After calling out Tim Cook personally, getting Gawker Media involved, Gizmodo also carrying the story written by a different editor, Cnet carrying the story, and Mat posting under his own name, you are still going with the denial angle?
The poster says he was contacted by someone who says he is the hacker. Nothing was confirmed about AppleCare involvement, though it is a possibility - especially if the hacker knows his victim.
Wrong. Read all the way to the end of the article: Apple already fessed up.
Update Three: I know how it was done now. Confirmed with both the hacker and Apple. It wasn’t password related. They got in via Apple tech support and some clever social engineering that let them bypass security questions.
Had the user set up Two Factor authentication, his Google stuff probably would have been safe"
As for 2 factor authentication preventing this, it would have kept my google account from being deleted, and probably kept them off of my Twitter feed, but it wouldn’t have prevented my Macbook from being wiped. That, which is the worst effect of all this so far, was possible as soon as they were able to log into iCloud. Nonetheless, I’m setting it up on my Google account once I have access to it again.
As for all his devices being wiped by one single hack, relying on a single point of security, makes for a single point of failure. I'm not sure I would have chosen this route even if I was a total Apple fan joined at the hip to iCloud.
Apple support has some serious 'splaining to do. But this is likely to happen again, probably not for a while, but any time you are tied so closely to one single point of security.
And what would he have done if he was just Joe Corporate Drone?
He and Gawker’s Scott Kidder then got on the phone with contacts at Google and Twitter trying to help me put the brakes on. A friend at Twitter helped expedite the request to suspend the account, which stopped the tweeting.
Seriously? contacts at Google and Twitter? 1) very few people have that kind of contacts. 2) didn't those two companies just violate their own security standards by helping this guy kill accounts he couldn't prove were his??
Sadly, it really can't be considered user friendly at the moment. I don't expect to take any market share away from, say, Linux Mint. In fact, I should probably actively discourage it, at least for this release. However, this fit my use case, and I figure at least a few others had similar interests but were disappointed no one distro provided all of them at the same time.
The other thing to consider is the many potential points of failure when a distro relies on other distros with dissimilar distribution methods, library tools, packaging tools, expected directory structure, etc.
Just one little change can cause a huge ripple effect. Arch, last month changed directory structures followed by changing/lib to/usr/lib. It bricked a lot of machines requiring much manual messing around to get things back on track.
I hate Chrome. Every time I open a tab, it open 1 or 2 more processes.
Its called Sandboxing, and its there for your protection. It keeps one tab from taking down your whole computer. And they don't fight with one another unless you have some serious other problems on your computer. When was the last time you did a virus scan?
Same as the latest version of IE. It too sandboxes. Learn what you are talking about before you
My last block of Apple stock is going to be sold in the run up to the iPhone 5 release. I will be out of that issue prior to the actual announcement. Its been a good run, more than doubled my investment in a couple years, but now its time to go, ahead of the disappointment sure to arrive when iPhone 5 is nothing but an incremental improvement.
Marketting research tells you who wants to buy your stuff.
Not entirely. More importantly, market research also tells you what people who are not buying your products want or need. Getting feedback from people who do not choose your products can be more important than feedback from your customers.
But Apple didn't do that, they only ate their own dog food.
Every month, Apple surveys iPhone buyers and Joswiak explains what Apple is able to glean from these surveys. And as you might expect, Apple conducts similar surveys with iPad buyers.
So what they learned only helps them attract that same customer again and again, which is precisely why most apple fanboys dump their perfectly good current model and rush out an replace it with the next model the instant it comes out, even if they have to pay an Early Termination Fee to do so.
Far from attracting the majority of new customers, Apple is mostly eating its young, singing to its own choir, reselling to the same crowd.
The research plan is fundamentally flawed, and has resulted in Apple's total domination of the smartphone market being cut in half over the years.
Yeah that is the first thing I check when shopping for new hardware, which one gets had the most profit into the pockets of the manufacturer.
Exactly.
Why are Apple customers so proud of the fact that they overpay for their products?
Would we all see cheaper cell service if carriers pockets weren't being emptied into Apple's coffers? How about iPhone users start giving back to the their fellow citizens by switching to Android, instead of inflicting the cost of these overpriced device on the rest of the cell phone users. Every iPhone sold is a money out of my pocket, by way of higher carrier bills.
The shadow password scheme there, tested, maintained, and general purpose in nature. You can use it for any purpose. It's not just for system accounts.
Ssh identification is over kill for your average forum login. While it might be useful for mail systems, it's not common to use it for such, even in the Unix would.
Users can multitask during a text chat session, and the support staff can sit and wait while the user looks up their account code, or what ever.
The user doesn't have to put up with surly condescending attitude on a chat call. The user doesn't have to put up with poor language skills or a heavy accent, or a shitty phone connection. The user doesn't have to give out a telephone number, and be monitored and recorded for quality control purposes.
Chat sessions aren't something users were pressing for, they are an invention of the service organizations to cut costs.
If those organizations find they don't like them, I'm sure they could hire some competent English speaking help and actually teach them something more than reading through a solution tree in a book for a product they have never laid eyes on, while ignoring every thing the user is saying.
Especially when these solution trees invariably end with some stupid advice "like factory reset your device" thereby wiping out weeks if not months of work.
Also, people tend to think while typing, and questions are actually more well though out. A stead stream of verbal "um, ah, like, seedimsayin?, I mean, Huh? Where? How do I do that? Wait while I find a pencile" etc. etc. etc. is not an efficiency model I like to engage in. Neither is explaining the problem to 4 consecutive flack catchers before finally finding someone who as even the shadow of a clue.
So, the service industry made this bed, they can damn well sleep in it. You built it, you fix it.
The problem is that 'everyone' in that sentence is only referring to those who are tech savvy. Majority of my family uses the same password for all their accounts (I know this from being in-house tech for everyone).
Its not that big if a deal.
There are several sites I read and very rarely post on, where my password is the same nonsense characters simply to save brain cells. Anyplace that matters gets a unique password. None of these reuse an email account password. But there are many trivial accounts where I use the same password
Since I log in with different names on many of these sites there is no real easy way to match names to any other account.
But the main point here is that its the users choice and the users accounts to risk, not something Yahoo should put at risk by storing unencrypted passwords.
Salted passwords don't matter - you can recover the password. Heck, you can reverse engineer hashing algorithms by just making a bunch of passwords then recovering them.
That would require you not only steal the password hash file but also the software used to create that file, including the salt, etc.
The point in the current case is that the passwords WERE NOT stored encrypted in any form. They were stored in clear text despite every recommendation never to do this on any system. Its inexcusable.
Every Linux distribution since the Pleistocene has defaulted to at least a minimally encrypted password file. Yahoo runs nothing but Linux. They would have had to intentionally bypass Linux security basics and roll their own to end up in such a mess.
They deserve to be sued. Still it will be a hard case to win because there is no law that says they have to be careful or competent.
By excluding evidence she has already done something. She's done something in a way that supports her prior public pronouncements that Samsung would not prevail. A self fulfilling prophecy.
She didn't do this to the company trying to game the system (Apple) she did it to the company trying to offer its own defense.
What does she have to do in your mind to qualify as "doing something"? Pull out a gun and shoot the Samsung attorney?
Actually, I called this Bogus at the time the story broke on SlashDot.
If the story had a more plausible origin I might have believed it, but to have originated from a top Nuclear Scientist in a paranoid state, who somehow sneaks an email past his keepers is just silly. If such a scientist has that ability, and a desire to embarrass the state they would leak far more devastating information than a childish exploit.
The email is as likely to have come from someone who actually tried (and perhaps failed) to plant such an exploit within Iranian systems. Or it was, as I suggested totally made up. Perhaps to gauge the reaction to a known false claim.
Slashdot Mirror
If you never forget your password, why do you need to enter them again?
Maybe because you got hacked?
You did read this story didn't you?
That you never head of him means nothing.
Google Him. The story is everywhere.
Apparently a lot of people know him. And some of those guys reached into Google and Twitter for him. And Google and Twitter RESPONDED!!!
Could you do that?
Seriously?
After calling out Tim Cook personally, getting Gawker Media involved, Gizmodo also carrying the story written by a different editor, Cnet carrying the story, and Mat posting under his own name, you are still going with the denial angle?
Sure, just read that string over a the phone to a tech support operator in India some time, moron.
Quick, now, without cut and paste could you please enter those again?
No.
Though not.
Fail.
The poster says he was contacted by someone who says he is the hacker. Nothing was confirmed about AppleCare involvement, though it is a possibility - especially if the hacker knows his victim.
Wrong. Read all the way to the end of the article: Apple already fessed up.
Update Three: I know how it was done now. Confirmed with both the hacker and Apple. It wasn’t password related. They got in via Apple tech support and some clever social engineering that let them bypass security questions.
Had the user set up Two Factor authentication, his Google stuff probably would have been safe"
As for 2 factor authentication preventing this, it would have kept my google account from being deleted, and probably kept them off of my Twitter feed, but it wouldn’t have prevented my Macbook from being wiped. That, which is the worst effect of all this so far, was possible as soon as they were able to log into iCloud. Nonetheless, I’m setting it up on my Google account once I have access to it again.
As for all his devices being wiped by one single hack, relying on a single point of security, makes for a single point of failure.
I'm not sure I would have chosen this route even if I was a total Apple fan joined at the hip to iCloud.
Apple support has some serious 'splaining to do. But this is likely to happen again, probably not for a while, but any time you are tied so closely
to one single point of security.
And what would he have done if he was just Joe Corporate Drone?
He and Gawker’s Scott Kidder then got on the phone with contacts at Google and Twitter trying to help me put the brakes on. A friend at Twitter helped expedite the request to suspend the account, which stopped the tweeting.
Seriously? contacts at Google and Twitter?
1) very few people have that kind of contacts.
2) didn't those two companies just violate their own security standards by helping this guy kill accounts he couldn't prove were his??
Sadly, it really can't be considered user friendly at the moment. I don't expect to take any market share away from, say, Linux Mint. In fact, I should probably actively discourage it, at least for this release. However, this fit my use case, and I figure at least a few others had similar interests but were disappointed no one distro provided all of them at the same time.
The other thing to consider is the many potential points of failure when a distro relies on other
distros with dissimilar distribution methods, library tools, packaging tools, expected directory structure, etc.
Just one little change can cause a huge ripple effect. Arch, last month changed directory structures followed by changing /lib to /usr/lib. It bricked a lot of machines requiring much manual messing around to get things back on track.
I hate Chrome. Every time I open a tab, it open 1 or 2 more processes.
Its called Sandboxing, and its there for your protection.
It keeps one tab from taking down your whole computer.
And they don't fight with one another unless you have some serious other problems on your computer.
When was the last time you did a virus scan?
Same as the latest version of IE. It too sandboxes.
Learn what you are talking about before you
Firefox fixed that problem ages ago.
No, they didn't.
They just made it easier to blame the plugin writers due to Mozilla's incessant API tweaking.
I'm guessing you didn't read the GPs last sentence.
Exactly my plan, because when the detailed specs are ANNOUNCED the rumor becomes news.
I suspect it will be a marginal improvement at best.
Exactly.
My last block of Apple stock is going to be sold in the run up to the iPhone 5 release. I will be out of that issue prior to the actual announcement. Its been a good run, more than doubled my investment in a couple years, but now its time to go, ahead of the disappointment sure to arrive when iPhone 5 is nothing but an incremental improvement.
Buy the rumor. Sell the news.
Marketting research tells you who wants to buy your stuff.
Not entirely. More importantly, market research also tells you what people who are not buying your products want or need. Getting feedback from people who do not choose your products can be more important than feedback from your customers.
But Apple didn't do that, they only ate their own dog food.
Every month, Apple surveys iPhone buyers and Joswiak explains what Apple is able to glean from these surveys. And as you might expect, Apple conducts similar surveys with iPad buyers.
So what they learned only helps them attract that same customer again and again, which is precisely why most apple fanboys dump their perfectly good current model and rush out an replace it with the next model the instant it comes out, even if they have to pay an Early Termination Fee to do so.
Far from attracting the majority of new customers, Apple is mostly eating its young, singing to its own choir, reselling to the same crowd.
The research plan is fundamentally flawed, and has resulted in Apple's total domination of the smartphone market being cut in half over the years.
Yeah that is the first thing I check when shopping for new hardware, which one gets had the most profit into the pockets of the manufacturer.
Exactly.
Why are Apple customers so proud of the fact that they overpay for their products?
Would we all see cheaper cell service if carriers pockets weren't being emptied into Apple's coffers? How about iPhone users start giving back to the their fellow citizens by switching to Android, instead of inflicting the cost of these overpriced device on the rest of the cell phone users. Every iPhone sold is a money out of my pocket, by way of higher carrier bills.
It's been over 60 years. It's long since time to stop blaming Hitler.
Oh, wait. No it isn't. Guilty is fucking guilty no matter how much time has passed.
Godwin!.
The shadow password scheme there, tested, maintained, and general purpose in nature. You can use it for any purpose. It's not just for system accounts.
Ssh identification is over kill for your average forum login. While it might be useful for mail systems, it's not common to use it for such, even in the Unix would.
Users can multitask during a text chat session, and the support staff can sit and wait while the user looks up their account code, or what ever.
The user doesn't have to put up with surly condescending attitude on a chat call.
The user doesn't have to put up with poor language skills or a heavy accent, or a shitty phone connection.
The user doesn't have to give out a telephone number, and be monitored and recorded for quality control purposes.
Chat sessions aren't something users were pressing for, they are an invention of the service organizations to cut costs.
If those organizations find they don't like them, I'm sure they could hire some competent English speaking help and actually teach them something more than reading through a solution tree in a book for a product they have never laid eyes on, while ignoring every thing the user is saying.
Especially when these solution trees invariably end with some stupid advice "like factory reset your device" thereby wiping out weeks if not months of work.
Also, people tend to think while typing, and questions are actually more well though out.
A stead stream of verbal "um, ah, like, seedimsayin?, I mean, Huh? Where? How do I do that? Wait while I find a pencile" etc. etc. etc. is not an efficiency model I like to engage in. Neither is explaining the problem to 4 consecutive flack catchers before finally finding someone who as even the shadow of a clue.
So, the service industry made this bed, they can damn well sleep in it. You built it, you fix it.
Its his accounts that are at risk. His choice to take the risk. Not Yahoo's choice. See the difference?
The problem is that 'everyone' in that sentence is only referring to those who are tech savvy. Majority of my family uses the same password for all their accounts (I know this from being in-house tech for everyone).
Its not that big if a deal.
There are several sites I read and very rarely post on, where my password is the same nonsense characters simply to save brain cells.
Anyplace that matters gets a unique password. None of these reuse an email account password. But there are many trivial accounts where I use the same password
Since I log in with different names on many of these sites there is no real easy way to match names to any other account.
But the main point here is that its the users choice and the users accounts to risk, not something Yahoo should put at risk by storing unencrypted passwords.
Salted passwords don't matter - you can recover the password. Heck, you can reverse engineer hashing algorithms by just making a bunch of passwords then recovering them.
That would require you not only steal the password hash file but also the software used to create that file, including the salt, etc.
The point in the current case is that the passwords WERE NOT stored encrypted in any form. They were stored in clear text despite every recommendation never to do this on any system. Its inexcusable.
Every Linux distribution since the Pleistocene has defaulted to at least a minimally encrypted password file. Yahoo runs nothing but Linux. They would have had to intentionally bypass Linux security basics and roll their own to end up in such a mess.
They deserve to be sued. Still it will be a hard case to win because there is no law that says they have to be careful or competent.
It is not called treason.
Look it up.
It didn't seem to bother Eric Holder to be held in contempt of Congress in an election year. What would make this any different?
By excluding evidence she has already done something.
She's done something in a way that supports her prior public pronouncements that Samsung would not prevail.
A self fulfilling prophecy.
She didn't do this to the company trying to game the system (Apple) she did it to the company trying to offer its own defense.
What does she have to do in your mind to qualify as "doing something"? Pull out a gun and shoot the Samsung attorney?
How did they know it was Tunderstruck ?
Hell, I didn't even know the song was released inf Farsi .
[peeks at Google Translate, No, no-can-do].
Actually, I called this Bogus at the time the story broke on SlashDot.
If the story had a more plausible origin I might have believed it, but to have originated from a top Nuclear Scientist in a paranoid state, who somehow sneaks an email past his keepers is just silly. If such a scientist has that ability, and a desire to embarrass the state they would leak far more devastating information than a childish exploit.
The email is as likely to have come from someone who actually tried (and perhaps failed) to plant such an exploit within Iranian systems. Or it was, as I suggested totally made up. Perhaps to gauge the reaction to a known false claim.