Slashdot Mirror


Ask Slashdot: Identity Theft Attempt In Progress; How To Respond?

An anonymous reader writes "It appears that two weeks ago my email address got into the wrong database. Since that time there have been continuing attempts to access my accounts and create new accounts in my name. I have received emails asking me to click the link below to confirm I want to create an account with Twitter, Facebook, Apple Games Center, Facebook mobile account, and numerous pornographic sites. I have not attempted to create accounts on any of these services. I have also received 16 notices from Apple about how to reset my Apple ID. I am guessing these notices are being automatically generated in response to too many failed login attempts. At this point I have no reason to believe any of my accounts have been compromised but I see no good response."

239 comments

  1. Change your e-mail address by Marxist+Hacker+42 · · Score: 5, Insightful

    Sometimes, it becomes necessary to change your e-mail address.

    --
    SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    1. Re:Change your e-mail address by Anonymous Coward · · Score: 2, Interesting

      First things first:

      Is it a gmail address ?

      Is there another exact address from a different country ?

      It could be as simple as foo.bar@gmail.com being confused with foobar@gmail.au

      Happened to me.

    2. Re:Change your e-mail address by X0563511 · · Score: 1, Informative

      foo.bar and foobar (and f.o.o.ba.r) are all the same account as far as gmail is concerned. The dots are dropped.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    3. Re:Change your e-mail address by Bearhouse · · Score: 5, Informative

      Indeed. Keep the old ones, of course, but change the passwords to something very, very secure and different for each one.
      Backup then delete all information associated in the Cloud with these addresses, (Android, iCloud, Gdrive...)

      Do not reuse any of the old accounts for anything. Use a "one-time" account for verification each of the new accounts, then nuke it and change to a new one.
      Do not be tempted to have one master account for verification of all the child ones.
      If you're using gmail, or similar, do NOT use some variation of your name, home town, company, whatever.

      Finally, pony up for your own domain etc. and get a nice email account you can totally control. Cheap, too.

    4. Re:Change your e-mail address by danomac · · Score: 2

      Firstly make sure there's a damn good non-guessable password on his existing email account!

    5. Re:Change your e-mail address by Anonymous Coward · · Score: 4, Informative

      Yes... but fubar@gmail.COM is NOT the same as foobar@gmail.AU. Reread the parent.

    6. Re:Change your e-mail address by Anonymous Coward · · Score: 0

      clearly fubar foobar ... duh !!

    7. Re:Change your e-mail address by Aardpig · · Score: 5, Insightful

      One does not simply change one's email address...

      --
      Tubal-Cain smokes the white owl.
    8. Re:Change your e-mail address by Lazere · · Score: 2

      No, when I feel the need for a new address, I simply add it to my growing pile of addresses. It's as simple as; create new address, make new address the contact for all the important stuff (bank/icloud/whatever) and keep the old one for things/people you may have forgotten.

    9. Re:Change your e-mail address by Anonymous Coward · · Score: 0

      It should happen to everyone. It is required by the email standard for local-part (the part before the @ sign) processing in email addresses. The extra periods in the local-part are essentially ignored when determining the owner of the mailbox.

    10. Re:Change your e-mail address by Anonymous Coward · · Score: 0

      I don't believe that's the case. My name isn't too common, but there are others around. I am fooe.bar@gmail.com and have been for years. There's another address, fooebar@gmail.com that belongs to someone legitimate who lives in another city. We've never been hacked, don't get too much spam, but occasionally one of us will get an email that should go to the other one. We made contact ages ago and now occasionally correct each other's correspondents, as in "Oh, I'm the Fooe Bar who's a piano teacher in Omaha. You want the Fooe Bar who's a designer in Baltimore." Both of us use a somewhat uncommon variant for spelling our shared first name, so it would actually be Fooe Bar. Gmail has been distinguishing between us for a long time. It's only our human correspondents who sometimes have a problem.

    11. Re: Change your e-mail address by Anonymous Coward · · Score: 1

      Malkovich Malkovich Malkovich?

    12. Re:Change your e-mail address by noh8rz10 · · Score: 1

      Hey - no wonder I haven't been getting any of my mail! You need to forward that stuff to me ASAP! -Fo Oebar

    13. Re:Change your e-mail address by hAckz0r · · Score: 1
      You can if you always use throw-away addresses (such as sneakemail.com provides for a fee, there are many others as well).

      Whenever I sign up for a new service I use a custom throw-away address, labelled for that particular site, and if it gets hacked/used for spam or other I can go back to change the address (and/or password) with that service to an new throw-away address. All email get forwarded to my real address(s) of my choice, and when I start receiving mail I don't want I automatically know who got hacked/scraped/or-sold-me-out. (Yahoo is by far the worst, so don't go there without throw away's.)

      Remediation is simple because I know the source of the problem, and they don't even own my real address. I can simply turn off the spam with a flick of the switch, so to speak. Knowing 'who sold you out' is priceless.

    14. Re:Change your e-mail address by Anonymous Coward · · Score: 0

      You pay a service a fee instead of just getting a domain and doing it yourself? Turn in your geek card!

    15. Re:Change your e-mail address by mccrew · · Score: 1

      Second, make sure your "Forgot Password" recovery question is non obvious as well. I recently had a Gmail account stolen out from under me because I had an extremely obvious secret question (e.g. on the order of "What does f-o-o spell? foo") going way back to the Gmail prehistoric times. Seems like this has been an attack vector that has been employed a lot recently.

      --
      Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
    16. Re:Change your e-mail address by davesag · · Score: 2

      Without wishing to seem pedantic, there is no *@gmail.au — if anything it would be *@gmail.com.au but I've never known anyone to have that; only *@gmail.com, or in the UK *@googlemail.co.uk.

      --
      I used to have a better sig than this, but I got tired of it
    17. Re:Change your e-mail address by Anonymous Coward · · Score: 0

      Hi, This is fooe.bar@gmail.com from the other city. YOUR EMAIL ADDRESS IS NOT fooebar@gmail.com for the love of god please stop telling people it is.

    18. Re: Change your e-mail address by ixidor · · Score: 1

      no no no no, like this, buffalo buffalo buffalo buffalo buffalo buffalo buffalo

    19. Re:Change your e-mail address by Anonymous Coward · · Score: 0

      The problem here is that there are PLENTY of services out there that insist on using your e-mail address as a username. A great many of those don't permit the changing of that username beyond the creation of the account. This essentially means that once you create such a linked account you can never change your e-mail address ever again - unless you want to go recreating all the linked accounts and losing anything in them in the process.

    20. Re: Change your e-mail address by Anonymous Coward · · Score: 2, Informative

      Gishpuppy offers this service for free turn in your geek card for not knowing what he is talking about. :)

      There's a Firefox plugin to automatically create addresses. I did this with all my loyalty cards. ???.kroger@gishpuppy.com and ???.walgreens@gishpuppy.com all forward to a special gmail box. If groupon keeps annoying the crap out if me, I can just log-in to gishpuppy and delete that address. All messages will be bounced back.

      Simple as possible, completely free and stunningly effective.

    21. Re:Change your e-mail address by lgw · · Score: 1

      The problem here is that there are PLENTY of services out there that insist on using your e-mail address as a username. A great many of those don't permit the changing of that username beyond the creation of the account. This essentially means that once you create such a linked account you can never change your e-mail address ever again - unless you want to go recreating all the linked accounts and losing anything in them in the process.

      All my email routes through my domain to my gmail account. I never give out my gmail account (not that it's that hard to discover, but it's never my username anywhere). If my gmail is getting hacked, I can just move to a new one, and change the forwarding. There's nothing really to hack associated with the email addresses I give out - there's only forwarding there.

      --
      Socialism: a lie told by totalitarians and believed by fools.
    22. Re: Change your e-mail address by Anonymous Coward · · Score: 0

      One does not simply change one's email address...

      One does if one gets one'd off about all the two that one's email address is getting.

    23. Re:Change your e-mail address by davester666 · · Score: 1

      You both have fucked up parents for naming you "Fooe Bar".

      --
      Sleep your way to a whiter smile...date a dentist!
    24. Re:Change your e-mail address by Reaperducer · · Score: 1

      Back in the olden days when the internet was still fun, it would have been *@gmail.oz.

      The internet is run by bureaucrats now.

      --
      -- I'm old enough to have lived through six different meanings of the word "hacker."
    25. Re:Change your e-mail address by quenda · · Score: 1

      Back in the olden days when the internet was still fun, it would have been *@gmail.oz.

      The internet is run by bureaucrats now.

      Actually, .au was administered for many years by bearded benign dictator Robert Elz, before the bureaucrats took over.
        The .oz predates in internet, and was never the same thing as .au .

    26. Re:Change your e-mail address by w0mprat · · Score: 1

      All that asside, the author of TFA seems to be under a very specific individually targeted attack, rather than some kind of automated attack.

      My tip: LONG passwords. make them really really long.

      Many people think they are clever with symbols and numbers by doing something like P@55w0rd.

      I can't think how many times I've seen something like that for some kind of critical system.

      Avoid using guessable common $ubs!tutions for l3tt3rs and numbers, along with 123, 666, 69 etc etc.

      --
      After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
    27. Re:Change your e-mail address by KozmoStevnNaut · · Score: 1

      Activate 2-step authentication as well. Every 30 days, I have to enter a code that I receive via SMS in order to login to my Gmail account on a trusted computer (my home desktop). On every other computer, I have to enter a new code on every login attempt. So unless an attacker gains access to both my password and my phone, they won't be able to get in.

      https://accounts.google.com/SmsAuthConfig

      --
      Eat the rich.
    28. Re:Change your e-mail address by Anonymous Coward · · Score: 0

      Yes, something very similar happened to me a few months ago after placing an ad in Craig's list.. The buyer requested suspicious terms and a bizarre posting method etc. Never sent me any money although he claimed to have done so, then 2 months later said he had "forgotten" to send it out and would do so after all. I never did complete the transaction, and have not heard from hin in 3 months ( had he sent a MO I would have tried to return it, as I expect it would have been fake) , although he may have gotten nervous when I pointed out all the suspicious terms in his request, and "Mr Smith's" atrocious english made that a difficult task ;-). Point is, however, that soon after that first contact, I got a notice from Google that an attempt to access my Gmail was made from some place in China! I live ...elsewhere.. Never been to China. Never will be, either. About 6000 miles too far to walk or swim. Changed all my passwords, though. Immediately. In fact, used most of the techniques that "Bearhouse", above, suggested, as I have heard that advice before. In addition to now using very long complex passwords, not based on anything familiar or easy to guess, I made several printed out hardcopies to keep in a safe place.. and have one text file double encryption, both on the file, and on the archive i store it as. If I need to access my password list, I unzip with one PW, and file level decrypt with the other PW.. Then I can copy/paste the pass into where it's needed making sure to have blind entry enabled. So, no keyloggers... then afterwards, re-encode/archive the list, secure delete the old text file, and Bingo! Only need to remember 2 passwords.. which I can still keep a hardcopy of also to help remember... It's not as complex a deal as it sounds, really. most PW's are for low risk websites, and are fine to store on a cookie etc.. as long as they're used only on that site and nowhere else. Banks and the like do not use a "remember me" feature, and although I prefer alternate emails over "security questions", for PW recovery, neither method has really worked well for me , as I had to try and recall what my previous ISP had given me for email, 14 years ago, one time. No problems so far, anyways, after all that.. or other attempts from China.!

  2. Don't just sit on your hands... by smartfart · · Score: 4, Insightful

    I would contact my local police force and talk to the financial crimes desk. They may not be able to do anything at this point, but you should establish a paper trail ASAP, which would certainly work in your favor while explaining things to your bank or whatever if the bad guys do manage to hurt you in some manner.

    1. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      Is it already time to reach out to the cops? Can anybody professional who has handled this chime in. This looks like something any one of us could be hit with.

      My opinion
      (a) Create a new email address and change it in every account you feel is important
      (b) Share a few of the phishing emails you have got, and some slashdotter may be able to hit home with the server and give you more details
      (c) Switch off html view in all your email clients (mobile/desktop) that use that email address
      (d) start marking the phishing mails as spam so that your email provider may be able to use that information to protect you and other targets of this phisher.
      (e) I dont know how IT savvy you are, if you are then start looking at using tools like Private Eye(if on mac) or other such monitoring software and post the logs

      Hope we isolate the site and the nasty SOB soon!

      Anonymous Coward

    2. Re:Don't just sit on your hands... by ShanghaiBill · · Score: 4, Insightful

      I would contact my local police force and talk to the financial crimes desk.

      You would go to the local police because someone (probably on the other side of the world) knows your email address? If you are lucky, the police will just laugh and hang up. If you are unlucky, they may get pissed at you for wasting their time on something so frivolous. What are expecting the police to do?

      Just make sure you have good passwords on all your accounts, install a spam filter, and get on with your life.

    3. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 4, Informative

      I've been down this road.. The local police are likely to tell you unless you are under threat of imminent bodily harm, you should contact the FBI. When you contact the FBI, they will tell you computers get viruses all the time and you should ignore the problem or contact your local police if you feel your life is in danger.

      I'm not trolling or being sarcastic. This was what actually happened when I contact LEOs to try and help solve the problem. Like others said, change your email address and get on with your life. Unless you want to spend a bunch of time chasing ghosts on your own time.

    4. Re:Don't just sit on your hands... by TechyImmigrant · · Score: 1, Funny

      >Is it already time to reach out to the cops?

      I suspect any cop would just stare at you blankly while sipping his coffee or chewing his/her doughnut.
      That or they would work out an excuse to beat you up and arrest you for resisting arrest.

      Cops are not equipped to deal with these things.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    5. Re:Don't just sit on your hands... by SQLGuru · · Score: 1

      Out of curiosity, wouldn't changing your email account look just as suspicious as if your account was compromised?

      Were I attacking someone, the first thing I would do is prevent them from getting the "you've been hacked" notices.

    6. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      Play the straight man and simply explain to the police that you think you may have spotted identity theft in progress, and would like to file a police report to have a record for insurance purposes. They have no reason to disallow you filing a report as long as they think they'll only have to do a bit of paperwork.

    7. Re:Don't just sit on your hands... by Dahamma · · Score: 2

      As I'm sure about a million other people who have tried this before could tell you, this is a complete waste of time.

      Most police departments couldn't care less if you report your car being burgled or your cell phone stolen (two cases I have tried to report and they basically acted like they couldn't be bothered), let alone someone just trying to use your email address on a web site. At least in the former case it is useful if you want to make an insurance claim.

      As for any Internet fraud claims, etc - as another poster said, the local police will just refer you to the FBI, who will just tell you if there is no material loss they really don't care (and even if there is, if it's not thousands of dollars they really don't care, either). An old roommate of mine actually had the address of a person who scammed him for about $500 on Yahoo Auctions - the FBI, Postal Inspectors, and police all brushed him off. When he asked if it would be better for him to go to the address and confront the person himself, the police told him if there was an incident it would then be his fault. Nice.

    8. Re:Don't just sit on your hands... by smartfart · · Score: 1

      One of my best friends is a financial crimes detective in my city, and yes, he seems to know his stuff.

    9. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      I followed that path and filed two reports. Nothing is done with them as there is no evidence the police can understand to chase.

    10. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 1

      Well, it's not for the police; they admittedly aren't going to do anything. As somebody pointed out above, most local police departments simply aren't equipped to deal with complaints like this, and the FBI isn't likely to care unless it's something that can make headlines. The report is for insurance purposes, in case suspected identity theft progresses to actual identity theft. Thicker paper trails are always better when you have to deal with insurance adjusters.

      That's not to say that somebody signing you up for BS accounts is necessarily indicative of attempted identity theft -- I have a very short gmail account name and have been dealing with exactly this crap for years with no ill effect. If somebody is truly concerned about it, though, and wants to cover all of his/her bases, creating an expansive paper trail is the way to go, and typically requires very little effort.

    11. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      They have no reason to disallow you filing a report as long as they think they'll only have to do a bit of paperwork.

      But they'll try! I had an actual case of ID theft once; and stuff was being sent to an address in the state next to mine. I went into a police station there to report it & get the report for my dealings with the credit companies (pita). They refused to take the report because I didn't live in the jurisdiction, but assured me that once I'd reported it to my local police they'd liaise and get right on it... My local police actually did take the report over the phone which was nice. It was an investigator for the bank which had been ripped off who eventually contacted me though, not any cop.

    12. Re:Don't just sit on your hands... by crazyjj · · Score: 1

      Lol, you think my local cops have a "financial crimes desk"??? hahahahahahahahah Shit, I doubt my state police even have that.

      --
      What political party do you join when you don't like Bible-thumpers *or* hippies?
    13. Re:Don't just sit on your hands... by operagost · · Score: 5, Funny

      So first he beats you up, then takes your wallet?

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    14. Re:Don't just sit on your hands... by Technician · · Score: 4, Informative

      For part of your paper trail, look at the lower right corner of Gmail. I bad guys were in your account recently, you may find some evidence on the "Last account activity: 13 hours ago
      Details".. Click on the Details link and it will open your most recent login times and IP addresses. If you were not on a trip and you were logged in from Florida or somewhere else, it is time to save the info and change your password. Knowing the IP adderess of someone using your account is good evidence. Contact their ISP with time, date, timezone, with the info. It may be against his ISP's terms of service to hack from his account. For those without Gmail, this is what it looks like. Note IP addresses altered to protect my privacy. I checked my mail from work, home, and on a recent trip.
      Browser * United States (WA) (192.25.69.00) 1:11 pm (4 minutes ago)
      Browser United States (OR) (10.134.137.00) Feb 25 (13 hours ago)
      Browser United States (WA) (192.25.69.00) Feb 25 (20 hours ago)
      Browser United States (WA) (192.25.69.00) Feb 25 (20 hours ago)
      Browser United States (WA) (192.25.69.00) Feb 23 (3 days ago)
      Browser United States (OR) (127.34.103.00) Feb 22 (4 days ago)
      Browser United States (OR) (127.34.103.00) Feb 21 (5 days ago)
      Browser United States (OR) (127.34.103.00) Feb 20 (6 days ago)

      --
      The truth shall set you free!
    15. Re:Don't just sit on your hands... by Attila+Dimedici · · Score: 2

      As a few others have pointed out, the point the original poster was making was NOT that the police would do anything about the problem. The OP's point was that by contacting the local police and filling out a police report, you have a paper trail that something is going on, so that down the road, if this person is successful you can document that you were aware of it and took steps to address the problem. Of course it is important that when you contact the police you make it clear that you do not expect that they can or will do anything about it. You let them know that you are contacting them so that you have an official record of the problem and so that if by some remote chance the information you are providing them connects to other information they have received they have it to add into their case files.

      --
      The truth is that all men having power ought to be mistrusted. James Madison
    16. Re:Don't just sit on your hands... by Fjandr · · Score: 1

      My city doesn't even have a property crimes division, let alone a financial crimes division. Unless it's a traffic infraction or a violent crime, they do not investigate anything.

    17. Re:Don't just sit on your hands... by green1 · · Score: 1

      if you take it to the police, even if your particular department is useless on these sorts of issues, they will at least file a report. They many not do anything at all with it after they file it. But at least it's on record.
      Now this doesn't help with the immediate problem, but if the crooks are successful in working their way past some logins and to a point where they have actually got access to something important (like a bank account, or heaven forbid enough information to get ID issued in your name) then when you go to clean up the mess, you have a paper trail saying things are happening. makes it more likely they'll believe you at that point.

    18. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      Is this a Chris Brown joke?

    19. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 1

      I followed that path and filed two reports. Nothing is done with them as there is no evidence the police can understand to chase.

      People aren't reading closely. No one said the police would do anything. This is about starting a paper trail, so you have proof that you knew something was happening on such and such a date, so if banks, insurance companies, or even the police do get involved at some point, you have a paper trail.

    20. Re:Don't just sit on your hands... by balsy2001 · · Score: 1

      Plus once you file the police report and are a suspect of identity theft you can freeze your credit for free (usually it costs up to $10 per agency per person depending on the state you live in). Freezing your credit is easy to do and essentially eliminates the possibility of someone starting credit in your name (unless they break into your house and take the codes you printed from the three credit bureaus after freezing your credit). There is a guide to freezing your credit on the website of a financial podcast I listen too (http://www.clarkhoward.com/news/clark-howard/personal-finance-credit/credit-freeze-and-thaw-guide/nFbL/). You can also check on your credit for free once each year at the following website https://www.annualcreditreport.com/cra/index.jsp (I recommend checking one of the three every 4 months).

      --
      GENERATION 27: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
    21. Re:Don't just sit on your hands... by cusco · · Score: 1

      Cool, never noticed that before. Thanks. No mod points today, sorry.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    22. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      http://www.ic3.gov/default.aspx

      That is the place to report cyber crime to the FBI. CYA

    23. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      sipping his coffee or chewing his/her doughnut.

      Only guys drink coffee?

    24. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      I would contact my local police force and talk to the financial crimes desk.

      Really? You know how many times my email addresses are used for various shit like this? Mostly as originator of spam
      (From: header), but you can type in any email address anywhere.

      You can't do shit about it short of not having email address visible to anyone.

      Finally, this is not even any serious "Identity Theft Attempt". If you get any ID theft, you'll start getting phone calls from collection agencies for the cars you bought but stopped paying for.

      This is "email nuisance", nothing more.

    25. Re:Don't just sit on your hands... by stretch0611 · · Score: 1

      I would contact my local police force and talk to the financial crimes desk. They may not be able to do anything at this point, but you should establish a paper trail ASAP,

      The police is my first though as well...

      If you are worried at all about financial threats, the 2nd action would be to contact the major credit reporting agencies and ask to freeze your credit. In theory this stops them from giving out your credit report so that no one (including yourself) can apply for credit while frozen.

      This can prevent someone malicious from applying for credit cards, running them up, and destroying your credit history in the process. (even though it is a huge inconvenience if you need to get credit during this time.) This can also be a problem if you are seeking employment and your potential employer wants to run a credit check on you.

      --
      Looking for a job?
      Want your resume written professionally?
      DON'T USE TUNAREZ!!!
    26. Re:Don't just sit on your hands... by Anonymous Coward · · Score: 0

      Your local police force will pass it to the FBI computer crime task force, for which there is no hope of actually getting anything done in any real case, or the Secret Service for wire fraud, which is even less clueful about hacking since they shot themselves in the congressional testimoney with "Operation Sun Devil".

    27. Re:Don't just sit on your hands... by TechyImmigrant · · Score: 1

      >Only guys drink coffee?
      Yes, in my experience, women drink Frappacinos.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    28. Re:Don't just sit on your hands... by Technician · · Score: 1

      I forgot one other feature in that details link. It will show if you are concurently logged in. This would be the case if someone was logged in monitoring your activity, or you simply left yourself logged in at work. If you have a concurent login, you can disconnect the other logged in accout, tossing them off. Then immediatly change your pasword to prevent them from logging right back in.

      I admit that I didn't notice that either. I picked up this gem from a scam baiting site forum. Most typical scam email styles are covered that seperate fools from their money.

      --
      The truth shall set you free!
  3. Your options are by Press2ToContinue · · Score: 4, Insightful

    1) Wait and see if they succeed, then create new online and financial accounts and deal with the personal and financial fallout
    2) Create new online accounts, transfer all information to new accounts and delete the old ones before they succeed

    Up to you.

    --
    Sent from my ENIAC
    1. Re:Your options are by Anonymous Coward · · Score: 1, Insightful

      Except in the case of things like an apple account, you lose access to everything you've ever purchased. I'm sure thats not the only example.

    2. Re:Your options are by gamanimatron · · Score: 2

      It's quite possible to change the email address associated with an Apple account, and dissociate the old address, as long as you can log into it. Just takes a few clicks and a couple of "click this link" emails.

      --
      cogito ergo dubito
    3. Re:Your options are by X0563511 · · Score: 1

      3) change all your passwords and such securely and watch as they flail against your login

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    4. Re:Your options are by pentalive · · Score: 1

      Use a password locker like LastPass, let it geneate the longest, most complex passwords the apps/websites will allow and a different one for each website or app.

    5. Re:Your options are by Anonymous Coward · · Score: 0

      How did they get his personal info to begin with? Has his computer been compromised in any way? Someone he might personally know might be a suspect also. If after changing accounts, passwords etcetera, attempts are being made again, then it's time to consider it could be someone he knows.

    6. Re:Your options are by Anonymous Coward · · Score: 0

      Except in the case of things like an apple account, you lose access to everything you've ever purchased. I'm sure thats not the only example.

      For a company to continue to perform hardware work on my 5-year old (stock warranty) laptop free of charge simply because it looked bad, I find it hard to believe that they're going to give a hearty "fuck you" to anyone sitting on a $3,000 iTunes stockpile that simply needs to be transferred to a new account.

      You would probably get someone's attention rather quickly by threatening future revenue. I hear CFOs are shot on sight for that kind of short-minded shit these days.

      And for a company who's stock price has dropped by 1/3 rather recently, now is not the time for corporate arrogance. That Apple can't be shined with bullshit and fanboy sperm forever.

      (Captcha = "audacity")

    7. Re:Your options are by Anonymous Coward · · Score: 0

      Why not just update the primary email id associated with your apple id, and remove the compromised one?

      That sure seems a lot easier than throwing away your entire purchase history.

    8. Re:Your options are by X0563511 · · Score: 1

      I am a fan of KeePass, personally. Same idea, different tool.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    9. Re:Your options are by achbed · · Score: 1

      Can't say enough about mSecure - it's one of the few that do NOT require an online sync of any kind. It'll sync across a local LAN/WLAN without sending traffic to the Internet. Of course, it has integration with a few services for that too if you want. One downside for some folks - it's an application, not a Web Service. Another downside - it does cost money ($10 on iOS and/or Android, and $20 for the mac or Win version, no linux one). But it's been reliable as hell for me and my business.

    10. Re:Your options are by Spiridios · · Score: 1

      3) change all your passwords and such securely and watch as they effortlessly use the forgot password feature on the site.

      FTFY. You don't brute-force an account, you maybe try a few common passwords then attack the weak link.

    11. Re:Your options are by X0563511 · · Score: 1

      Well, KeePass just stores into a file. How you move that file around is up to you :)

      It has some kind of internet thing, but I've never touched it.

      Open source as well, if you care about that (I do)

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    12. Re:Your options are by X0563511 · · Score: 1

      How is that link supposed to be used without first getting into the now-secured email account?

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    13. Re:Your options are by Spiridios · · Score: 1

      How is that link supposed to be used without first getting into the now-secured email account?

      Perhaps because not all "forgot password" links work that way? Now, of course, that particular method no longer works and it did require some "personal" info and a physical call. However, it's not an isolated story, it's just the first that came up in my admittedly haphazard search. Online password cracking is too easy to detect and stop unless you have a large botnet at your disposal. Crackers are going after alternate channels. While you and I can pick our complex passwords to protect the front door, we cannot pick the reset methods and procedures chosen by Apple, Amazon, Google, or Microsoft.

    14. Re:Your options are by cusco · · Score: 1

      Been using Keepass for years (and have converted a number of our customers into regular users as well), but never realized it was open source. Great product.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    15. Re:Your options are by stretch0611 · · Score: 1

      I'm also a fan of KeePass.

      It is cross platform as well including Linux/Unix, Mac, Windows, Android, and iOS.

      There are two versions, v1 and v2. BOTH are actively supported and updated. v2 is really a rewrite using .net, so v1 is better if you want to use it on non-windows devices.

      There are plugins for browser integration, and as a flat file, in theory you can sync it through dropbox (or a different cloud service.) Of course you better trust that service if you do...

      Very Important: Have a very good and long passphrase as a login. Also, create a key file and require both. A key file is just a 2nd authentication method. (If you rely on a cloud service, never put the key on the cloud.) If someone gets your key, you should pray that you have a damn good password or you are screwed.

      --
      Looking for a job?
      Want your resume written professionally?
      DON'T USE TUNAREZ!!!
  4. misnmer by Anonymous Coward · · Score: 0

    This does not sound like identity theft to me. This sounds like someone using a valid email address so that messages don't instantly bounce, and possibly an attempt to hack your existing accounts..

    For help with identity theft, go to your local police, not slashdot.

    1. Re:misnmer by arth1 · · Score: 1

      Looks more like a case of cyberharassment to me.
      If this weren't slashdot, my first question would be "have you turned down anyone within the last year?"

      To me, there doesn't seem to be enough to go to the police with at present, unless you happen to live somewhere where the police are under-worked, bored and looking for something to investigate that might not lead to a prosecutable or even fineable crime.

      And if you think this is bad, wait until you get joe-jobbed.

    2. Re:misnmer by fustakrakich · · Score: 1

      For help with identity theft, go to your local police, not slashdot.

      What, and have SWAT bust down your door and kill your dog? Stick with Slashdot.

      --
      “He’s not deformed, he’s just drunk!”
    3. Re:misnmer by ArhcAngel · · Score: 2

      Looks more like a case of cyberharassment to me.

      Were you referring to the emails or the comments on /.?

      --
      "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
  5. did you change your email password? by alen · · Score: 5, Informative

    to something not in the dictionary?

    after that i would just ignore the failed attempts. after a while the perp will stop and move on to easier prey

    1. Re:did you change your email password? by Anonymous Coward · · Score: 5, Funny

      No, but he did change them all to "honest equine capacitor fastener"

    2. Re:did you change your email password? by Cigarra · · Score: 1

      I'm not sure "ignore the failed attempts" is the right thing to do here. It SHOULD BE, in an ideal world, but there's more than one case where persistent hackers get to reset an account, not by guessing the password, but by social engineering the support people from Apple, Amazon or whatnot.

      It's a little unnerving, but I have no idea what exactly a user can do to prevent such things from happening to one.

      --
      I don't have a sig.
    3. Re:did you change your email password? by pentalive · · Score: 2

      XKCD password regimen!

    4. Re:did you change your email password? by Anonymous Coward · · Score: 1

      No, but he did change them all to "honest equine capacitor fastener"

      Assume an attacker will always start by running a dictionary attack, so you basically have a 4 character password with each character having a possibility of a few hundred thousand values. So it's only about as secure as a 5 or 6 character random string. Another detracting point for using real words is that they'll all get checked prior to random strings, so the attacker has a much better "worst-case" in terms of time to crack than he should. By the same token, a random string will almost always fall towards the ideal case (for the defender).

      And yes, I know you were joking, but it needs pointing out. Passphrases are much weaker than they appear on paper unless the attacker is a complete imbecile.

      As for the article, I suggest the guy immediately update all his passwords, use a unique one on every site, make them as long as the site will allow and consist of a purely random string picked by a decent program... humans are horrible at generating truly random passwords.

    5. Re:did you change your email password? by Muros · · Score: 1

      No, but he did change them all to "honest equine capacitor fastener"

      I know XKCD made a good point, but that's still nowere near as good as passwords could be. It is extremely easy to memorise a fairly long gibberish sentence and use it as a password, eg. "The moon that afternoon was violently passive." Thats a 47 character password and I didn't even bother mangling any words, it could be made much better. I don't understand why accounts on some computer systems that have disk quotas measured in gigabytes have such arbitrarily small limits on the password. Is 1KB too much to ask for? It is bad enough that so many people use Password1, qwerty123 or letmein, but it is worse that many systems don't actually allow you to have a good password. I've seen systems in the last few months where I was puzzled about why I was having problems until I realised my password was too long. And not archaic systems, these were supposedly modern.

    6. Re:did you change your email password? by bitt3n · · Score: 5, Funny

      to something not in the dictionary?

      I don't know about this advice. I once fell for one of those nigerian scammers who duped me into giving him my email password. then I changed my password to 'gullible', since I've heard that's not in the dictionary. somehow it was the first thing he guessed. what's worse is I used it for all my accounts, and now he posts idiotic comments as me on slashdot.

    7. Re:did you change your email password? by bobbied · · Score: 1

      And just kiss access to all these accounts goodbye? I don't know about you, but I have difficulty trying to remember 20 passwords with 20+ random characters.

      Do change the E-mail address and make sure you have complex passwords that differ between sites. Complex Passwords are mixed case, have special characters, numbers and don't consist of dictionary words. Keep them as long as you can remember and keep them different between important sites. Change them regularly if you can.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    8. Re:did you change your email password? by Muros · · Score: 2

      Assume an attacker will always start by running a dictionary attack, so you basically have a 4 character password with each character having a possibility of a few hundred thousand values. So it's only about as secure as a 5 or 6 character random string.

      If you are only talking about English words, there are about 300000 of them. A standard English language keyboard has about 94 characters available. So your four "word character" password is actually about as good as a password of an 11 character random string. But only if the attacker assumes you are using a password of 4 dictionary words separated by spaces. That is a very specific and unrealistic assumption to make.

    9. Re:did you change your email password? by cdrudge · · Score: 1

      Is 1KB too much to ask for?

      Probably. Because no one in their right mind is going to have a password that's 1KB long. Average word length in English is about 5 letters per word. Add in a space and you're at ~166 words for a 1KB password. An excellent typist types at 80WPM so that's 2 minutes to type in your password if you're really fast, you remember it, and you type it correctly.

    10. Re:did you change your email password? by CrimsonAvenger · · Score: 3, Insightful

      And just kiss access to all these accounts goodbye? I don't know about you, but I have difficulty trying to remember 20 passwords with 20+ random characters.

      Password Safe. I let it remember my passwords for me, and only have to remember the one to open the password safe.

      --

      "I do not agree with what you say, but I will defend to the death your right to say it"
    11. Re:did you change your email password? by Fjandr · · Score: 1

      Yeah, in addition to other reasons to hate Comcast (depending on where you live), they have an arbitrary 11-character password limit. At least a couple years ago, anyway.

    12. Re:did you change your email password? by Hentes · · Score: 1

      If somebody was attacking me with this persistence, I would consider using randomgenerated passwords that are written down in an encrypted file on my machine.

    13. Re:did you change your email password? by magic+maverick+ · · Score: 2

      Stupid instant moderation applying shit.
      My bad. I didn't mean to mod you troll. Maybe /. could actually require a confirmation for moderating rather than just a stupid drop down and automatically applying bullshit.

      --
      HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
    14. Re:did you change your email password? by magic+maverick+ · · Score: 1

      You should never be saving the password itself anyway if you are running a system.
      You save the hash of the password (plus salt). So that 1KB password will still "compress" (you won't get your password back of course) down to 64 bytes or whatever anyway.

      Funky stuff.

      --
      HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
    15. Re:did you change your email password? by cusco · · Score: 1

      Try Keepass. It will even generate random strong passwords for you if you want. The database can be pretty much anywhere, a USB drive, network drive, Dropbox, floppy disk, whatever, and is 256 bit RSA encrypted. You only need to remember one password, and Keepass does the rest.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    16. Re:did you change your email password? by cusco · · Score: 1

      There's a brand of security camera that only allows 6 lower case letters for the root password. A couple of them don't even allow changing the root password, and pretty much all of them allow you to use root/root or admin/admin. Only recently has the security equipment industry even woken up to the idea that security equipment should actually be secure.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    17. Re:did you change your email password? by chrismcb · · Score: 1

      And yes, I know you were joking, but it needs pointing out. Passphrases are much weaker than they appear on paper unless the attacker is a complete imbecile.

      But how do you know if I am using a 4 word pass phrase, or a 6 character random string? Maybe I''m only using a 2 word passphrase with a couple extra special characters? Maybe I'm using random characters. where do you start? How strong is it now?
      Sure if you KNOW something about my password, it helps to crack it.

    18. Re:did you change your email password? by chrismcb · · Score: 1

      I changed mine to 12345, as it isn't in the dictionary either...

    19. Re:did you change your email password? by Anonymous Coward · · Score: 0

      For the systems that aren't vital, pick a 7+ letter word. Pick a two digit number. Capitalize the word. Split the word in half. Stick the two digits in the middle. Your definition for "half" and "middle" can vary. I've been doing this for plenty of years now and nobody stole any of my accounts yet. For important accounts (like 3 in total) I have the most cryptic password yet.

      And no matter the importance level, I never give my passwords to any sites so they can "find my friends" ever.

    20. Re:did you change your email password? by strikethree · · Score: 1

      Password Safe. I let it remember my passwords for me, and only have to remember the one to open the password safe.

      I use so many different computers that such a thing is unreasonable to use. Stick it on a thumb drive? Many of the computers I log into do not allow "personal" media to be attached.

      I currently have something on the order of 80 passwords and 60 usernames stored in my head at any one given time. I would LOVE to reduce it... but a "wallet" type program just will not ever fly.

      --
      "Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
    21. Re:did you change your email password? by N1AK · · Score: 1

      My password 'system' is designed to allow me recall them without assistance, be unique to each site and be reasonably hard to crack. I won't share the exact method but the following is the same kind of idea. Pick 2-3 core passcodes that you will use for different trust levels of sites. I have three. One I use for sites I don't trust, one I use for sites I trust a little more and another for financial style sites. They shouldn't be words but should be memorise-able for example "Dang84Deng". Then create some rules you can remember to adjust the password based on the site, for example add the number of vowels in the domain and the first two consonants. So my Slashdot password would be: Dang84Deng2sl

      If someone finds out my password for slashdot it won't work for any other site. Theoretically they could work out the method and apply it to other mid-level sites but unless you're being targeted by someone willing to invest time and spots the method. As most attacks are automated I'm willing to accept that risk.

    22. Re:did you change your email password? by Anonymous Coward · · Score: 0

      This is such a crazy idea.

      It means that if someone does manage to get access to your "safe", they get a list of all services and their logic details and you would get completely raped.

    23. Re:did you change your email password? by bobbied · · Score: 1

      As in all things related to security, this is really a risk management question and may not be all that "crazy" in practice. I use a password storage program for my personal accounts so I can keep up with changing passwords on lots of sites. I keep the encrypted data file containing my passwords on my phone and automatically update a backup copy of the data file on my PC.

      Yes, this is a risk, somebody could crack the encrypted password file and have access to my whole life. But what are the other options?

      Write them all down? Paper is hard to keep updated and easy to loose.

      Make them all the same? Obviously not a good idea....

      Come up with some Common technique for password generation so all are different? Doesn't always work (Some sites have mutually exclusive password requirements) and doesn't allow passwords to get changed regularly.

      I use a program to store my passwords on my phone, have my phone PIN protected and software to remotely wipe it. I keep an automated backup of the encrypted password data file. Should the phone go missing, step one is to wipe it, step two is start changing passwords. My biggest risk is somebody getting my password file and decrypting it without taking my phone, so I don't name it anything obvious and only transfer the data file on trusted network connections. Should the phone get lost/stolen, the crook will not have that long to 1. hack into my phone, 2. find the password file, 3. breach the encryption, 4. take over any or all of my accounts before I detect that the phone is missing, wipe it, change my passwords.

      Are there risks with this approach? You betcha... But ANY approach has it's risks, it's all about understanding the risks and managing the risks to keep them at an acceptable level. I figure that I'm a whole lot better off than the average user out there, and should not be a huge target anyway.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    24. Re:did you change your email password? by Anonymous Coward · · Score: 0

      > > "honest equine capacitor fastener"

      > Assume an attacker will always start by running a dictionary attack, so you basically have a 4 character password with each character having a possibility of a few
      > hundred thousand values. So it's only about as secure as a 5 or 6 character random string.

      You seem to be confused about dictionary attacks. It doesn't matter, if it's in a dictionary if you use more than 1 word. Oxford Dictionary has roughly 300.000 entries, so a 4-word passphrase, assuming it's randomly chosen out of the OD, constitutes 300.000x300.000x300.000x300.000. This is roughly 72 bits entropy. Go to distributed.net to check, how much time it takes to crack just once! While you're at it, also check Diceware.com.

      Your 5-6 random character passWORD (26 chars, upper&lower plus 10 digits) at random are only 35 bits. Therefore: "honest equine capacitor fastener" FTW! ;-)

    25. Re:did you change your email password? by david_thornley · · Score: 1

      I have an account at one financial site (which I have to do business with for reasons I'm not going to get into) that would reject that password as too long. Sigh. I also have (IIRC) an account that requires a non-alphanumeric in the password, and that would fail. There's more than one account that doesn't allow special characters in the password.

      So, nice system, but until people running these stupid systems all decide to have reasonable requirements, it won't work all the time.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    26. Re:did you change your email password? by Anonymous Coward · · Score: 0

      I forget who it is, but one of my local telecoms has an EIGHT character password limit! Oh, and NO special characters, thank you very much. Idiots.

    27. Re:did you change your email password? by LunaticTippy · · Score: 1

      12345 is in the dictionary

      I guess I'm old. I completely don't get the most popular definition. The one I'm familiar with, an idiotic luggage combination, is second.

      --
      Man, you really need that seminar!
  6. email address by Anonymous Coward · · Score: 0

    Make a new email address and go to the websites that you use and change the account to reflect the new address. As for the other websites. Keep an eye on your bank statements and credit card statements because most banks require fraudulent transactions to be brought to their attention within 45-60 days otherwise they won't refund. Good luck

  7. What would you report? by Anonymous Coward · · Score: 5, Funny

    Um... yes... There's this person, probably in another country, that I suspect is trying to gain access to my facebook account. LOL.

    1. Re:What would you report? by Em+Adespoton · · Score: 4, Insightful

      Um... yes... There's this person, probably in another country, that I suspect is trying to gain access to my facebook account. LOL.

      Laugh, but the GP is correct. File the paperwork. It's a CYA move, just like you'd do if something fishy was going on at work. Not only does this cover YOU, but it also provides a jumping off point, should some computer crimes force actually stumble on the perp. They can't do a thing against them in many cases unless someone has reported it first. Having a report on file unties all sorts of red tape for their investigations.

      That said, reporting it to a local county office isn't going to do much; you need to find the closest computer crimes division that will actually file your report and also add it to the federal/international databases so it can be cross-referenced by other investigators.

    2. Re: What would you report? by Anonymous Coward · · Score: 2, Funny

      404 in progress, all units respond!

    3. Re: What would you report? by sayno2quat · · Score: 1

      404 Response: units not found.

      --
      Sure I sold you robot insurance. But you were attacked by a cyborg. Not covered.
  8. Documentary on Identity Theft by jerdenn · · Score: 4, Funny

    I believe that Jason Bateman was in a recent documentary on this topic - seemed very factual, and you should probably consider his plan of action:

    http://www.imdb.com/title/tt2024432/?ref_=sr_1

    -jd

    1. Re:Documentary on Identity Theft by Anonymous Coward · · Score: 1

      Speaking of documentaries, you should also probably try this one :
      http://www.youtube.com/watch?v=_g6tNfwp7UE

    2. Re:Documentary on Identity Theft by Anonymous Coward · · Score: 0

      and including -jd in the body of your post adds WHAT to the discussion? Or are you somehow more special than everyone else here and feel the need to self-promote at every opportunity?

      -jd

  9. Also consider, by Anonymous Coward · · Score: 0

    have you upset anyone recently?

    Wanting to get into your email, and get to your financial stuff would lean toward id theft. But setting up accounts on porno sites? That might be a tip off that someone is trying to ruin your reputation.

  10. Taken? by eldavojohn · · Score: 5, Funny

    Okay you need to listen to me carefully and to be focused. Do you have access to a bathtub? Good, take your laptop into the bathroom and fill the bathtub full of water. I need you to log into your Facebook and open your Farmville tab. You need to do this quickly before they gain access. Take each of your animals from your farm and love them and nuzzle them and say goodbye to them. Then hold them under water in the bathtub until they stop struggling.

    Are you done? Good, leave them in the tub, they're in a better place now.

    Go back into your room and crawl under your bed so the satellites they have control of cannot see you. Open up your Apple account and start forwarding your e-mails to your Gmail account. Yes, I know it will take forever, no there is not an easier way to do this. Okay, once you have all of those out delete your Apple account -- you'll get a new one later. You never really owned that stuff you bought on iTunes so just forget about it now, it's gone. Now log into iCloud on your laptop and start the laptop on fire. It's better to destroy all of those photos, tax returns and documents then to let them have them.

    Now listen carefully because this part is important. These men are going to access your accounts. They're going to send your friends messages and make you seem like a jerk -- just for fun. There's nothing you can do about that. Just make sure to leave the Slashdot chat box open when they take you ...

    Hello?

    Hello? Anonymous Reader?

    I don't know who you are. I don't know what you want. If you are looking for ransom, I can tell you I don't have money. But what I do have are a very large amount of Slashdot karma; karma I have acquired over a very long career. Karma that make me feel like I can stand up to people like you. If you let the anonymous reader's accounts go now, that'll be the end of it. I will not look for you, I will not pursue you. But if you don't, I will look for you, I will find you, and I will ask you politely to stop messing with people.

    --
    My work here is dung.
    1. Re:Taken? by black3d · · Score: 1

      :O Awesome...

      --
      "The true measure of a person is how they act when they know they won't get caught." - DSRilk
    2. Re:Taken? by Anonymous Coward · · Score: 1

      Good luck.

    3. Re:Taken? by Anonymous Coward · · Score: 0

      man, don't mix that sh....t, can kill you

    4. Re:Taken? by who_stole_my_kidneys · · Score: 1

      epic!

    5. Re:Taken? by realsilly · · Score: 1

      I see what you did there....

      --
      Life takes interesting turns, but the most interest is when you're off the beaten path.
    6. Re:Taken? by lurker412 · · Score: 1

      Funniest post I've seen here in years. Bravo!

    7. Re:Taken? by Anonymous Coward · · Score: 0

      I'd expected another finale:

      1. Good, take your laptop into the bathroom and fill the bathtub full of water.
      2. I need you to log into your Facebook and open your Farmville tab.
      3. Post your goodbye message to Facebook.
      4. Take each of your animals from your farm and love them and nuzzle them and say goodbye to them.
      5. Then hold them under water in the bathtub until they stop struggling.
      6. Hook your laptop to the grid.
      7. ...?
      8. Prophet!

    8. Re:Taken? by daffmeister · · Score: 1

      eldavojohn, I applaud you

  11. Definitely Change the Email You Use for Apple by ios+and+web+coder · · Score: 1, Insightful

    It is a huge PItA to reset an AppleID.

    This time, don't use "abcdef123456" as a password, hmm?

    I have had my email address compromised (in spam databases) for years, and nothing like this has happened. However, I use non-trivial passwords (I use the Randall Munroe Method), so I have yet to have had an email address actually cracked.

    It sounds like they got more than just your email address. It looks like they actually cracked it.

    I am getting sick to death of all my friends, associates, tech support folks, salespeople, etc. getting their email accounts cracked. I mean, I know scientists, engineers and real highbrow types, and they are constantly (often repeatedly) getting their emails cracked.

    When you get your email cracked, you are selling out everyone on your contact list.

    Good job!

    --

    "For every complex problem there is an answer that is clear, simple, and wrong."

    -H. L. Mencken

    1. Re:Definitely Change the Email You Use for Apple by Anonymous Coward · · Score: 1

      It is a huge PItA to reset an AppleID.

      This time, don't use "abcdef123456" as a password, hmm?

      It doesn't sound like that's what happened. That is, it doesn't sound like the attacker doesn't have control of the account at all. What the attacker DOES have is the email address and is harassing the user by attempting to A) subscribe it to a variety of pornographic websites (which appear to be requesting confirmation before doing anything) and B) brute-force a password check, both to no avail.

      The problem is, the user keeps getting emails for all of this, which is getting annoying.

    2. Re:Definitely Change the Email You Use for Apple by ios+and+web+coder · · Score: 0

      OK, I'll cede the point. However, I have a number of Apple IDs, and just having an email addy isn't enough to just go ahead and use it. They are pretty tinfoil, and recognize when a new computer is trying to access something.

      However, in order for that to have happened, then I seriously doubt that it's really identity theft. Sounds like the OP pissed off someone that has their email addy.

      Thanks for the "troll" rating, BTW. Really shows some class.

      --

      "For every complex problem there is an answer that is clear, simple, and wrong."

      -H. L. Mencken

    3. Re:Definitely Change the Email You Use for Apple by Anonymous Coward · · Score: 0

      Security through obscurity. Why people think it's a good idea to use the same address everywhere is beyond me.

    4. Re:Definitely Change the Email You Use for Apple by Spiridios · · Score: 1

      Security through obscurity. Why people think it's a good idea to use the same address everywhere is beyond me.

      It's a sad day when the security of our accounts is so poor that we have to rely on obscurity to keep them safe.

    5. Re:Definitely Change the Email You Use for Apple by Anonymous Coward · · Score: 0

      This time, don't use "abcdef123456" as a password, hmm?

      Now, I wasn't the mod, but the above seems pretty trollish to me. Or, at best, condescending and presumptuous.

    6. Re:Definitely Change the Email You Use for Apple by ios+and+web+coder · · Score: 1

      Mmm-Hmmm...

      Yup. Pull the other one. It's got bells on. If you weren't the mod, then post in here under your /. name.

      "Don't Agree" = "Troll".

      I just love The Internets.

      --

      "For every complex problem there is an answer that is clear, simple, and wrong."

      -H. L. Mencken

    7. Re:Definitely Change the Email You Use for Apple by ios+and+web+coder · · Score: 1

      OK, having given this some thought, I agree. It was condescending and presumptuous.

      You are correct. No excuse. I was in a crappy mood, and expressed it in an indelicate manner.

      Now, pay attention and take notes, because, in order to complete this module, you'll have to do an exercise.

      To the original author: I sincerely apologize. I took something out on you in a public venue that was inappropriate.

      I live by a code: Public transgressions get public apologies -in the same venue and audience as the transgression.

      Please note that I am posting this under my /. account, as I did the original post.

      EXERCISE:

      Your turn.

      --

      "For every complex problem there is an answer that is clear, simple, and wrong."

      -H. L. Mencken

  12. Really? by koan · · Score: 2

    "but I see no good response."
    You can stop using that email, monitor your credit cards and other accounts, you can also freeze your credit cards and who can check your credit, change all your passwords, there are entire web pages dedicated to helping with this issue.

    --
    "If any question why we died, Tell them because our fathers lied."
  13. Malicious or clueless? by Anonymous Coward · · Score: 1

    My wife is being plagued by someone giving out her email address and signing up for various accounts.

    It's not identity theft in this case, it's just a completely clueless person that doesn't understand that the address is hers, and using it to sign up for various things doesn't mean they can get to the email in the end.

    1. Re:Malicious or clueless? by arth1 · · Score: 2

      My wife is being plagued by someone giving out her email address and signing up for various accounts.

      It's not identity theft in this case, it's just a completely clueless person that doesn't understand that the address is hers, and using it to sign up for various things doesn't mean they can get to the email in the end.

      Never attribute to stupidity that which can be adequately explained by malice.
      -- Mrs. Hanlon's Razor

      My money would be on a former friend of your wife's.

    2. Re:Malicious or clueless? by Hjalmar · · Score: 1

      I have had this happen. Eventually I was able to gather enough information about the person to contact them in real life. Nothing will freak out a person more than to be told by someone "stop using my email". Especially if you also prove that you know their home address, phone number, names of personal friends, etc.

    3. Re:Malicious or clueless? by Anonymous Coward · · Score: 0

      Sadly enough, that's not the case. This is happening to me right now; dude is trying to buy a truck (with his own money, apparently) and I'm getting all his dealership communications (mostly "why aren't you answering? do you still want the truck?"). I guess that's what I get for registering for gmail when you could still get first/last name addresses....

    4. Re:Malicious or clueless? by happylight · · Score: 1

      HAHAHA. My brother did exactly this. There was an email address that he wanted. Despite the fact that he couldn't sign up for the address at gmail or yahoo because it was already taken, he used that email to sign up for various services anyway. He could not understand the fact that he doesn't have control of the email address stops him from using it.

      He has autism btw. I tried to explain this to him a million times and he still can't understand it.

    5. Re:Malicious or clueless? by Anonymous Coward · · Score: 0

      HAHAHA. My brother did exactly this. There was an email address that he wanted. Despite the fact that he couldn't sign up for the address at gmail or yahoo because it was already taken, he used that email to sign up for various services anyway. He could not understand the fact that he doesn't have control of the email address stops him from using it.

      He has autism btw. I tried to explain this to him a million times and he still can't understand it.

      Actually, it's 34,654 times you told me

      Sincerely, your loving brother

  14. reset your passwords by Anonymous Coward · · Score: 0

    Change your passwords to be very strong, and change them once a week for the next few weeks. Also contact some of your providers and see if they can put a trace on attempts.

  15. More Likely by g0bshiTe · · Score: 4, Insightful

    An anonymous reader writes "It appears that two weeks ago my email address got into the wrong database"

    Or two weeks ago you pissed someone off and they are just plugging your email address into everything.

    --
    I am Bennett Haselton! I am Bennett Haselton!
    1. Re:More Likely by ShaunC · · Score: 1

      That's what it sounds like to me, too. An identity thief wouldn't be having all of these email notifications etc. being sent to the victim's address, he'd have created an account on Yahoo or something to receive those messages without the victim knowing. The porn site registrations are a pretty good sign that this is "revenge spam." Someone just wants to annoy the heck out of submitter.

      As an aside, anytime Apple updates their Terms of Service on an iOS device, there's always a button for "Send these terms via email." That form performs no check on a) whether the address entered belongs to an Apple ID, or b) whether you've already emailed the terms. So, you can easily have Apple spam someone's mailbox with as many copies of their TOS as you're willing to waste time on. Last time I did this, each click of the send button actually generated two emails... One about the TOS and one about the game store, or something.

      --
      Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
    2. Re:More Likely by DarthVain · · Score: 1

      It does sound a bit like ordering pizza's and magizine subscriptions to an address of someone you loath.

    3. Re:More Likely by DigiShaman · · Score: 1

      Ever wonder why the boss gets so much junk email? It's proportional to how many firings he/she has performed thoughout their career. Just sayin.

      --
      Life is not for the lazy.
  16. Everybody gets these by Anonymous Coward · · Score: 0

    I get these on all my email accounts. I highly doubt you were specifically targeted in any way.

    1. Re:Everybody gets these by Anonymous Coward · · Score: 0

      Bob Smith is that you?

  17. Credit fraud alert and maybe credit freeze by slashgordo. · · Score: 1

    With the 3 main credit agencies, definitely put a credit fraud alert on your account, and if you're a little more paranoid and have a few bucks, put a security freeze on your account, too. Hopefully if you have good passwords they'll lose interest and move along. You mentioned your Apple ID. Is there anybody at Apple that you can report the bogus password reset attempts to, and maybe they can trace their IP address?

    1. Re:Credit fraud alert and maybe credit freeze by Geoffrey.landis · · Score: 1, Informative

      With the 3 main credit agencies, definitely put a credit fraud alert on your account

      Do be aware that the mere act of putting a credit fraud alert on your file with the credit agencies will reduce your credit rating, and result in banks quoting you higher interest rates if you apply for a loan.

      --
      http://www.geoffreylandis.com
    2. Re:Credit fraud alert and maybe credit freeze by BonemanPgh · · Score: 2

      the mere act of putting a credit fraud alert on your file with the credit agencies will reduce your credit rating

      That is a common misconception. Will a freeze lower my credit score? No. (Source: http://atg.wa.gov/freeze.aspx)

    3. Re:Credit fraud alert and maybe credit freeze by Jumperalex · · Score: 1

      Not to mention, even if it DID ... it would have to lower it a LOT and your score would already have to be on the margain to be bumped down into a new rate range. But alas, it is NOT true.

      --
      If you can't be good, be good at it!
    4. Re:Credit fraud alert and maybe credit freeze by Geoffrey.landis · · Score: 1

      the mere act of putting a credit fraud alert on your file with the credit agencies will reduce your credit rating

      That is a common misconception.
      Will a freeze lower my credit score? No. (Source: http://atg.wa.gov/freeze.aspx)

      Well, I was talking about a fraud alert, not a freeze.

      OK, a fraud alert won't reduce your numerical score. However, banks checking your credit report to consider issuing credit will see the fraud alert. Based on that, they chose whether to extend credit, and if so, what rate to offer. The law does not forbid them from taking the existence of a fraud alert on your account into consideration when deciding that, and you can expect that they will do so.

      Your mileage may vary.

      --
      http://www.geoffreylandis.com
  18. not much to do, a lot you can do? by zerosomething · · Score: 1

    There has been not account compromise that you know of right? So there isn't much you can do. You should get your free credit report https://www.annualcreditreport.com/cra/index.jsp This is the truly free ones. You can get one free one each year from each agency, there are 3 agencies so you can get one every 4 months. Just keep track of your financial info. You might disassociate the address they are trying to get into from any financial accounts. Change all your passwords to something good and use a password manager so you don't have to do the online reset process.

    --
    It all starts at 0
    1. Re:not much to do, a lot you can do? by zerosomething · · Score: 4, Informative

      Found some old recommendations I sent out to friends that weren't too tek savvy. It's fairly basic info that most should know.

      I was looking into Life Lock and started reading what they actually do, which is in the fine print of their terms of service here.

      http://www.dmachoice.org/ it's the primary service Life Lock uses to get you off of mailing lists and it's free. They also have some good info on how to keep secure online. There are several items you can go through to have your self removed form email and mail lists.

      Then go to https://www.donotcall.gov/ and register your phone numbers for the do not call list.

      Then go to https://www.optoutprescreen.com/ to remove your self from the credit card pre-approval lists.

      If you want free credit reports use this site. https://www.annualcreditreport.com/cra/index.jsp You can get 1 free report every year from each of the 3 reporting agencies. If you break it up you could get 1 every 2 month. I could get one from Equifax this month. Then in 2 months my wife could get one for them. Then in 2 months I could get one from TransUnion. etc... The reason to get them is mostly to see who has been looking at your credit. Then make sure all the loans are yours.

      Now for your online stuff. Get an email account at google or some place else that you can use for those online registration things that you need to do from time to time. Use that account only for things that you are unsure about. Keep another account for the more important stuff like the banks. You could even have a 3rd account for your general email.

      Most web browsers have an option too clear the cache and cookies. Look for it. In Safari on Mac look under the Safari menu then select Reset Safari... On Windows it's under the File Menu. In Firefox you need to look in the Preferences and the Security tab. Resetting and clearing out the cookies will also clear saved passwords. The reason to do this is because many web sites set tokens on your web browser called cookies that allow them to track you and what you do online. They can see where you are going and what you do online. For Windows this is a big problem because there are ways to install applications on the system without you knowing. Then your computer can be used to send email spam to others or even be used remotely to take over other computers. This is really only a problem on Windows but for Macs they can still track your online usage and figure things out about you that might make it easier to get you to click on something that would install an application that could take over your computer.

      For email. Set your email program to not automatically read your mail and try to use the built-in spam filters. Also set the options to not download in-line pictures and such. The pictures in spam can be used to also track you and verify your email address. If you and I get the same piece of spam the picture will actually not be in the email it's actually a picture on a web server someplace. The name of the picture is unique to each spam email so when your mail program tries to access the picture from the internet the spammers computer ticks off the unique name your computer used to get the picture. That unique name is associated with your email address.

      --
      It all starts at 0
  19. Probably not Identity Theft by Anonymous Coward · · Score: 0

    In this case, it looks like you pissed someone off, and they are attempting to gain access to your account and create new accounts with the same e-mail address to get back at you using your name. Change your passwords, and make them strong. You can file reports with the police but they probably won't do much. Most importantly keep an eye our for people pretending to be you and slandering you. If you find it happening somewhere, then contacting the police and/or hiring a lawyer might make sense.

  20. Sucks, but you must be proactive by Anonymous Coward · · Score: 0

    hit the credit reporting sites and see what they have to offer (Experian, Equifax, Transunion). Also, look up LifeLock. Talk to your bank and credit card companies. Delete as many accounts as you can (facebook, apple, twitter, etc.). Move your bank accounts to different banks. Have your banks disconnect your accounts from online-banking (I can choose which accounts to have visible when I log in to my banks website).

    1. Re:Sucks, but you must be proactive by Anonymous Coward · · Score: 0

      LifeLock is a scam. They don't do anything you can't do yourself for free.

  21. Moron with your name by Anonymous Coward · · Score: 0

    I recently had a similar issue. It turned out some moron in Denver with the same name as me thought that he automatically got to have a gmail account in that name. I've had the relevant gmail account since you needed invites. Some quick googling got me his contact info and it got sorted out. Looking back, I got lucky though. I'd change all your passwords and try to reach authorities if it goes on too long.

  22. How is this identity theft? by twotacocombo · · Score: 4, Insightful

    It looks like you've pissed somebody off and now they're just screwing with you. What would motivate a stranger to randomly open free online accounts under your email address, which they presumably don't yet control, when they can get one of their own just as easily? The days of breaking into and squatting somebody's paid AOL account are long gone. If this was true identity theft, things would start showing up on your credit report, you'd be getting nastygrams in the mail, and the collectors would start calling. Go change your passwords and move on with life.

    1. Re:How is this identity theft? by Inda · · Score: 1

      I've done this. We've done this. Back in the days, when spam was a real problem and mailboxes had a 5kb limit, you could shut down someone's email by plugging it into a vast number of websites.

      "this email address has already been registered" wasn't handled very well either. If the authorisation link wasn't clicked, it wasn't purged from the database after a set number of days. Blocked forever.

      But yeah, why bother these days? Move on. There's no attempt to steal anyone's identity here. Some kiddie is just being a dick.

      --
      This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
  23. The two above and... by echnaton192 · · Score: 1

    Yes, what the two above me wrote:

    1. go to the police. I guess even in the USA this might be a good idea. As post above this said, you might need the papertrail for evidence
    2. create new emailaddress by another provider. Last time I checked hotmail was swarmed with compromised accounts, while gmail actually protected some customers. I do not know about outlook.com. Use IMAP and ssl so that you quckly receive all emails and do not have to delete mails (use provider with large inbox). Set new provider to get all the emails via ssl and pop from the old one (change password first to a strong one).
    3. Change literally every password to a strong one and change the associated emailaddress of this account from any account you could think of. Use paper and pencil or trusted password safes (some even create good passwords in case you can not think of so many, use only machines or mobile devices you can trust).

  24. Also by g0bshiTe · · Score: 1

    I'd be willing to bet AC poster used thisname@gmail.com and thisname@apple.com and thisname@whatever.com
    Are all your usernames the same between all these sites?
    Have you responded to any of the 16 notices from Apple about resetting your password? Are the emails actually coming from Apple and not some type of phish.

    --
    I am Bennett Haselton! I am Bennett Haselton!
  25. There isn't a solution by AK+Marc · · Score: 4, Informative

    You can change your passwords on every site to different random strings of unbreakable length and store them in a password manager, to guarantee that breaking one wouldn't affect the others.

    Or you can attempt to close any accounts tied to that email.

    Other than closing the accounts, there's nothing you can do. I've called the FBI in a similar circumstance. "Yes, we are tasked with enforcement of that nature. No, we will not act unless you've suffered actual monetary loss."

    If you want to prevent this, use different email accounts for each service (you can forward them all to the same "main" account to make checking them easier), so if one email gets abused, you only risk one service. But that's too late for the submitter.

  26. Probably an id10t error. by Rhys · · Score: 2

    Having a fairly common name and a early gmail where I snagged first initial + last name I get a lot of junk there. Password reset attempts aplenty, people's airline tickets, house listings, closing documents...

    Those I want off of I send a nice mail to support at the company and claim fraudulent use of my email address to register with them. You'd be amazed how fast your email will be off their account (sometimes the account survives that, sometimes... the id10t gets to get a new account -- have fun with that!).

    --
    Slashdot Patriotism: We Support our Dupes!
    1. Re:Probably an id10t error. by Registered+Coward+v2 · · Score: 1

      Having a fairly common name and a early gmail where I snagged first initial + last name I get a lot of junk there. Password reset attempts aplenty, people's airline tickets, house listings, closing documents...

      Those I want off of I send a nice mail to support at the company and claim fraudulent use of my email address to register with them. You'd be amazed how fast your email will be off their account (sometimes the account survives that, sometimes... the id10t gets to get a new account -- have fun with that!).

      Same here. Once got onto a string of lawyers emails. Most people are nice and thank you when you reach out, as I do when it is an obvious mistake. Only once did an id10t insist it was the right address. I said fine, but I have no responsibility to protect all that private information you are sending me. Eventually it stopped, I assume when the intended receipient asked about it and was told 'but I've been sending it for months...'

      --
      I'm a consultant - I convert gibberish into cash-flow.
  27. Chill out... by bazmail · · Score: 4, Informative

    It is just someone who doesn't like you trying to fuck with you. That's not how identity thieves operate. Hopefully one of those automated emails sent you you includes an IP address of whomever is submitting the forms, and that may lead to something. I would say relax, it will pass.

  28. I've had this happen to me by black3d · · Score: 1

    When this has happened to me before, also with the apple ID resets, etc, I've simply hardened the passwords on all my accounts and happily kept on going. As long as you're not following any phishing links, you should be fine.

    --
    "The true measure of a person is how they act when they know they won't get caught." - DSRilk
  29. Trace them ... by Anonymous Coward · · Score: 0

    Track them down using the IP address information they have left behind during their attempts.

    Then kill them.

  30. Review your e-mail and other account settings by Anonymous Coward · · Score: 0

    Just review your accounts settings. Is your password a strong one?

    For the backup e-mail (for lost passwords) is that account secure as well? What about that account's backup?

    Are you security questions and answers complex? Are they truthful answers or did you put in some fake/random data as well to protect them? I recommend making the answers really long random strings (like 50+ character password), print the answers out, and store them in a safe or deposit box. Not on your computer.

    2 factor auth available?

    Your bank probably allows resets to your e-mail. Make sure that is locked down too.

  31. Fraud Alert! by TheCarp · · Score: 1

    Most everyone is saying similar things, one thing I missed if anyone said it.... put a fraud alert on your credit. Lifelock does this, in fact, its really their main product. Basically, if you write a letter to the credit reporting agencies to tell them that you have reason to believe that someone is trying to steal your identity, they will post an alert on your records, which makes them actually do things like ask for ID when someone claiming to be you asks for a credit report.

    The main nice thing about lifelock is/was (its been a while) that this only lasts a few months, they automatically renew it for you. The credit reporting agencies were pretty pissed about this claiming that the fraud alert system is....well.... for people like you who actually have reason to think someone is trying.... not just those of us who know how common and easy it is and know that we are all targets. (or as I liked to paraphrase it "waaaaah we have to do our jobs now....waaaah we can't just be irresponsible with our humoungous database of other people's information....waaaaah")

    --
    "I opened my eyes, and everything went dark again"
    1. Re:Fraud Alert! by TheCarp · · Score: 1

      Ok.... apparently what I said was correct...all except for the lifelock part. They WERE doing this until they got sued, they apparently don't do that anymore: http://en.wikipedia.org/wiki/LifeLock#Service_controversies

      Not sure what they are doing now, but I haven't kept up in years (obviously)

      --
      "I opened my eyes, and everything went dark again"
  32. Happened to me by Hjalmar · · Score: 2

    I started getting multiple "you have reached the maximum number of login attempts" from my bank. I changed the account name, and it ended.

    Create a new email address, and switch iTunes over to that account. Keep in mind that when hackers got into Mat Honan's life, they did it by exploiting weaknesses in Apple and Google's authentication schemes. Neither weakness was enough on its own, but when combined hackers were able to get full access.

    http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/

    It's annoying, but be a little proactive and you'll be fine.

    1. Re:Happened to me by Anonymous Coward · · Score: 0

      Gmail plus sign extension does wonders where accepted. My iTunes account is not the same as my Amazon account from the plus sign onward. I use the extension as a hardening system. Sure, you got my password, the starry thing. But the thing in the clear? Nope. And if you get that for one site, you still don't have any access to any of my other accounts.

  33. Credit Report Pronto by AnalogDiehard · · Score: 1

    Order a free copy of your credit report pronto and check for suspicious activity. Call the credit reporting agencies and put a fraud alert on your account - by providing a phone number only you have access to, any financial institution attempting to open a credit line or loan from someone using you stolen identity will see the fraud alert and call the phone number listed before approving. The fraud alert stays on your record for five years.

    My soon-to-be-ex-wife attempted to open a $13,000 credit card in my name using stolen mail. The fraud alert put a stop to any more attempts. That fraud event came out in divorce court and the judge was not too pleased with her.

    Regarding the emails to confirm or reset accounts, look for a link to report fraud. Use it (but not the p0rno emails, those bastards will just spam you forever since you just confirmed a live human on the other end).

    --
    Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
  34. Try to figure out what they're after, secure it. by Anonymous Coward · · Score: 0

    This isn't casual ID theft. You have something that somebody wants. Someone is trying to hammer at all possible points of your online presence, probably to find information or leverage to get in to something else. (This is the real reason password reuse is bad. One weak system, and your credentials are compromised in other systems)

    Do you have a popular online presence? Do a lot of people follow and watch what you do?
    Blog? Facebook page? Youtube account? Google+?

    Facebook in particular. If you have even a midly popular account you'll be hammered HARD by break in attempts, and due to facebook's generally shit security, you'll probably lose it no matter how well you secure it.

    Facebook's fail-open-yes-by-default nature means that popular accounts have huge exposure. Spammers, shady marketers, and social media opinion manipulators (Yes, this is a real thing) buy hacked popular accounts to get their messages to lots of eyes very quickly.

    Most of facebook's most popular non-big-celeb accounts are stolen, and exist pretty much to be monetized by shady interests.

  35. There's always suicide by Anonymous Coward · · Score: 0

    Hey, I don't think you can be charged with killing yourself .. can you?

  36. Phish! by Anonymous Coward · · Score: 0

    Could just be Phishing too, trying to get you to click on the legit looking links that really take you to a malicious site...

  37. Well by arse+maker · · Score: 1

    You're fucked :D

  38. GMail is your friend :D by Anonymous Coward · · Score: 0

    Someone in China attempted to access my account about a month ago, and Google (praise be to the google gods), very generously forwarded me the offender's IP address. After about a week of single ping requests, the offender came back online.. and *poof*. He is no longer attempting to steal email accounts anymore. At least, until he gets a new computer.

    Amazing stuff you can do with custom firmware these days, no?

    1. Re:GMail is your friend :D by sexconker · · Score: 2

      Someone in China attempted to access my account about a month ago, and Google (praise be to the google gods), very generously forwarded me the offender's IP address. After about a week of single ping requests, the offender came back online.. and *poof*. He is no longer attempting to steal email accounts anymore. At least, until he gets a new computer.

      Amazing stuff you can do with custom firmware these days, no?

      No one believes your horseshit story. No one believed it back in 1992 when you threatened to hack people over IRC.

  39. Throw away email by DarthVain · · Score: 1

    I don't know if it is sad or not, but I did this a very long time ago.

    I have a throw away email address that I forward (and delete) everything from to one I actually use. When I use my online identity I only use the throw away account (Slashdot included). If it ever becomes compromised (or even just too much spam, which I think was my orginal intent before filters became very good), you can just drop and delete it (if possible), then if you like start a new one and continue the same process. Sure you may have to reconnect to various websites again to re-register or whatever, but seriously 90% are garbage anyway.

    It's not perfect, and won't protect you from everything, but it is at least one level of seperation between you and your online communication. Anyway the way I figure it, it doesn't take much to foil most online attempts, most are looking for the low hanging fruit (usually enmasse, usally scripting, so any deviation throws a wrench into the works). Any amount of effort on their part is too much, as there are plenty of easier marks. If someone of some knowlege really wants to illegally access your stuff (and isn't really worried about repercussions), given time and resources they can probably do it. However I have always maintained that doing so to me would be rather pointless in terms of riches and loot, so why would anyone really bother.

    Tilts my tinfoil hat to a jaunty angle.

    1. Re:Throw away email by Anonymous Coward · · Score: 0

      I have used Spamgourmet for disposable e-mails since forever.

  40. bullshit - gmail does NOT recognize dots by rgbrenner · · Score: 5, Informative

    Good call on posting your BS as an AC.

    Google Help: Receiving someone else's mail
    http://support.google.com/mail/bin/answer.py?hl=en&answer=10313

    Gmail doesn't recognize dots as characters within usernames, you can add or remove the dots from a Gmail address without changing the actual destination address; they'll all go to your inbox, and only yours. In short:

    homerjsimpson@gmail.com = hom.er.j.sim.ps.on@gmail.com
    homerjsimpson@gmail.com = HOMERJSIMPSON@gmail.com
    homerjsimpson@gmail.com = Homer.J.Simpson@gmail.com

    All these addresses belong to the same person. You can see this if you try to sign in with your username, but adding or removing a dot from it. You'll still go to your account.

    1. Re:bullshit - gmail does NOT recognize dots by PickyH3D · · Score: 1, Informative

      That wasn't originally the case though. I believe that when they first instituted the referenced change, they excepted those that were already in conflict.

    2. Re:bullshit - gmail does NOT recognize dots by rgbrenner · · Score: 2

      you're thinking of some other service

      gmail launched in april 04.

      Here's a post from the same month:
      http://www.errorik.com/archive/2004-04.htm

      Here's July 04:
      http://itsmygmail.blogspot.com/2004/07/gmail-address-variations.html

      and Jan 06:
      http://arstechnica.com/uncategorized/2006/01/6022-2/

    3. Re:bullshit - gmail does NOT recognize dots by parkinglot777 · · Score: 2, Informative

      It doesn't happen to you doesn't mean it doesn't exist. Who knows when Google actually "apply the rule" of dot & no dot to their web mail. My friend recently showed me his emails and some of those do not belong to him. He actually know that the person is living in another city and use the email to register for some clubs or certificates. Nothing illegal but it's been for years and still going on. So my assumption from this is that there are some people who have been left when Google has not applied this "dot" rule. These people still have their email address messed up and have no idea what they can do.

    4. Re:bullshit - gmail does NOT recognize dots by synaptik · · Score: 1

      So what happens if...
      1. Alex registers "alleycat@gmail.com"
      2. Alexandra registers "alley@gmail.com"
      3. Alexandra decides to give her pet's veterinary the dotted address "alley.cat@gmail.com"

      --
      HSJ$$*&#^!#+++ATH0
      NO CARRIER
    5. Re:bullshit - gmail does NOT recognize dots by synaptik · · Score: 1

      Oh, nuts, please disregard what I posted above. Somehow, I got it into my memory that-- in addition to what my GP posted-- Google had also opted to use the dot at the end of your email address as a replacement for the + functionality called out in the RFCs (and explicitly disallowed the plus.) But looking back through early news discussions of gmail, I can't find mention of that, so likely it is a fabrication of my mind.

      --
      HSJ$$*&#^!#+++ATH0
      NO CARRIER
    6. Re:bullshit - gmail does NOT recognize dots by Krojack · · Score: 1

      Then the email is sent to "alley.cat@gmail.com" but lands in the "alleycat@gmail.com" mailbox.

      I've been using a series of dots in my gmail for years now when I sign-up for some sites. That way if I start getting shit mail and the TO address matches one of those I used on a site I have an idea who is selling my info (or was hacked).

    7. Re:bullshit - gmail does NOT recognize dots by rgbrenner · · Score: 1

      How you got +3 with second hand information I have no idea. Google says dots are discarded. They have said so since it launched in 2004.

    8. Re:bullshit - gmail does NOT recognize dots by DavidRawling · · Score: 2

      Probably because it really does happen to some people - my own gmail address is signed up with a period, and someone else, presumably in the UK, signed up without. I still get Dell UK newsletters for him (and I'm in AU, so if I used my gmail address with Dell, I expect he would receive some Dell AU newsletters). Just because it's publicly stated that dots are dropped does not mean there wasn't a period where either the rule did not exist, or the code to enforce the rule was broken.

      I've also sent mail to the version of my GMail account without the dot, and it neither bounced nor arrived in my inbox. I therefore deduce that it was delivered somewhere else.

    9. Re:bullshit - gmail does NOT recognize dots by shtrom · · Score: 1

      Google had also opted to use the dot at the end of your email address as a replacement for the + functionality called out in the RFCs (and explicitly disallowed the plus.

      Untrue. I regularly use the + in GMail addresses, and it does fall into the desired recicipient's mailbox: BLAH+WHATEVER@gmail.com properly reaches BLAH@gmail.com's inbox.

    10. Re:bullshit - gmail does NOT recognize dots by synaptik · · Score: 1

      Yes, that was my point. My recollection was untrue.

      --
      HSJ$$*&#^!#+++ATH0
      NO CARRIER
    11. Re:bullshit - gmail does NOT recognize dots by Demena · · Score: 1

      UM.... before gmail actually launched, it was in use for some time by invitations only was it not?

    12. Re:bullshit - gmail does NOT recognize dots by rgbrenner · · Score: 1

      An invitation was required from 2004-2007. After 2007, an invitation was no longer required.
      http://en.wikipedia.org/wiki/Gmail

    13. Re:bullshit - gmail does NOT recognize dots by Demena · · Score: 1

      Thank you for the correction.

    14. Re:bullshit - gmail does NOT recognize dots by Anonymous Coward · · Score: 0

      WHAT!? I had gmail in 03! And... there was a company... they were having trouble with some login because of a DOT. They spent a day and a half wit the dot problem, but I saw the address and said right away: the dot is out of pace, they are misparsing. Could it be a COINCIDENCE? Any kind of advise-interpretation for these facts? Why would gmail choos not to address dots? So NEAR me... djb >:-(

    15. Re:bullshit - gmail does NOT recognize dots by rgbrenner · · Score: 1

      wow.. that's amazing. You had gmail before it even existed
      http://www.nytimes.com/2004/03/31/technology/31CND-GOOGLE.html

      Or you're full of shit.

  41. Okay, here's what you do: by pitchpipe · · Score: 4, Funny

    They done goofed this time. You need to set up a backtrace. I can help you. Send me all of your log-in information and I will get the backtrace set up. Then I will forward your case on to the Cyber Police. These hackers aren't going to know what hit them.

    --
    Look where all this talking got us, baby.
    1. Re:Okay, here's what you do: by sootman · · Score: 3, Funny
      --
      Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
  42. Change your Apple ID by lazarus · · Score: 1

    Not hard.

    How do I change my Apple ID

    You can also change the e-mail address on your Apple account. No loss of your previous purchases.

    I think I would do this on anything where they had my CC info on file. Then pick a strong password for both your old and new e-mail address and wait for them to go away.

    --
    I am not interested in articles about life extension advancements.
  43. they can't win if you don't play by Anonymous Coward · · Score: 0

    I don't have an Apple ID, GMail, Facebook, Twitter, or any other accounts; instead, I have friends and activities in the real world, which is somewhat more difficult to "hack".

    Seriously: put down the laptop and cellphone, go outside and play.

  44. creating twitter, facebook, etc., with your e-mail by j2.718ff · · Score: 1

    I've had part of this happen to me. My spam e-mail address is of the format FirstName.noun@gmail.com. I imagine if someone is trying to think of a quick e-mail address, and they share my name, they might come up with the same one. Or maybe they created a very similar account on gmail, but forgot that they're actually FirstName.noun1@gmail.com.

    Anyway, I'd say on average I get about two notifications per month that someone is trying to create a facebook, twitter, eharmony, or whatever account with this e-mail address, and I need to click a link to proceed. Generally, I just ignore them, and have not had a problem. Only one time did it get annoying -- someone signed up for a dating service (I forgot which), and it didn't do the "click the link to confirm your e-mail address" thing. Instead, I started getting daily e-mails about potential matches. I tried the "reset password" link on the web site, but they required more information than just my e-mail address. Ultimately, I had to send a message to their support department, and they promptly deleted the account.

  45. Mobile Phone by Anonymous Coward · · Score: 0

    If you recently added this account to your mobile phone it may be legitimate. I got multiple notices from gmail regarding logging in to the account from an unusual location. It took a little thought but I backtracked the IP address to a mycingular host in Virginia.

  46. Let me Guess, you're the wifi leach from last week by boskone · · Score: 2

    So, were you wifi leaching, using an evil twin and got MTM'd?

    Honestly, sorry my friend, this kind of stuff is a PITA.

    I would do the following
    1. make sure your pc and router are not pwned
    2. change the email address that all of your services use NOW
    3. for good measure, change all of your passwords.

  47. This time, do it right... by dalroth5 · · Score: 1

    Right, so as others are saying, for Goodness' sake change your email address; but this time, do it right.

    Set up an email forwarder such as bigfoot.net (free [as in beer] for a single forwarding address). Tell bigfoot to forward to your true new account, and make sure you never give out your true address - give _everybody_ your bigfoot address.

    That way, if you ever need to change your true email address again for any reason, it will just be between you and bigfoot.

    --
    "We reject kings, presidents and voting. We believe in rough consensus and running code." Dave Clark, IETF
  48. Just a Wild Guess..... by twmcneil · · Score: 1

    Did you recently piss-off a female? Break up with your girl? Pack up your toothbrush? Suggest you be just friends?

    Thought so.

    --
    "The ferrets, they're every where I tell you!"
  49. correcthorsebatterystaple by tekrat · · Score: 1

    I know your password then! I mean after all, I've memorized that xkcd comic for at least a year...

    --
    If telephones are outlawed, then only outlaws will have telephones.
    1. Re:correcthorsebatterystaple by ios+and+web+coder · · Score: 1

      Damn. I thought it was SO GOOD....

      --

      "For every complex problem there is an answer that is clear, simple, and wrong."

      -H. L. Mencken

  50. Re:Yeah you're right by echnaton192 · · Score: 5, Insightful

    What moron moderated this bullshit "insightful"?

    1. Including navigational software in my case it would rather be 300 EUR. How about steam? How about othe electronic goods?
    2. You do not have to create new accounts, only the password and the emailaddress associated with it - your initial post was already misleading
    3. If you do 2. and not the bullshit you were suggesting, nobody has to rebuy anything

    Again: What moron moderated this insightful?

  51. Small claims court? by MiniMike · · Score: 2

    IANAL, but if you have their identity couldn't you sue them in small claims court? I'm assuming that they would be unlikely to show up, and you would get a default judgement. Then I think you could get a court order to have the sheriff (?) go and ransack their property to retrieve $XXX worth of stuff. Probably much more satisfying than just getting your $500 back.

    1. Re:Small claims court? by Dahamma · · Score: 1

      He just had the address, not the name (or *real* name, as least). An address alone is not enough to sue since it's not enough to prove who did it - in this case he thought the person used someone else's address (someone who probably knew him, but still not enough to accuse them). Plus, he was in SF and the address was in LA. Going through the LA courts without any police/government assistance would have inevitably cost him more in time and effort than he lost.

      The address was *plenty* of information for the police to investigate, of course, but that was the point - they weren't interested and more or less forbade him from confronting anyone there on his own (not that it would have been a particularly smart idea to fly/drive down to a dangerous neighborhood in LA and bang on a random door, anyway).

  52. Scaminatori.oilischious by Impy+the+Impiuos+Imp · · Score: 1

    I don't think an account was compromised, yet. These sound like phishing attempts. I receive emails for the following kinds of junk:

    Your FedEx has arrived but been returned.
    You have attempted to sell your Warcraft account.
    Your eBay (or Paypal or ???) account (something something that sounds like I should check it out), I don't even have accounts

    Etc.

    Never clicked, don't want to. Links typically fake pointing to, say, ebay.com but are actually ebay.com.somesuspicious.url.some.tiny.country

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  53. 300EUR? Oh my. I've changed my mind. by Press2ToContinue · · Score: 1

    Maybe one day you might get the chance to follow your own advice. Some people exist only to act as examples for others, so be sure to let us know how that goes.

    --
    Sent from my ENIAC
    1. Re:300EUR? Oh my. I've changed my mind. by echnaton192 · · Score: 1

      I do not think that this is very likely:
      1. In europe, we tend to have IDs. No way in hell you could even start a financial account without valid ID. Identity theft happens, but it is a very rare event. And I mean rare, at least in my country.
      2. My advise was not included. It was to change emailaddress to a more safe provider. Gmail > hotmail, in case he already uses gmail, look for a more secure provider, last resort be your own provider. Change emailaddress and password on every account. Strong passwords, use paper and pencil or a password safe.

      How do you think your way is better except for losing money? Every f.cking account has the feature to remind you about your lost username in case you forgot and to reset password. They are sent to your email (you know, the one the guy changed if he followed my advise?) Your advise simply stinks. Nothing happened yet and you suggest losing money for no security gain at all.

  54. A familiar list by geminidomino · · Score: 1

    Twitter.
    Apple.
    Facebook.

    Those three have something in common.

  55. Re: Yeah you're right by Anonymous Coward · · Score: 0

    He was commenting in a general sense. Most people have more sense than money, but some are in the fortunate position of being the opposite of that.

  56. I have a popular name on Gmail myself. by Bryan+Bytehead · · Score: 1

    I've had Bryan Prices from Canada, Hong Kong, and the various states (including a person in mine!) that forget that they don't own that particular gmail.com address. I have gotten things to do with Juniper, Apple, business loan applications, cable TV and Internet appointments set (it took them over two weeks, but I think they finally realized that they were using the wrong email on that one), frat brothers that think I'm part of their frat (wrong frat, I'm afraid), people sending me pictures of their Jeeps as if I'm in the market. The automated stuff like the Juniper stuff, I just mark as spam. I have called them, but because I'm not a customer, they refuse to do anything about it. Meanwhile, that guarantees that I will never use them for anything. Notifying the mistaken parties can still be an issue, because they don't change their address book, and the next email arrives to me!

    --
    Bryan
  57. Re:Didn't you mean by cusco · · Score: 0

    ESL, idiot. Get over the fact that not everyone has English as their first language. I've been speaking Spanish for over two decades and still make mistakes far more egregious than that.

    --
    "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
  58. Re:Didn't you mean by echnaton192 · · Score: 1

    I bet my English beats the hell out of your German. Thank you very much. And yes, either safer or more secure would habe been better.

  59. "more saferer," then? by Press2ToContinue · · Score: 0

    or maybe "more safest?"

    --
    Sent from my ENIAC
  60. OUCH NO DON'T INSULT MY GERMAN by Press2ToContinue · · Score: 1

    He doesn't like to be insulted...

    --
    Sent from my ENIAC
    1. Re:OUCH NO DON'T INSULT MY GERMAN by echnaton192 · · Score: 1

      Haha. I looked it up first and dict said "German" is correct. But school was a lomg time ago. Could you get back on topic? Your advice to create new accounts everywere would only cost money and gain no security. Period.

      Try an argument for a change. This is slashdot, we are not here to manually spellcheck each others post.

      Your point to start from scratch every time somebody *tries* to steal your identity and losing hundreds or thousands of dollars while doing so is what exactly? What is the fucking security gain? Especially if we are talking about the apple ID? Why create a new account? What does he gain security-wise?

  61. Happens to me by MerlynDavis · · Score: 1
    I've been dealing with this for a couple of years now...

    I send back replies to people who are emailing me explaining they have the wrong person, and either mark the junk accounts as spam, or contact their customer service and ask for them to remove my email from their account.

    Sometimes, the companies will actually comply, especially if it's for some children's website... (COPPA is a big deal).

    For the ones who don't listen, or can't remove me, I just keep tossing them into the bit bucket.

    --
    -merlyn
  62. Personal email vs Social Email by Maarek · · Score: 1

    Most people only have 1 account. But you shoul hdave more then one.

    Holding account purchases: main email that is your backup and used to hold online purchases for Amazon and other sites.
    personal: used for friends and family
    social: used on message boards and social networks.

    if one is compromised, it will not affect the others.

    1. Re:Personal email vs Social Email by luxifr · · Score: 1

      if one is compromised, it will not affect the others.

      how about not getting compromised at all? works for me...

  63. phishing attempt...? by Angturil · · Score: 1

    are you sure they're actually trying to create those accounts, and not... sending you false emails/links to cause you to "change your password", login to check on stuff via a dummy link that masquerades as the original sites authentication pages?

  64. Self hosted email... by guevera · · Score: 3, Informative

    ...is a bitch to administer. Configuration, authentication, making sure you do all the crap so you don't get flagged as spam. I'll admit that the first time I played with Postfix it took me like two solid days to get everything set up right. You got any recommendations for deployment and admin to save me the headache next time? (Cuz the best part is, it's now been long enough that I've forgotten most of it and it'd probably take me another two days to set up...)

    1. Re:Self hosted email... by Anonymous Coward · · Score: 0

      You could always use a service like Fastmail to host the domain and provide email service. No need to run your own server or software. Yearly fee is quite reasonable.

  65. Accounts are compromised every day by Press2ToContinue · · Score: 1

    and I don't know about you but my email account has become my legal proxy. An mail sent from my account is in many cases as good as a legally signed document. If I wished to, in a 24-hour period. I could empty my bank accounts, liquidate and transfer my assets overseas, secure $50,000 in credit and probably run up about $100k in debt, all with only access to my email. In the USA, there are many cases of debt incurred by fraudulent means for which the victim has been deemed liable for, and for which they spend years fighting legal ramifications. Worse has happened with less information; Personally, I have had an account compromised by someone who knew enough about me that they convinced phone reps to reset my password by a) being charming and b) pretending to be me. That was an eye-opener. No it shouldn't have happened. Yes, it did.

    To me, if my account were to become the object of clear and persistent interest by entities of unknown capabilities and intent, I personally would do what to me is the most prudent thing that I could do and destroy the trail that leads them to my shit. Since I don't know who they are, I have no way of knowing how likely they are to succeed or how they will attempt it. If Apple won't give me what I paid for is the least of my worries - Apple is relatively credible and I have legal recourse, but I have no recourse when my shit disappears over foreign borders into laundered criminal accounts.

    Or, to put it another way, f*ck that shit - I'm changing my accounts.

    --
    Sent from my ENIAC
  66. Und für Ihre Unterhaltung... by Press2ToContinue · · Score: 1

    Konten sind gefährdet jeden Tag und ich weiß nicht wie es euch geht, aber meine E-Mail-Konto zu meiner rechtlichen Proxy. Eine Mail von meinem Konto gesendet wird, in vielen Fällen so gut wie eine rechtsgültig unterschriebene Dokument. Wenn ich wollte, in einem 24-Stunden-Zeitraum. Ich konnte leeren meine Bankkonten, zu liquidieren und übertragen mein Vermögen im Ausland, sichern $ 50.000 Kredit-und wahrscheinlich laufen bis über $ 100k in Schulden, die alle mit nur Zugriff auf meine E-Mail. In den USA gibt es viele Fälle von Schulden durch betrügerische Mittel für die das Opfer als hat haftet für und für die sie jahrelang kämpfen juristische Konsequenzen entstehen. Schlimmer noch mit weniger Informationen passiert, persönlich habe ich ein Konto von jemandem, der genug über mich wusste, dass sie sich telefonisch Wiederholungen mein Passwort durch einen Reset überzeugt gefährdet) ist charmant und b) sich für mich aus. Das war ein Augenöffner. Nein, es hätte nicht passieren dürfen. Ja, es tat.

    Für mich, wenn mein Konto war der Gegenstand der klare und anhaltende Interesse von Einrichtungen aus unbekannten Fähigkeiten und Absichten zu werden, würde ich persönlich, was mir zu tun ist die klügste, was ich zu tun und zerstören könnte die Spur, die sie führt zu my shit . Da ich nicht weiß, wer sie sind, habe ich keine Möglichkeit zu wissen, wie wahrscheinlich sie erfolgreich sein wird oder wie sie es versuchen werden. Wenn Apple nicht geben mir, was ich bezahlt ist meine geringste Sorge - Apple ist relativ glaubwürdig und ich habe Rechtsweg, aber ich habe keine Zuflucht, wenn meine Scheiße verschwindet über ausländische Grenzen in gewaschenen kriminellen Konten.

    Oder, um es anders auszudrücken, f * ck that shit - Ich ändere meine Konten.

    --
    Sent from my ENIAC
    1. Re:Und für Ihre Unterhaltung... by echnaton192 · · Score: 2

      Ah yes. You would delete and recreate all your accounts.

      Just because someone tries to break into your accounts by knowing your email address. Even though the email account is not (!) compromised but changed anyway.

      Regarding your post: the email account was not compromised, so the emails to destroy your life can not be sent. And the address would be changed even in my point of view because of the ongoing attempts to get in. So the horrorscenario you describe won't become a reality. By ignoring adequate steps to react, you give every tease way too much power by just triggering a few password resets online.

      To follow your advice would mean that all I need to do to actually harm someone is to know his email address and try a few password resets using Tor at different companies. And voila: Every account deleted, emailaddress changed, lost hundreds of dollars or much more. We are not only talking about apple but every electronic good bought online by that person. Steam - another 1000 EUR because all the games he bought are gone. And 20 - 40 games is not much.

      You would not strengthen your passwords, change the associated email and tighten security, you would delete your digital personality by "destroying the traces that lead them to" your stuff...

      You keep your emailaddress secret, correct? Because that information alone is dangerous by that logic.

      We can stop here. You do not argue technically, but emotionally. If it makes you feel better to destroy every account you have instead of taking reasonable counter-measures, it is logical for you to do so. But I do not believe that this is a good advice, because it costs a lot of money without a reasonable security gain.

      Thank you for using autotranslation, but I am afraid that every German reading this text knows that this is not manually written German from a foreigner but an automatic tranlation. So I am afraid that my claim that my English beats the hell out of your German, is still not falsified ;)

    2. Re:Und für Ihre Unterhaltung... by Press2ToContinue · · Score: 1

      Next time, before I spend any time trying to explain something to a German, I will remember you are right.

      --
      Sent from my ENIAC
    3. Re:Und für Ihre Unterhaltung... by mgcarley · · Score: 1

      Inclined to agree with echnaton192 - even without a significant amount of knowledge in German, the spaces between the dollar signs and in f * ck are a fairly clear indicator of ye olde Google Translate ;)

      --
      Founder & COO, Hayai India (hayai.in) / USA (hayaibroadband.com) // t: @mgcarley
  67. Happens to me, too... by luxifr · · Score: 1

    ...turns out the other person has a very similar email address... something like my address being jkirk@gmail.com and his jtkirk@gmail.com and I'm not sure if people just don't memorize the t in his email address b/c in everyday-life they'd call him "Jim" or "James" or "Mr. Kirk" but not "James Tiberius" or even know about his second name or if it's because he has typos on is business cards or whatever... in fact this /. story just made me write another email to him suggesting he might want to tell people his email address is j.t.kirk@gmail.com

    oh and: I was lucky finding out his real email address because I could convince one of his relatives that he got the address wrong and that he should ask Jim to clarify that, which made Jim contact me eventually...

  68. Re:Yeah you're right by Anonymous Coward · · Score: 0

    How about steam?

    Press the "Change contact email" button you fucking moron.

  69. Re:Didn't you mean by Anonymous Coward · · Score: 0

    "Sprechen Sie Deutsch?

    Nah, I don't speak Dutch, just German ... ;>)