more willing to openly provide them to authorities as a way to help the producers get caught, as well as making being involved in the financial promotion of the production of child pornography still a crime.

Back in the early 90s, before the explosion of the web, I used to use AOL. I used to trade in pictures of naked women. Some guys used to send out pictures of their wives. I was 18-19 years old and had no interest in 35-40 year old housewives. I asked one guy if he had anything of someone "younger". Apparently that's a keyword for child porn. Next thing I knew I was getting inboxes full of the stuff, this was also back in the days before broadband so I had some people that I used to automatically share anything I got with before I downloaded it myself. On the first inboxing, I forwarded all of the contents to some of my trading partners. And THEN I downloaded the pictures and saw things that no normal person should ever have to see.

I deleted the jpgs and gifs from my computer, deleted the emails from my inbox, and at that time AOL allowed you to unsend an email if it had not been read. I believe that I was able to unsend them all, but if I hadn't been, I shudder to think of the things I could have been charged with. All because I wanted to see naked 18-24 year old girls...

LK

Re:Think of the children too

[Anonymous Coward]

It's a US thing. Over there:
- You're presumed innocent until proven guilty. Except for terrorism, in which case the rule is "If you were innocent, you wouldn't be a suspect".
- Sexual assault is a horrendous crime. Except if the perpetrator is wearing a TSA uniform.
- The Constitution stops the government from abusing it's authority and power. But only as long as the government agrees.
- Infringing copyright on music steals copyright holders of thousands of dollars. Except for the music industry, they only steal 60 cents per song from artists.
- Child Porn is illegal in order to protect victims of child abuse. Unless if children willingly make and send pictures of themselves, in this case they're not victims but vicious pedophiles. So vicious, they abuse themselves!
- You're too young to drink beer at 21 but you're old enough to die for your country.

Re:Think of the children too

[Anonymous Coward]

The reality here is that these are consenting girls taking pictures of themselves, and volunteering them to people, even without being asked. Sexting is getting bigger and bigger in schools, and the perpetrators are more often the girls, who hit puberty earlier than the boys.

Re:Think of the children too

[JWSmythe]

    Depending on the level of detailed dialogue you are describing, she may have been a victim of sexual abuse. They may have rationalized that the sexual abuse has positive results. For example, a bad adult does sexual acts, and then rewards the child. The child may associate the act with the result, and try to initiate the act with others for similar rewards.

    Most 10 year olds can't carry on an unsupported dialogue of sexual matters. For most (and yes, the average have has been growing younger), they simply have no interest. For others, they've had no exposure. Most (but not all) parents keep their children away from what they perceive as dangers for the childs development, which includes movie violence and sexuality. If the dialogue was beyond what you may see in a R or NC17 movie, you should consider that there is something pretty serious going on. Talk to a professional about it. Ask the simple questions, "This happened. Should I notify someone?" If you have school age children, a call to the schools child psychologist may be helpful, or your local child protective services. The child protective services call may start unwanted actions, but if there is something bad going on, they should definitely be involved.

    Most importantly, don't be involved. It's not up to you to investigate such things. Besides tainting evidence, being too involved can be bad for your health (i.e., the bad adult may seek to silence you). Leave investigations up to the experts. For the sake of your safety and mental health, it's better to give the anonymous tip, than to become a witness. If you get too involved, you may become a suspect, rather than just a witness.

Re:Think of the children too

[tragedy]

And there's absolutely nothing new about this behavior, it's as old as taboos against nudity. I'll show you mine if you show me yours. The difference now is that it's being done more and more via electronic devices with the bizarre consequence that acts which would otherwise be perfectly legal without the electronic image producing middleman become life-destroying felonies.

Re:Think of the children too

[Pentium100]

Well, even if I leave my car with the keys in the ignition, it's illegal to use it without my permission.

OTOH, if I ever left the keys in and my car got stolen, I would be considered an idiot by almost everyone.

Re:Think of the children too

[bennomatic]

Of course, sometimes things can be misinterpreted. When I was in college, my girlfriend and I took a day off to help out her mother, who was a kindergarten teacher. We spent the morning reading to and playing with the little ones, and during the art part of the day, one little girl decided to confide in me that she and her father "do a secret dance when mommy goes to work."

As you suggest above, I knew it wasn't my place to investigate, but that sounded pretty serious, so I told my GF's mother, who immediately went to the principal and school counselor, and they took the girl out to question her right away.

In the retelling later, my GFM said that the little girl clammed right up, refused to talk, until finally, out of exasperation, she explained that her mother is a dancer at a club, and doesn't want her little girl to follow her career path, so she forbids her to dance. At all. But she (the little one) loves to dance, so as soon as mommy goes to work in the evenings, she and daddy put on a record and dance all over the house. Clothes on, no touching.

I was soooo relieved to hear that it was nothing.

Re:Think of the children too

[black6host]

"Choose the more obscure questions that only you and your family know the answers to."

Or better yet, use an answer that is totally unrelated to any of the security questions. If one of the security questions is: "what high school did you attend?" a good answer would be aZ333addkwe467. Just need to keep track of it like you do your passwords. These things are usually only used when you forget your password, or as in this case, someone is trying to gain access to your account. Since you rarely would need to know the answer I don't think there would be too much hassle is saving them in a safe place (not on your computer) and should you need the answer you'll have it. Meanwhile everyone else is typing in "James Monroe" because that is what is on your Facebook page. Note: I don't even use Facebook and I don't put personal information like that on websites. My wife, who is much younger, does like Facebook but she knows not to enter personal info such as "hey, going on vacation for two weeks tomorrow" or other personal info like that either. Further, she is not allowed to post anything about me, anywhere. Paranoia? Might have been thought so at one point but I think another article today speaks of Facebook making personal info available to developers. If they can get it, anyone can.

Re:Think of the children too

[JWSmythe]

    There are plenty of misunderstandings with children. Years ago, someone I was dating had a son who was about 5 at the time. He refused to take a bath without help. The "help" was standing there waiting for him to wash up. Lots of "wash your face", "no really, wash your face", "wash your hair ... with shampoo this time". The door was opened the whole time, and mom could hear exactly what was happening. I wasn't entertained by it. I had better things to do, like flirt with mom. :)

    Around the time he was 13, he mentioned that he didn't know why, but I used to give him his bath. Luckily, mom heard him say it, and explained what happened. We laughed about it, but saw how it could be taken completely wrong. Ya, I'd rather not get in trouble for a kid remembering something wrong.

    The previous message, as I understood it, was saying that the 10 year old girl was asking for explicit sex acts. That is out of character for any 10 year old child, unless they were exposed to something very wrong.

Re:Think of the children too

[sumdumass]

Right, and if God wanted us to fly, he would have gave us wings instead of the ability to create them and make flying machines we can fit into.

Re:Think of the children too

[Golddess]

and step up the penalties for production (or just for child abuse, since using a child to produce child pornography is itself abuse) and purchase/sale.

I think you missed that part. GP never said legalize it completely, just decriminalize simple possession of it.

Re:Think of the children too

[Anonymous Coward]

What you said:

Actually, legalize possession of child porn, and step up the penalties for production (or just for child abuse, since using a child to produce child pornography is itself abuse) and purchase/sale.

What every politician and journalist in America would hear:

... legalize ... child abuse ...

Sorry, but no penalty is going to be reduced. The only changes that are ever going to happen in the forseeable future will be increased penalties for whichever specific things are involved in the next few child abuse cases to hit the news. (Oh, you possessed child porn that was produced using a smartphone? That means you get an extra fifty years in jail, because clearly that's more of a deterrent than the 490 years you were already going to get.)

We are no more able to have a rational and objective debate about child pornography than McCarthy was about communism, or the citizens of Salem about witchcraft. This is our generation's moral panic and it is not going to die until we do, so you'd better get used to it.

Re:Think of the children too

[SwampChicken]

Right, cause if god gave us the ability to create flying machines we can fit into, then the reason why there wasn't a F-14D Tomcat parked in the shade of an apple tree in the garden of eden was because...?

Re:Think of the children too

[sumdumass]

Most likely because it wasn't invented yet and it wasn't called that yet.

Besides, how do you know there wasn't one parked in the shade of an apple tree? Just because the books didn't talk about it doesn't mean it wasn't so.. Well outside the obvious of when it was invented.

Actually, do you have a point somewhere that I missed?

Re:Think of the children too

[Archangel Michael]

For the sake of your safety and mental health, it's better to give the anonymous tip, than to become a witness. If you get too involved, you may become a suspect, rather than just a witness.

This is why our society is going to hell in a handbasket. Chickenshit pussies afraid of the boogie man of bad people might do something bad.

If you're a real man, stand up and be counted. Real men will protect the innocent and defenseless with everything they have, including their life. I know I would.

I have no room for child predators (real ones), nor pussies that hide behind self preservation at the expense of taking one off the streets.

Re:Think of the children too

[aug24]

There's a superb sketch by Not The Nine O''Clock News showing a boy and a girl sitting in a steamed up car. A cop knock on the window. It's would down, revealing the boy, still dressed, and the girl, still dressed and knitting. Cop says "Excuse me sir, is this young lady 16*?". Boy looks at his watch and replies "Not for another 15 minutes".

Just.

*Age of consent, UK.

Re:Think of the children too

[m50d]

Even if you require "porn" to be more explicitly sexual, the basic problem remains: a 16-year-old girl can still send such a picture to your phone and thus destroy your life.

Re:Think of the children too

[LordSnooty]

In my country you can join the hired killers with your parents' consent at 16... but you can't vote against the political party which sends you on an unwinnable war until you are 18...

Re:Think of the children too

[Anonymous Coward]

Of course, sometimes things can be misinterpreted.

So, you risked destroying somebody's life because you are all-too-willing to see evil in a person and opened your fat mouth? I don't think you appreciate the gravity of even being Accused of something like that. You are tried in the court of public opinion, and there is never a Not Guilty verdict, thanks to paranoid assholes like yourself. 'But, think of the children!' you say, as though it justifies your intrusion into privacy and flirting with disaster.

What if the little girl had been told it was an absolute secret and Daddy will get in trouble if she tells? What if she had never told? How many YEARS would it have taken out of peoples' lives to work out that nothing had happened, nothing was going on. All because you 'misinterpreted' something a child said, laughably, because under normal circumstances nobody takes a single thing a child says seriously because gosh, they are children.

Show a little decorum when treading on peoples' lives, man.

Re:Think of the children too

[DaVince21]

Where can I find this manor?

Just kidding. I'm not a child molester. Honest!

Re:Think of the children too

[Longboy]

The next thing that you know, someone will suggest that pot be legalized! Where will it stop? What has happened to our sense of morality? Of our God-given right - nay, our duty! - to police the acts of other people, precisely those cases in which the person accused has done nothing more than to be in the wrong place at the wrong time? OTOH, if you're the kind of simple fool who responds positively to "How about sending me a picture of you giving head?", then, you're kind of asking for it.

Re:Think of the children too

[bkpark]

If God® wanted you naked, he would have made you born that way.

So ... he wants us covered in blood?

Re:Think of the children too

[rdnetto]

This is our generation's moral panic and it is not going to die until we do, so you'd better get used to it.

OK, we've found a solution. Now on to planning...

Re:Think of the children too

[Schadrach]

There's two issues, really, which combined are why I said to legalize simple possession.

One of them is what you noted -- there's a lot of "technical" child porn out there like Traci Lords.

The other is that under current laws, if you can anonymize yourself well enough (or aren't concerned with being arrested alongside your target), you can technically wield child porn as a weapon. Accidental (as in things like mislabeled P2P files) or forced (as in, let me e-mail/send to your phone this picture now you've committed a felony!) possession of CP is still possession.

Are you suggesting that young people horribly rape and victimize themselves, or harping on the "16y/o photographs her own tits" cases? Honestly, I don't know what to do about the latter, maybe set a lower than 18 cutoff for self produced media? Or throw distribution in with production, purchase, and sale?

Or do you have a better solution that still prevents CP from being "weaponized"?

Re:Think of the children too

[bennomatic]

Funny that the AC thinks that it's better to do nothing in this scenario. I fear for your children, sad, lonely little man.

Security Questions Security Risk

[Anonymous Coward]

That's why my answer to those security questions is always 30-50 randomly selected characters.

What's your mother's maiden name? - kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna

Re:Security Questions Security Risk

[Haedrian]

"What's your mother's maiden name? - kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna"

But everyone calls her bob.

Joking aside, I did that once for my steam account. Then I forgot the password, when I came to reset it it demanded my secret answer. Couldn't remember it. :(

Re:Security Questions Security Risk

[peragrin]

So you just have to use the same random name. mines qwertyuiop or was it asdfghjkl

Re:Security Questions Security Risk

[Dunbal]

No asdfghjkl is your dad, idiot.

Re:Security Questions Security Risk

[Winckle]

You can contact valve and scan a couple of CD keys to prove it's your account I think.

Re:Security Questions Security Risk

[Lalakis]

I can't believe that no one blames the online services for requiring and using security questions as a security measure(!). This is such an insecure practice that I'm just baffled from the so much widespread use of it!
  Theoretically, security questions could be used as an ADDED security measure and be marginally effective at that, but in most times you can't know exactly how your answer will be used, so the sane response would be something like kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna.

Re:Security Questions Security Risk

[Mathinker]

Why not try using the Linux/Cygwin command line?

  echo "mother's maiden name" | md5sum | sha1sum

If you want to be fancy:

  (echo -n "string1" ; echo "string2" | md5sum) | sha1sum

(P.S. For anyone foolish enough to think otherwise, I personally use a more sophisticated Python script for this, don't waste your time trying to break into my email using this "information".)

Re:Security Questions Security Risk

[Opportunist]

How do you do that if everything on your steam account is bought through steam?

Re:Security Questions Security Risk

[Winckle]

Well that's just one method I know of, there may be others.

Re:Security Questions Security Risk

[jecblackpepper]

Or you could use a proper unique password for each security question and store it in KeePass against the site (oblig BBC: other password storage tools are available)

Re:Security Questions Security Risk

[TheLink]

The attackers will still succeed in targeting the sheep who will give the obvious answers to such "security" questions.

Worse - some sites have security questions that require a drop-down selection box for the security answers! Yep, only a few limited answers. DailyWTF contenders.

Re:Security Questions Security Risk

[jecblackpepper]

Of course though when you use 'doofus' on site A and on site B as the answer to your favourite colour, a hacker that gets access to the details from site B could guess that you used the same on site A. This becomes particularly an issue when you use the same 'security information' and password over many different sites, you just need one to be compromised and you suddenly leave yourself open to attack on other sites; you know that site that stores the info in plain text - because the developer thought hey it's a pretty simple site and we store no sensitive information that could be compromised right and it's much easier for our customer services department to have direct access to the question's answers to help deal with our customer's enquiries.

Re:Security Questions Security Risk

[Chelloveck]

Theoretically, security questions could be used as an ADDED security measure and be marginally effective at that, but in most times you can't know exactly how your answer will be used, so the sane response would be something like kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna.

Hey! How did you know my response?!

Seriously, when I'm required to give an answer to one of these I just use my regular password generator to create another password for the site, then use that. "What was your first pet's name?" "w8ZRjkynm18ZVL9RWVhK" I don't think that's going to be cracked any time soon.

The whole idea is pretty stupid, though.

Re:Security Questions Security Risk

[couchslug]

"What's your mother's maiden name? - kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna"

My mother's maiden name IS kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna, you insensitive clod!

Re:Security Questions Security Risk

[ildon]

I've actually misspelled my non-crazy secret question before. The first time I needed to use it to verify the account was over the phone, so I didn't even know it was spelled wrong (and apparently, neither did the customer service girl). The second time, it took me like 4 attempt to realize that maybe I'd spelled it wrong (it was a word I knew that I sometimes spelled wrong).

Now I like to pretend I did it on purpose as an added layer of security!

Re:Security Questions Security Risk

[noidentity]

If security questions are used in addition to a password, then it's merely as if you used a longer password. I thought that their purpose was always an alternate means of access, in case you forget your password. The idea is that you know the answers without having to memorize them. Thus, this usage always decreases security, since it provides an additional way to access your account.

Re:Security Questions Security Risk

[mjwx]

(P.S. For anyone foolish enough to think otherwise, I personally use a more sophisticated Python script for this, don't waste your time trying to break into my email using this "information".)

I just use a "secret answer" completely unrelated to the question.

Re:Security Questions Security Risk

[Alsee]

What's your mother's maiden name? - kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna

Whoa, freaky! That's the combination on my luggage!

-

Re:Security Questions Security Risk

[jayme0227]

Indeed I used to enter random birthdates on sites that sold my information. Now I've noticed more and more places use birthdate as a security question.

Re:Security Questions Security Risk

[Haedrian]

Probably the silliest security question ever.

My workmates had sent me a birthday card, so I guess that's a bunch of people who can compromise my account.

Re:Security Questions Security Risk

[T.E.D.]

I always answer mine with a *wrong* answer, that is wrong in a way I will remember.

Re:Security Questions Security Risk

[Mathinker]

Better than typing the real answer, but weak because you are reusing the same password (which is probably sent to the website in cleartext, not hashed) between different resources, any one of which might expose it (via an unscrupulous employee, for example).

With my suggestion, one can merely prefix the answer string with the name of the resource before hashing, and voila, every web site has a unique secret answer.

Re:Security Questions Security Risk

[mjwx]

Better than typing the real answer, but weak because you are reusing the same password

To be fair, yes that is true for most users. Password reuse for me is not an issue, you're making an assumption that I do reuse the same password.

But a script that randomly generates a password is no better. Good security with passwords is a balance between password strength and password usability. Obviously your solution is on the extreme end of usable, most people would find that far too onerous. I've got several machines, not all of them are going to have that script available and chances are, when I need that secret answer I wont be anywhere near my main Linux box.

Basically we could keep adding security, but then a product or procedure becomes unusable and people start looking for a less secure alternative, so really what is the point. Efforts would better be spent in educating people about good security habits like password reuse and how to avoid it. Most sites these days use email as a form of password recovery, so even if they have a "secret question" they still send an email to your account to get your password reset. Really we should be discouraging the use of secret questions as a method of password recovery. Gmail has my mobile phone no. and my bank requires me to call them to get my password reset.

Re:Security Questions Security Risk

[Mathinker]

My apologies, I misunderstood your use of "a" in "a secret answer" to mean "always the same one".

To be honest, I also don't always bother to generate strong security question answers, it certainly depends on how important is the resource being protected.

Article in summary redirects

[Grimbleton]

To a blogspot blog.

Re:Article in summary redirects

[mountaineer76]

yeh, I got that too, re-directs immediately to a blog about some insurance company. Here's the printable link which doesn't redirect: http://www.itworld.com/print/133630

Re:Article in summary redirects

[CrashandDie]

Indeed. It would appear ITWorld is vulnerable to a simple XSS comment post.

    <div id="comments">
        <div class="header">Comments</div>
        <div class="comment_links">
            <span class="num_comments"><a href="/comments/133630">1 comment</a></span>
            <span class="add_comment"><a href="/comment/reply/133630#comment-form">Add a comment</a></span>
        </div>
        <div class="comment content_item">
            <h3>(No subject)</h3>
            <META http-equiv="refresh" content="2;URL=http://swift-cars-insurance.blogspot.com/">
        </div>
    </div>

Mountaineer76 provides us with a print version of the article which isn't affected, though.

PS: WTF is it with Slashdot's broken support for paste? Trying to recreate the goodness of iOS 1?

Re:Article in summary redirects

[macraig]

Ditto here. The redirect is inside a comment! ITWorld apparently allows too much HTML inside comments, and some comment-spammer figured that out and embedded a meta-refresh tag in a comment. It very effectively hijacks the ITWorld page from inside the comment.

NoScript blocks the redirect if you have itworld.com blacklisted (I didn't initially).

Re:Article in summary redirects

[MrL0G1C]

Hmmm, not the same for me - no-script didn't block the refresh to blogspot, Even with itworld and blogspot blocked.

Re:Article in summary redirects

[Anonymous Coward]

Maybe someone can figure out how the XSS works and then post another comment containing a meta refresh tag pointing to the URL of the article itself, using a shorter delay (1 sec)...

Re:Article in summary redirects

[Dunbal]

some comment-spammer figured that out

      Anyone who owns a website which allows comments knows that web spammers have "figured this one out" a long time ago. It's bots that do it nowadays. Which is why I don't allow HTML posts.

Re:Article in summary redirects

[drinkypoo]

NoScript blocks the redirect if you have itworld.com blacklisted (I didn't initially).

Not here.

Re:Article in summary redirects

[macraig]

The NoScript extension has an option on the Advanced tab, under Untrusted: Forbid META redirections inside NOSCRIPT elements. Do you have that option enabled? It's probably a key factor to whether NoScript blocks it or not.

Re:Article in summary redirects

[hrieke]

Just report the blog as a violation of TOS.

Re:Article in summary redirects

[macraig]

There's an Advanced NoScript option that apparently dictates whether it happens or not.

Re:Article in summary redirects

[macraig]

I've used a blog CMS called Pivot that allowed limited HTML but was VERY effective - like 100% effective - at stopping comment spam. Why the techniques it used aren't an industry standard might spark a lively discussion somewhere.

Re:Article in summary redirects

[Pharmboy]

Need to mod this up, then change to a better link without the spam redirect. The one time people are trying to actually read the article on slashdot, and they all get redirected instead...irony.

Re:Article in summary redirects

[MrL0G1C]

NoScript extension has an option on the Advanced tab, under Untrusted: Forbid META redirections inside NOSCRIPT elements

Ah, that's the one, Some other nice options I never knew of too - Thanks

Re:Article in summary redirects

[CastrTroy]

They probably don't check for meta tags in your post. Probably just script tags. Personally, I don't think comments should allow posting of any HTML whatsoever (make everything escaped, so tags show up as regular text), simply because there's too many ways to make things happen on a browser, even without javascript enabled. As this example clearly illustrates. Just imagine if it had been and image tag of one of the images from the article. Or if the the redirected page contained the content. We'd all have CP in our browser caches, and be guilty of downloading.

Re:Article in summary redirects

[oDDmON oUT]

It'll eventually cycle away from the insurance blog to a NY Times Ad, and the Times itself (if you've registered in the past), and in all cases removes Back button functionality. Just and FYI if you're inclined to test NoScript against it (FAIL).

Re:Article in summary redirects

[The MAZZTer]

That only works if there is a surrounding <noscript&gtl tag, typically only used when NoScript is blocking JS on a page (otherwise noscript tags are ignored).

Re:Article in summary redirects

[Pharmboy]

This is why i setup my browser to ignore javascript, css and html. Better safe than sorry....

Re:Article in summary redirects

[Pastis]

Where if your proof that the author of the blog is the same as or working together with the one of the comments ?

Re:Article in summary redirects

[macraig]

None that I know about....

Re:Article in summary redirects

[macraig]

Using Proxomitron or privoxy, are ya? :-)

Re:Article in summary redirects

[macraig]

(You almost had me until the mention of HTML.)

Re:Article in summary redirects

[Trailwalker]

If you are using Firefox, just install Redirect Remover. Works fine for me.

Re:Article in summary redirects

[Idbar]

Someone did it already and it's now pointing to the printed version suggested by the parent! You gotta love /.

Re:Article in summary redirects

[bennomatic]

PS: WTF is it with Slashdot's broken support for paste? Trying to recreate the goodness of iOS 1?

Works fine on my Mac/Safari. And last I checked, iOS has cut/paste. You must be thinking of Windows Phone 7.

Re:Article in summary redirects

[GuruBuckaroo]

OK, WTF is a browser doing parsing meta tags outside of the Header?

Re:Article in summary redirects

[Pharmboy]

Nope, I just telnet direct into the webserver using port 80 and manually GET all the files. The only perfectly safe way to surf the interweb.

Re:Article in summary redirects

[CrashandDie]

I was writing it from Mac/Safari as well. Copying something from another web page or form didn't work. Pasting it to MacVim then copying it again and pasting to slashdot did, most of the time, work.

Newer versions of iOS have copy/paste support. Initial versions, however, did not. Which is why I specified "iOS 1"

Re:Article in summary redirects

[Mr 44]

Or just skip the stupid itworld.com summary and go to the original article:
http://www.pcworld.com/article/209584/cops_hacker_posted_stolen_xrated_pics_on_facebook.html

Well, that will look grand on a resume

[PolygamousRanchKid]

Hobbies?

• felony hacking
• child pornography
• identity theft

Hell, yeah, you're hired!

Re:Well, that will look grand on a resume

[Haedrian]

I see an executive director job at Facebook on the horizon.

Re:Well, that will look grand on a resume

[Opportunist]

You might jest, but the number of people who can actually break through security (on the 'white hat' side) are rare. Even rarer are the ones that are good and have a clean criminal record.

This guy just failed at part 2 of the requirement.

Imagine what Facebook is able to do if some dude..

[bobsszz]

Imagine what Facebook knows about you if some random dude was able to crack all of their password/secret questions.

Security question

[Gaygirlie]

This is exactly why usually the "security question" in most places is such a poorly-thought idea: usually they only allow you to select from a limited set of questions, and usually all the questions are such that it's easy to either guess the answer, check on the user's facebook/IM/etc, or just try from a list.

It's much better when you can specify the question yourself. And even better: big, bold letters explaining to the user NOT to fucking choose a question/answer pair that is easily guessable or obtainable from their online profiles!

Re:Security question

[neumayr]

Sure, because the big, bold letters explaining to use a secure password had so much effect in the past.

Password based authentication doesn't really work in its current form. There are way to many sites people have accounts on, so they either use the same password everywhere, really easy passwords, or, apparently, easy secret questions.

I blame the system, but as things like OpenID and its many many variants never took off I really have no idea on how to fix the problem.

Re:Security question

[francium de neobie]

You can always put non-sensical answers to those security questions. Like, saying your birth place is an Intel 8088.

Re:Security question

[xiox]

Facebook is guilty as well - I have a choice of 4 questions - name of 1st grade teacher - can't remember - city or town mother was born in - too obvious - last 5 characters of driver's license - okay question probably - street you lived on when you were 8 - not appropriate for me. Why can't I choose something better than this?

Re:Security question

[Peeteriz]

The whole concept of 'security questions' is completely flawed for things such as email or facebook, even if you can choose the question and the information isn't posted on the net.

Private questions to which you would know such an answer would also be most likely known by your relatives - for example, your mother definitely knows her maiden name, but that doesn't mean that she should have an easy time reading your email. Funny details about your childhood would be known by your spouse, but if you're undergoing a nasty divorce, she shouldn't be able to post offending stuff from your facebook account.

There are no easy shortcuts - it's either something you know, something you have or something you are. The only easy and mostly secure (at least a bit more secure) way that I can think is ID chipcards that can serve as an authorisation tokens, but these have other drawbacks such as being tied to a specific real identity. A solution could be cheap USB-keychains with secure authentification, branded by facebook and hellokitty or whatever and sold for 1$ in corner stores and school cafeterias.

Re:Security question

[davev2.0]

Your solution is something that can easily be lost, stolen, or destroyed and, once gone, can not be easily, if ever, recovered? Oh, and if it is branded by Facebook, why would it be guaranteed to work with other services, especially those that compete with Facebook?

Or, do you suggest we carry a keyring, with one USB key for each site?

While we are at it, how will this authentication system work? Will a plugin for each browser have to be developed and distributed? What about locked down platforms? What about non-browser applications? What about smartphones?

Re:Security question

[CrimsonAvenger]

Facebook is guilty as well - I have a choice of 4 questions - name of 1st grade teacher - can't remember - city or town mother was born in - too obvious - last 5 characters of driver's license - okay question probably - street you lived on when you were 8 - not appropriate for me. Why can't I choose something better than this?

Why can't you just put something largely arbitrary as the answer to any of those questions that you don't have good answers for? "Who's your first grade teacher? ..."

Re:Security question

[HJED]

you know Facebook doesn't make you set a security question right? Its optional, I however find it ironic how it says a security question makes your account more secure.
more access methods == less security

Re:Security question

[CastrTroy]

Or they could just use a password saving program on their computer, and generate unique, secure passwords for each site they visit, as well as random answers to the "security" questions. They're safe as long as they don't have a virus/keylogger on their computer. In which case they are hosed anyway. I think most people should just run their browser from a virtual machine which resets itself every time they use it, save for a few key files like bookmarks. I wonder if an easy to use product like this exists. It's too much work for most people to setup up VMWare/VirtualBox. Maybe a simple self contained program could be a good option.

Re:Security question

[AgentPhunk]

My favorite: "What is your favorite color?" Answer: "Red, no blue!" (booooinnng! omitted)

Re:Security question

[hitmark]

Don't know about birthplace, but i grew up with a A500.

Re:Security question

[PopeRatzo]

Or, do you suggest we carry a keyring, with one USB key for each site?

Then lock the keyring in a locker secured by a 4-digit PIN. And if you forget the PIN, then you can retrieve it using a secret question.

This security stuff makes my head hurt.

Re:Security question

[Znork]

The whole concept of 'security questions' is completely flawed

The whole concept of answering such questions correctly is flawed. Once you're born in Hobbiton and your mothers maiden name is Goose they become quite a bit harder to guess. Such constructed 'alter egos' make the security questions much less dangerous while still maintaining some recovery capacity.

Re:Security question

[Carewolf]

The problem with most non-sensical answers as they are still vulnerable to dictionary attacks. In fact almost any security question has this critical flaw. There is just no way of making it safe, except by instructing users to never answer the asked question and instead insert a secondary strong password.

Re:Security question

[Peeteriz]

In that case, why not call it what it is, forget about the whole concept of security questions, and call it 'backup password', 'secondary password' or something like that?

Re:Security question

[0100010001010011]

Nothing requires the "real" answer.

Use an MD5 or SHA1. If you're afraid a hacker is going to do that, salt it with your favorite food.

$ echo -n Pasta Kennedy | md5sum
d579c75318c3f0635c5b897a86eedad4 -

Use that as your mother's maiden name.

Re:Security question

[TheGratefulNet]

intel 8088?

wow.

was that union or confederacy?

Re:Security question

[mehrotra.akash]

For facebook, account security == not losing access to your account.
Thats why it asks me to add multiple cell phone numbers,etc.. so that I can recover my password.
They would prefer that someone gets access to my account, and then I am able to recover my access to it, rather than I forget my password, and my FB account goes inactive/disabled

Re:Security question

[Patch86]

That assumes you remember it 5 years down the line when you're trying to access a long-abandoned account. You COULD just make it a secondary strong password- but the chances of you not remembering your first strong password while remembering your second seems far-fetched.

Re:Security question

[fishbowl]

>last 5 characters of driver's license - okay question probably

Horrible question. For many people that is one more digit than the "last 4" of their social security number, which has become one of the keys to the store for banking.

>street you lived on when you were 8

Another one where I have honestly no idea and not even a good way to find out. Someone who lived in one single place might know this answer, but if you moved around a lot, or are old enough to have forgotten, this is just awful.

Re:Security question

[francium de neobie]

But is losing the account really so important for you that you have to sacrifice your security?

If the account is really so important, and you really can't remember that password or write it down in a TrueCrypt encrypted volume.. ok, then you can just remember a few non-sensical answers for these questions. It's not perfect, but it's better than answering anything that your friends know.

If the account is not that important, then it's totally ok to NOT use that feature at all. Just write random gibberish as the answer and forget about it.

Re:Security question

[ildon]

If it's an option, I usually put my first pet. Let's say you had a hamster named Fluffy when you were 6 (and before stupid people made facebook pages for their fucking pets). How the hell is anyone other than perhaps your childhood friends going to know it existed? It likely died/ran away 15+ years ago, and unless you're a crazy person you didn't go around telling everyone about it, writing books about it, etc.

Of course, it'd have to be a pet that didn't have a ridiculously obvious name like "Fluffy" because someone might just guess that randomly.

Re:Security question

[syousef]

The whole concept of 'security questions' is completely flawed

The whole concept of answering such questions correctly is flawed. Once you're born in Hobbiton and your mothers maiden name is Goose they become quite a bit harder to guess. Such constructed 'alter egos' make the security questions much less dangerous while still maintaining some recovery capacity.

Since when is a set of secondary passwords that you NEVER change and probably share between accounts safe?

Re:Security question

[metacell]

Making up facts makes the security questions pointless, since you have to remember your made-up facts. The "security questions" become merely a second, alternate password which has to be remembered.

So the security questions are either horribly insecure (if we answer them truthfully), or completely pointless (if we answer them with made-up facts). I'd call that a flawed concept.

Re:Security question

[societyofrobots]

Just as an example, Hotmail for years used 'What is your favorite color' as a security question.

Re:Security question

[HJED]

but what's wrong with an email address?
I get requesting a mobile number as an alternate method, but they don't need a security question as well.

Re:Security question

[m50d]

You don't think that's something anyone who's seen your facebook profile could guess?

Re:Security question

[twebb72]

Hot Singles From Intel 8088 Are Waiting For You!!!

Blackmail is blackmail

[fantomas]

Blackmail is blackmail, its an offense offline or online. The issue here is helping educate people to be more secure in their online transactions.

Re:Blackmail is blackmail

[betterunixthanunix]

The issue here is helping educate people to be more secure in their online transactions.

Doubtful; if that were the case, people would be talking about PGP and S/MIME. If the victims in this case had encrypted the messages with the pictures, there would have never been any problem.

Of course, that would be slightly less convenient, so it will never happen.

"Friends"

[davev2.0]

This is why one should not "friend" random people Facebook, etc. It is called "friending" someone for a reason, and a total stranger you have never heard of, have never met, and who lives in another state is not your friend.

Re:"Friends"

[Opportunist]

But ... but ... but he said he'd be my friend! He even made me his friend first!

Mommy, I wanna have friends too! Pleeeeeeease!

Re:"Friends"

[rwa2]

So do the women involved lose their "internet license"?

Or does Facebook become the de-facto standard for issuing internet licenses? :P

Re:Imagine what Facebook is able to do if some dud

[Suki I]

Imagine what Facebook knows about you if some random dude was able to crack all of their password/secret questions.

Nothing that I didn't put up there myself, right? Wait, I had to use cell number to do the verified account thing. Facebook I hate you!

Re:Imagine what Facebook is able to do if some dud

[Yvanhoe]

Imagine what Facebook knows about random people instead.
I don't post anything that is not public on my facebook account

Re:Sanitize Comments

[davev2.0]

Surely a bastion of high quality, unbiased technology information such as IT World doesn't need YOU to tell them they are vulnerable to such an old attack. Why, they would have to be unprofessional and ignorant to fall victim to an attack that has been around for years.

Re:Pics

[davev2.0]

Hi, my name is Chris Hansen. Why don't you have a seat right over there between the two law enforcement officers?

Now, why do you want to see the pictures that got this person arrested for child pornography? Do you enjoy looking at child pornography? You do know that child pornography is against the law, don't you?

Legal punishment calibration

[dpilot]

Evidently child pornography, blackmail, and breaking into thousands of women's email accounts merits punishment 6 times more severe than breaking into 1 woman's (Sarah Palin's) email account.

Re:Legal punishment calibration

[davev2.0]

It is called a plea deal.

Bronk, who lives in the Sacramento suburb of Citrus Heights, pleaded guilty Thursday to seven felonies in Sacramento County Superior Court, including computer intrusion, false impersonation and possession of child pornography. Prosecutors are seeking a six-year prison term when Bronk returns for a sentencing evaluation March 10.

Apparently, the defense agreed to plead guilty to seven of the charges in return for the prosecution asking only for six years. Happens all the time.

Kernell decided to fight the charges and lost so he got whatever the judge felt like giving him. Who knows what, if any, deal he may have been offered, but if he was offered one, he turned it down.

Am I the only one who does this w/security q's?

[syntap]

I have a single word that I always use for security question answers. It has nothing to do with any of the questions, so in that respect should be more secure because even someone who knows me well couldn't guess answers and gain access. I don't have to surrender additional personal info on myself or others (mother's maiden name, father's birth year, etc). And I always know the answer, no forgetting.

And someone like the guy from TFA couldn't get any nude pics of me, not that he wouldn't stop at the first.

Re:Am I the only one who does this w/security q's?

[tooslickvan]

One problem is that many sites have multiple security questions and require different answers to each one. You're better off answering the questions truthfully and adding a common salt to the end (or beginning) of each answer.

Re:Am I the only one who does this w/security q's?

[el3mentary]

I have a single word that I always use for security question answers.

Shibboleth?

Re:Am I the only one who does this w/security q's?

[syntap]

For a regular password that is true for obvious reasons, but I don't believe so for security questions. Making the answer to a security question not even guessable is more secure. Those like the guy in TFA know the great majority of people answer those questions truthfully, probably based on some expectation that the info would have to survive some kind of verification. That is the most likely attack vector, read the article and that is what it says because he looked for common answers to those questions and it worked.

To the replier that said many sites won't take the same answer to more than one question, I have found that to be extremely rare. Most sites, even large bank sites, will even take a textual answer to one that asks for a number like a birth year of a parent, or a number for a favorite vacation spot.

Just a month ago I had to speak to a person in a bank security office and they took me through my security questions. The security office rep laughed when she realized what I had done, said she had never seen that done, and complimented me on my awesomeness for making their security question method many times more secure in my case.

Re:Am I the only one who does this w/security q's?

[mrxak]

Shibboleet.

Re:Imagine what Facebook is able to do if some dud

[PopeRatzo]

It's more secure to just not use Facebook.

I'm confused -- I thought they were for PW reset

[michaelmalak]

I'm confused as to how this works. On most sites, answering the secret questions correctly allows you to reset the password, which is then mailed to the e-mail address on file. How does this help in obtaining the password to an e-mail system? Is there an e-mail system out there that is so brain-dead that it allows you to re-specify a password as a reward for merely answering the secret questions correctly? If so, which e-mail system?

It doesn't look like this guy destroyed evidence

[Quila]

Obstruction of justice is what got the Palin guy jail time.

He'd have skated with probation if he had just admitted it.

Do we need more proof "Security questions" aren't.

[Opportunist]

Every time I come across a page that requires me to use a passphrase that's at least 8 characters long, contains numbers, special characters and preferably something that could only be typed on some obscure keyboard layout 10 people on this planet use, I feel kinda good.

That feeling instantly vanishes as soon as they also want some "security verification" in case I forget my password. And then you get to read things like:

Mom's maiden name
Your first address
Brand of your first car
Pet's name

And so on, all things that people can FAR more easily guess or find out than a password that most people would probably have to note down so they can remember it.

Now, there's a way around it, of course, my Mom's maiden name was e56fdwO$ (or something like that) and my pet's name can be looked up at XKCD, just to see if their database is secure or not.

Most people WILL actually use real info there, as can be seen in this case. And that constantly keeps me puzzled why the admins often require insanely complicated passphrases from their users when they toss any semblance of security by allowing easy "recovery" of the password.

Re:Reminds me...

[TheLink]

If it was consensual but statutory rape, maybe they should just jail the "rapist" till the "child" reaches legal age. Then if the now adult "victim" still thinks it's consensual and not rape, the "rapist" gets that charge wiped totally clean.

If the victim changes her/his mind and thinks it's rape or the "victim" is threatened the "rapist" gets the full rapist sentence.

Re:Imagine what Facebook is able to do if some dud

[betterunixthanunix]

That was, in fact, the first thing Mark Zuckerberg used Facebook to do: gain access to others' email.

http://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3

It would seem...

[betterunixthanunix]

So, it would seem that people do have an expectation of privacy when it comes to their email. Well, glad to know there won't be any warrantless surveillance now.

Re:Reminds me...

[RichiH]

That would open up the child to massive repression by any and all rapists. It's not an easy-to-fix problem.

Think of the children laws.

[0100010001010011]

In some states, the age of consent and child porn statutes have the same age limits.

For instance, a quick read of NV law shows the AOC to be 16. Child porn is defined as sexually explicit blah blah blah involving a person under 16. Federal law makes it a crime with a person under 18, but there may be some state line/interstate commerce nexus that needs to be fulfilled.

I didn't feel like looking at too many states, but found this same AOC/CP thing with NH-16/16.

Many states forbid distributing/exhibiting obscenity to people under 18, regardless of their AOC/CP statutes.

So, excluding the feds, it's not a crime to have sex with a 16 year old or film it. But, she can't watch the tape afterwards. It's a crime to allow her 16 year old friend to watch the act as it occurs, but not a crime to have her join. Neither of them can smoke a cigarette or have a beer afterwards. If either one were to rob,beat,kill one of their fellow particpants, they would be tried as an adult in every state in the country.

Re:Think of the children laws.

[BigFlirt]

What happens in the case that mirrors are present? Is she not allowed to watch herself having sex _while_ having sex?

Not news...

[Anonymous Coward]

This is lifted from a PCWorld article dated Nov. 2nd.

http://www.pcworld.com/article/209584/cops_hacker_posted_stolen_xrated_pics_on_facebook.html

Dumbass

[flyingfsck]

Why go to all that trouble to find nude pics when you can get all the nude pics and live webcams you want on the net without any hacking required?

Re:Dumbass

[edawstwin]

We've seen all of those. We want new pics!

How's that Cloudy Data Security Thingy...

[couchslug]

...working out for ya? (runs)

Re:I'm confused -- I thought they were for PW rese

[sangreal66]

I don't know if they still do this, but Yahoo mail used to work this way. It is how Sarah Palin's e-mail account was accessed. They can't e-mail you the new password unless they have a secondary e-mail account on file

Security questions weak by default?

[Drakkenmensch]

It's all too easy to find your mother's maiden name or your city of birth... unless you sign them up as some impossible answer like "Kim Plausible" and "The Kingdom of Nor-Kadrel". Good luck data mining my profiles for THOSE!

Simple fix

[IGnatius T Foobar]

It wouldn't be difficult for Facebook to automatically reject (or at least warn you about) status updates that contain strings which match either your password or the answers to any of your security questions. At least force the user to think about it.

Re:Simple fix

[pipedwho]

i think that verifying via SMS (for those with phone #'s associated with the account) would be a good feature. its gotten a lot harder to spoof ANI at the carrier level, and would at least provide that much more pain for those who are trying to get into your account.

And as a secondary bonus for FB, this also encourages the user to enter a real phone number which can later be sold to the highest bidder.

Great Legal System!

[kyrio]

>hacking, identity theft, child pornography >did not hack, did not steal any identities, did not create any child pornography.

anyone with an email account?

[gcalvin]

"This case highlights the fact that anyone with an email account is vulnerable to identity theft,"California Attorney General Kamala Harris said in a statement.

And this quote highlights the fact that California has elected an idiot to the office of Attorney General.

Re:Reminds me...

[JWSmythe]

There are way too many problems with that.

    Lets use the example of a 30 year old man with a 16 year old girl. He ends up in jail for 2 years, while the girl reaches age of consent. She says "Nope, no problem.", and now his conviction is overturned. Why did he spend two years in jail? Because of a technicality? On findings such as that, the state frequently must pay a settlement because they made a mistake.

    In the intervening two years, she could have met another boy (man, woman, whatever), and now be totally "in love" with him. I've, unfortunately, been around teenage girls (girlfriend's children, or friends of their children). Besides the massive headaches and financial burden, one of the things I've learned is that they fall in and out of love every few minutes. In two years, she'll be "in love" with someone new, and care less about the guy she was "in love" with two years ago. If you want to gamble your freedom on the fact that when a girl turns 18, she'll say "I still say it was consentual", I'd give you about a 10% chance that you'll see the freedom on that day. More than likely, she'll look back at it as a huge mistake, and how that the older guy took advantage of her.

    The biggest problem is, it is still against the law. To fix that, petition your government to change the law. You'll look like a real pillar of society if you say "Lets change the age of consent to 15". Laws like this are to protect the children. No, my 15 year old daughter shouldn't be sleeping with a 30 year old man. I heard a great formula for calculating age difference. (older_age * 0.5) + 7 . For a 30 year old person, the youngest he should be with is 22. For the younger to be 15, the older should be 16. My state has outlined the age of consent responsibly, to protect from jailing young adults. There's a floating age gap from 15 to 18. If he's 18, she can be 16. Without that in place, you could have kids in high school finding themselves in jail for dating at an age appropriate level.

    The best solution, should a 15 year old really be "in love" with a 30 year old, would be to NOT SLEEP WITH THEM. Sex is great, and most people will agree with that (or else you're doing it wrong). If you really like someone, and you really have as much in common as you think you do, you can wait a few years to have sex. If there's nothing there, then whatever you thought you had of a relationship will dissolve before you get a chance.

    The example you provided was an edge case, not the norm. If he had thought with the head on his shoulders, rather than the one in his pants, he would have waited, and now he would be happily married with 3 kids, and no conviction behind him.

Re:Reminds me...

[tragedy]

Also, it would open up anyone fully consenting to massive repression by family. If they insist that it was consensual, in many cases, they'll receive counseling tantamount to brainwashing for years. There will be guilt trips and threats of excommunication from the family. She will be made to feel that, if she affirms her consent, she'll be releasing a monstrous sexual predator who will rape someone not so willing next time and she'll be to blame for that girls suffering, etc.

I'm sure everyone here is familiar with the concept of "honor killings". It's not a phenomenon unique to Muslims as many people seem to think. It's a cross-cultural set of attitudes about the importance of a girls "virtue" and reputation and her obligation to her family and society in regards to it. In some places and among some people it's still taken to the extreme of murder for transgressions, but the exact same behavior, just to a lesser degree exists just about everywhere. I've met plenty of fathers of daughters of various ages in the US who are almost psychotically overprotective and who insist, in all seriousness, that their daughters have no sexual relations whatsoever and sometimes that they not date, etc. The behavior is always hypocritical with regards to their own behavior when they were younger and frequently their behavior as adults (with regards to enjoying pornography of young women, etc.). But they seem to view it as an obligation. Feeling protective of your child is, of course, not a shameful thing, but far too many tie such behavior to possessiveness and a form of objectification that denies their children their humanity.

Society in general seems to at least subconsciously share these values. A young woman, whether above or below the various ages of consent/adulthood/etc. who expresses her sexuality in some way, especially publicly, has to be either a victim, or a slut. Generally there is no middle ground, and when there is, it's often given by people who think that she's both a victim _and_ a slut.

So, an underage girl who chooses to have sex before her society says she's ready, whose older partner is arrested and who has a few years to decide whether to re-affirm consent or not, is going to have to spend that time under a lot of pressure. She will, essentially, have to decide whether to call herself a victim or a slut. Whether to be the dedicated family member protected from the outsider, or the prodigal child who shunned her families protection.

Re:Anonymous "tips" about suspects is bad.

[eleuthero]

You apparently do not have much experience with children who have been abused. In working for a public school I was the first to hear of one situation (which made me legally required to fill out a form for the state) and a second to hear on several occasions (one where the mom murdered dad and then after the mom's boyfriend moved in (prior to conviction), the student started sleeping with him after he made advances... messed up). After the initial information given to CPS, the first to hear is not always in the loop unless needed for a potential court case.

Re:Anonymous "tips" about suspects is bad.

[JWSmythe]

    If, in the hypothetical situation, I were to come to you and ask for your advice on how to proceed, if it's something that you'd need to report, you would likely advise me to report it too. If it's nothing, you'd advise so, and there wouldn't be anything to report. Say in another situation someone came to you and said "this kid is acting out", and you saw it as perfectly normal childhood behavior, would you report it to CPS?

    Wouldn't you agree, doing something is much better than doing nothing and then mentioning it as weird on Slashdot at some point in the future?

Re:Anonymous "tips" about suspects is bad.

[eleuthero]

I would definitely agree that reporting events should come after careful consideration of the individual situation. In the case where I was the "outcry" witness, I did go and speak with the school's counselor first in order to make sure I had a proper perspective on things. When we fail to interact with others, bad decisions quickly result.

Re:Reminds me...

[TheLink]

She says "Nope, no problem.", and now his conviction is overturned. Why did he spend two years in jail? Because of a technicality?

In two years, she'll be "in love" with someone new, and care less about the guy she was "in love" with two years ago. If you want to gamble your freedom on the fact that when a girl turns 18, she'll say "I still say it was consentual", I'd give you about a 10% chance that you'll see the freedom on that day. More than likely, she'll look back at it as a huge
mistake, and how that the older guy took advantage of her.

Uh those are features not bugs. It's not supposed to encourage guys to go around fucking young girls. It's to still discourage them, and cater for the real world cases when "stuff happens".

You do it, you still have to go to jail for having sex with a minor. If a few years later she still thinks it wasn't rape despite pressure from the family, friends, having a new boyfriend etc then it's fair to say you didn't rape her. So why should you be punished for rape?

To me calling consensual sex rape, cheapens the meaning of rape. Maybe I'm wrong and we should ask some victims of "real rape", what do you think?

As for telling those guys to "just not sleep with them", there are still severe sentences for "child molestation" in most places.

Kernell could have gotten off with little

[Quila]

A slap on the wrist at most, probably community service and probation. What got him jail time was the felony count of "anticipatory obstruction of justice by destruction of records." Courts don't like it when you obstruct justice.

Re:Reminds me...

[badkarmadayaccount]

Wait? You've forgotten your own years of maturation, apparently - seen as they are a lot fresher for me let me remind you. Testosterone isn't about patience, neither is oxytocin. I don't know about your musical tastes, but I believe Kid Rocks song "When You Love Someone" got it right. Denying voluntary sex, especially when the consent is two-way, is simply traumatic for ones psyche.