Slashdot Mirror
Developer Loses Single-Letter Twitter Handle Through Extortion
Hugh Pickens DOT Com writes "Naoki Hiroshima, creator of Cocoyon and a developer for Echofon, writes at Medium that he had a rare one-letter Twitter username — @N — and had been offered as much as $50,000 for its purchase. 'People have tried to steal it. Password reset instructions are a regular sight in my email inbox,' writes Hiroshima. 'As of today, I no longer control @N. I was extorted into giving it up.' Hiroshima writes that a hacker used social engineering with Paypal to get the last four digits of his credit card number over the phone then used that information to gain control of his GoDaddy account. 'Most websites use email as a method of verification. If your email account is compromised, an attacker can easily reset your password on many other websites. By taking control of my domain name at GoDaddy, my attacker was able to control my email.' Hiroshima received a message from his extortionist. 'Your GoDaddy domains are in my possession, one fake purchase and they can be repossessed by godaddy and never seen again. I see you run quite a few nice websites so I have left those alone for now, all data on the sites has remained intact. Would you be willing to compromise? access to @N for about 5 minutes while I swap the handle in exchange for your godaddy, and help securing your data?' Hiroshima writes that it''s hard to decide what's more shocking, the fact that PayPal gave the attacker the last four digits of his credit card number over the phone, or that GoDaddy accepted it as verification. Hiroshima has two takeaways from his experience: Avoid custom domains for your login email address and don't let companies such as PayPal and GoDaddy store your credit card information."
like so many other articles, this just seems like another reminder to never ever use godaddy
Who, the person working at GoDaddy? Or the owner of the domain for using GoDaddy?
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
Methinks if Mr. Hiroshima had the funds available, or pro-bono lawyer stepped in, there's grounds for a lawsuit against at least PayPal if not also GoDaddy.
Colin Dean Go a year without DRM
Avoid custom domains for your login email address
Honestly, I don't think that would have helped. I doubt it's much harder to gain control of someone's gmail, yahoo or hotmail account if they are as motivated as it sounds like his attacker was.
Once you gain control of anyone's email account, even if the attacker doesn't have custom domains to hold for ransom, they could easily threaten bank accounts, etc etc.
I'd be talking to a lawyer. Sounds like someone at Paypal owes $50k to Mr. Hiroshima.
don't let companies such as PayPal and GoDaddy store your credit card information.
I wonder, does Mr. Hiroshima realize that consumers have little to no (closer to the latter) control over what a corporation does with our credit card info once we make a purchase with them?
Does he know of some nuclear option the rest of us aren't aware of?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
This is a story about how 'real' people hate secure things. Nerds are all about creating encryption and security that requires knowing a secret key. Real world people deal with the fact that they forget secret keys, and want companies to restore their data for them. So for companies to keep customers, they have to create workarounds for the secret keys.
As a result the only way to for sure secure something, is to not depend upon companies who have 'real' people for customers.
When the Target data breach happened, I commented here about some of the advantages to using throw-away, preload credit cards (which limits your potential loss and allows you to quickly switch to an entirely different account if you feel the other might be compromised). I was modded down by people who have bought into the whole big-bank credit card racket, and the attitude "why should I worry, when the bank is responsible and I'll eventually get my money back". Well here is yet another advantage of using preloaded credit cards. You load money on it, pay your annual hosting fees, etc, and then just toss it and get another next year to make the next annual payment. This story illustrates the advantages of using an entirely different credit card per service, so the card you use with Godaddy is not the same as you use with Paypal.
Yes, yes, it will cost you $3 each time you load a card to make that yearly payment, but you can decide for yourself what that extra $3 can buy you.
Better known as 318230.
After all Twitter knows which new eMail-address is holding @N. Should not be to hard to figure the real person behind it. And simply asking Twitter to hand it back should also work.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
That's totally absurd. I can't believe a service provider like Godaddy has no record history or history of customer information change. Of course, this historical informaiton may not be available to the first level of customer support. But come on... that shouldn't be the end of it.
Actually, I'm surprised that a service like Godaddy doesn't have checks in place for cases like this. An account where ALL the customer information is changed within a short period of time, should raise alarm bells. The owner, under the contact information previously available, should automatically be contacted.
"It's entirely your fault that a thief held a gun to your wife's head and demanded your Babe Ruth-autographed baseball. If you didn't have a Babe Ruth-autographed baseball in the first place, it never would have happened."
Everything is better with chainsaws.
This is like kidnap or a mugging. At no point do I have an actual incentive to give in to such a person's demands. "We won't hurt you / them / your website if you do X". I have *absolutely* no guarantee of that.
I *cannot* win. If I do everything you request, you could still trash my domain / stab me anyway / kill your hostage and there's nothing I can do to stop that.
As such, non-compliance is no different to compliance in such a situation. So why voluntarily give them MORE power over you / your assets?
As it is you would have to wipe servers, settings, email etc. and start again even if they did honout their agreement.
But then, you have to remember, this person is already committing a crime... what's in their conscience that will make them honourcan agreement concerning that crime.
Let them squirm, report them, regain control when you can, then purge their access from your systems.
Anything else is just stupid.
That would be Paypal that gave out the last four digits. And really, that's not at all uncommon - you can usually get that information from just about anyone who's holding your credit card information "Hi, I wanted to confirm which card I have associated with this account. Are the last four digits 1234? No, they're 8462? Ah, that explains it, thank you." Hell, they tend to be listed on every single email receipt sent unencrypted across the internet.
GoDaddy is still on the hook in my eyes though - given the completely unsecure treatment of the last four by pretty much everyone, using it for any sort of authentication purposes is completely asinine.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
Of course, the customer support rep wants to be helpful, and the person already knows the other account identifiers... so the idea of fraud never crosses their mind.
Um, they don't have to make a fraud/non fraud. The policy should be to never give out details. Ever.
No sig today...
"Hi, I wanted to confirm which card I have associated with this account. Are the last four digits 1234?
"Our policy is to never give out that sort of information on the 'phone. Why don't you log into your account and check?"
No sig today...
This is the truth, some customers are not partial to jumping through hoops for secured access, at all.
For those of us that want the hoops, why don't these companies offer you the ability to opt-out of the 'workaround' security practices?
Because "real" customers would think they want to have the higher level of security, when in reality they still want the lower level of security. If the company offers higher security to them, the customer will accept it, and then the customer will get upset when the company delivers it to them. The customer will then change to a competitor who promises high security but in reality delivers low security, because that is what they really want.
Classic IT mistake - you need to deliver what the customer wants, not what they ask for.