Linked by Thom Holwerda on Mon 6th Aug 2012 11:12 UTC
Mat Honan got hacked, and lost all the data on his MacBook, iPad, and iPhone. How? Somebody broke into his iCloud account. Brute force attack? Simple password? No, not really - the hacker called Apple tech support, and convinced the person on the phone he was really Mat Honan. Apple then reset the iCloud password. The dangers of a monoculture, kids. Even Steve Wozniak has doubts about everything going into the cloud.
Thread beginning with comment 529856
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
Member since:2011-05-12
This time, and a very rare time, this wasn't Thom doing his anti-Apple act.
He reported just the facts and added a general warning.
And it's a very serious warning. We become increasingly depended on stuff that's out of our control and quite literally out of our reach. Too many people can make mistakes that make you the victim. Resetting passwords, cutting wires, wiping hard disks, dropping a server.
Member since:2012-03-14
Member since:2005-12-18
Your "B" assumption is flawed. You can't have physical control of any online service unless you run it by yourself.
So, your proposal would imply a naive person running a mail server and a openid authentication service on his own machine. A potentially more dangerous situation.
Member since:2012-03-14
i agree with you. that is why i didn't suggest you running your own server as the ultimate security.
The fact is this game is flawed, you can't win. The only strategy is to make sure that the other side winning is really difficult and making sure you can pick-up the pieces *after* the other guy wins.
That's why i mentioned the "physical control" and the real physical customer service of my university. they won't reset passwords longdistance and they won't give you the passsword unless you literally come in and show yourself with your id.
it can still be fooled but if it is, i can take back my stuff afterwards. try doing that with a million client company overseas that doesn't even have/show a simple of contacting themselves (google) or one that does but it is as weak /useless as the "what's my pets name" questions (Apple).
Member since:2005-06-29
what exactly is the "monoculture" danger here? *
iPhone, iPad, MacBook Air, iCloud. All his computing devices rendered useless because he relied on a monoculture.
I have Windows, Linux, Android phone/tablet, and a separate, independent cloud backup solution (which is encrypted and only I know the password - not even the provider itself knows my password; if I lose it, I can't access my data anymore since its encrypted). No monoculture, hence, no danger is me being knocked out because my monoculture gets knocked out.
This is not rocket science.
Edited 2012-08-06 14:14 UTC
Member since:2012-03-14
"what exactly is the "monoculture" danger here? *
iPhone, iPad, MacBook Air, iCloud. All his computing devices rendered useless because he relied on a monoculture.
I have Windows, Linux, Android phone/tablet, and a separate, independent cloud backup solution (which is encrypted and only I know the password - not even the provider itself knows my password; if I lose it, I can't access my data anymore since its encrypted). No monoculture, hence, no danger is me being knocked out because my monoculture gets knocked out.
This is not rocket science. "
Aparrently it is... Correlation does not mean causality.
lets say you would use androidlost (http://androidlost.com) on your android phone, lojack (http://www.absolute.com/lojackforlaptops/features) for your windows laptop, and prey on your linux laptop (https://panel.preyproject.com/forgot).
In all of them you activate the remote wipe feature. In all of them you've got a nice "i forgot my password" webpage that allows you to resend a reset request for your email. But your email accounts, all of them, were hacked. so what now? how has your avoidance of "monoculture" stopped it?
the question here is not the reliance on apple's system. the question is that we've chainlinked all of our email accounts and webservices in to either a something of a pyramid or, in some times, an endless loop of accounts. And if a sufficiently high weak link can be broken by social engineering, you're royally screwed.
Specially if, like this guy, you activate remote wipe without even considering doing local backups. On that issue alone i find serious problems feeling sorry for him. that's doubly dumb and whining shouldn't be allowed here.
you can join apple or google or microsoft monoculture as much as you want. just either don't give them the power to wipe everything (i would say phone wipe is ok, but laptop is better served with encryption) or do backups!
Member since:2010-01-07
Features
Linked by Thom Holwerda on 05/21/13 21:38 UTC
At an event earlier today, Microsoft unveiled the next Xbox - the third model, but confusingly named Xbox One. The big focus was TV, integrated Kinect, and all the other stuff we all expected to be forced down our throats. I think it took them 25 minutes to actually come to what should be the core of the story: gaming. Nothing groundbreaking in the gaming department, except for how Microsoft intends to handle the used games market and borrowing games from friends: pay up, buddy!
Linked by Thom Holwerda on 05/20/13 11:29 UTC
The day has finally come! Jolla has finally announced the launch device for its Sailfish operating system - and by god this is a looker. It's decidedly different from other phones out there, but it has good specifications and carries a relatively reasonably price tag - EUR 399, and it's up for pre-order today, shipping in the fourth quarter of this year.
Linked by Thom Holwerda on 05/18/13 21:33 UTC
Why does Google get so much credit in the technology industry? Why, despite the company's many obvious failings, do many geeks and enthusiasts still hold a somewhat positive view on the all-knowing technology giant? A specific talk at Google I/O this week provides the answer.
Linked by David Adams on 05/16/13 4:23 UTC
OSNews is a sponsor of this year's O'Reilly OSCON in Portland, Oregon, USA. A lucky OSNews reader will win a free three-day pass, including two tutorials days. To win the pass, post a comment on this story saying something about Open Source Software or OSCON. We'll pick a winner at random next week. If you don't have an OSNews account, you may email us your entry. Part of the conference is the 9th annual Open Source Awards, and today the 16th is the deadline for nominations. If you'd like to nominate an outstanding open source contributor, do it here. Read on for more information about OSCON. Update: The 20% discount code for OSNews readers is "OSN."
Linked by Thom Holwerda on 05/11/13 21:41 UTC
"Windows is indeed slower than other operating systems in many scenarios, and the gap is worsening." That's one way to start an insider explanation of why Windows' performance isn't up to snuff. Written by someone who actually contributes code to the Windows NT kernel, the comment on Hacker News, later deleted but reposted with permission on Marc Bevand's blog, paints a very dreary picture of the state of Windows development. The root issue? Think of how Linux is developed, and you'll know the answer.
Linked by Thom Holwerda on 05/08/13 14:22 UTC
This is one of those news items that's fun to write, fun to read, fun to comment on, and where no one will be able to say anything unkind. It's all just one big ball of awesome fluffiness. TuneTracker, the BeOS radio automation software, has just released something very special: TuneTracker System 5, the first version designed entirely and specifically for Haiku. In fact, it actually includes Haiku in the software package. Better yet, TuneTracker also unveiled several system-in-a-box products - which have Haiku and TuneTracker pre-installed.
Linked by Thom Holwerda on 05/02/13 15:28 UTC
Exactly twenty years ago, a document was published that played a huge role in establishing the web as we know it today. Twenty years later, and this simple and straightforward document is proof of an irrefutable fact: while closed technologies can change markets, open technologies can change the world.
Linked by Thom Holwerda on 04/29/13 21:06 UTC
Oh multitasking. That staple of computing that got thrown out the window with many modern smartphones. We got some rudimentary thing in its place - but even as multitasking on phone and tablets improves, its user-visible side remains cumbersome. Windows 8 has a neat implementation, and now it's time Android follows in it footsteps.
Linked by Thom Holwerda on 04/24/13 22:24 UTC
They're here! Whether that excites you or not remains to be seen, but the Galaxy S4, which will most likely become the best selling Android smartphone of the year by a huge margin, has been reviewed by all the major sites, and there's lots of interesting conclusions in there - although I think most of you will get the gist.
Linked by Thom Holwerda on 04/18/13 11:21 UTC
Nokia has posted its quarterly results for the first quarter of 2013, and just like the quarters that came before, there's not a whole lot of good news in there. The rise in Lumia sales still can't even dream of making up for the sales drop in Symbian phones, and when broken down in versions, the sales figures for Windows Phone 8 Lumias in particular are very disappointing. In North America, Nokia is getting slaughtered.More Features »
Sponsored Links
Member since:
2012-03-14
what monoculture? the guy had gmail, twitter, facebook, icloud and old .mac accounts, all entangled and chained up in some sort of mail accounts pyramidal chain, the same way pretty much everyone has...
what exactly is the "monoculture" danger here? *
there's basically 2 lessons from here:
a) do the damn backups! i keep repeating this and people just keep going without doing them. and them wonder what happened to their data...
b) every webservice in the planet will ask you to link your account with some other service account. Just make sure that the final (or better yet, more than one final) account is something you really have control of, as in physical control of.
I use my old university alumni perpetual account. They have a actual client service you can walk in, they ask for my citizen id, they check the data. (and actually i can even use my national citizen card smartcard and encryption features as a login/two factor authentication with it).
if you can't have some sort of this kind of physical way of controlling your final account, use two-factor authentication with something you physically control. something Yubikey-like would be perfect, but your mobilephone number is a reasonable option too.
------
* thom, can we stop with the blind anti-apple bias that's going on around lately? yes, apple can be (and should be) criticized like every other company on earth, but you've really been completely engulfed by it lately. is everything wrong in the world apple's fault?
this case was about social engineering. the same kind of social engineering that breaks every other security system in the world. Although i have no doubt that apple service did something really wrong here. But i don't trust apple with my remote encryption keys and other stuff. And for the matter i don't trust google with this kind of stuff any more than apple.