Twitter hacked again

[valkyrie]

Re: Twitter hacked again

Dudes, what do you expect.....it's 140 characters of pretty text. Just remember that. I would love to be a fly on the wall in the Twitter support department, what a mind numbing job that must be.

xor

The daily come to Jesus meetings must be stupendous!

Regards,

valkyrie
_________________________________________________
saprere aude

[xor]

Re: Twitter hacked again

Dudes, what do you expect.....it's 140 characters of pretty text. Just remember that. I would love to be a fly on the wall in the Twitter support department, what a mind numbing job that must be.

xor

[theprez98]

Re: Twitter hacked again

Have I mentioned that the Twitter people are totally fucking incompetent and don't know what the fuck they're doing?

Apparently after failing to assign a help request to someone for 14 days, the request is automatically closed as if someone actually helped you.

It's been two weeks and we haven't been able to get to your request. Twitter is a free service, and while we try to provide as much help as we can, we can't get to every email. Sorry about that!

[theprez98]

Re: Twitter hacked again

Have I mentioned that the Twitter people are totally fucking incompetent and don't know what the fuck they're doing?

Help request...

Submitted 13 days ago
[Still] Awaiting assignment to a help desk operator.

Looks like they're on top of it!

[bascule]

Re: Twitter hacked again

Have I mentioned that the Twitter people are totally fucking incompetent and don't know what the fuck they're doing?

[barry99705]

Re: Twitter hacked again

Many years ago I was working Desktop Support at a large multinational, and it was common practice to ask users for their passwords when doing work on their machines. We got a call from HR Drone asking for help. The tech that got the call asked her for her password and she hesitated for a bit, and then whispered "spankme".

I'll be right over!

[b0n3z]

Re: Twitter hacked again

haha, I was speaking more in terms of our AKO accounts we use and the limits for them.

Not surprising really though on the total number of passwords being superman.

[bascule]

Re: Twitter hacked again

In other news, 37signals, where all this Ruby on Rails stuff that Twitter uses originates, apparently stores passwords in plaintext. Way to go guys.

[streaker69]

Re: Twitter hacked again

sigh..

So in mentioning superman, it reminded me that the last time I ran a DoD audit about 12% of the passwords were some form of "superman". Strangely, nobody had a password called "overbearingego" or "napoleoncomplex".

But that was a few years ago, maybe they have moved on to transformers underwear now.

Many years ago I was working Desktop Support at a large multinational, and it was common practice to ask users for their passwords when doing work on their machines. We got a call from HR Drone asking for help. The tech that got the call asked her for her password and she hesitated for a bit, and then whispered "spankme".

[sintax_error]

Re: Twitter hacked again

...snip snip...Of course, it would be wise to make the answers to those questions just as complex as your password, so even if someone did happen to find the answer, they wouldn't know how you entered it.

Exactly. One doesn't need to go as far as a 20+ digit alphanumeric string with a couple of symbols tossed in for "what's your father's middle name?" Something as simple as intentionally mis-spelling the answer, dicking with capitalization, or using a relatively simple string that you're reminded of would generally suffice. Alas, that's about as common a practice as using a solid password in the first place. No matter what training and scolding you give the masses, you will still find pet's names with a zip code tossed after it, passwords emailed to one's self, and post-it's stuck to a variety of objects near workstations, and my personal favorite, taped to a laptop palm-rests. It's a never ending battle.

On a separate note, Xor: "sex"? Really? Come on, everyone knows real men use "god".

[the-Jaku]

Re: Twitter hacked again

jajajajja is very funny this shit

[streaker69]

Re: Twitter hacked again

I think the primary focus here shouldn't really be twitter getting 'hacked' since it really wasn't per se. It was more of a good social engineering attack against one of their people and the lax way that YahooMail handles password resets.

Obviously the guy was an idiot for storing his twitter password in his yahoo mail account. But at the same time, it would appear that Yahoo needs to take a serious look at their own system for password changes. Obviously they shouldn't be using password reminder questions that are so easily guessed or researched. My bank has some interesting questions that they use for authentication. Two that I can recall are "Name of first girlfriend/boyfriend" and "Maternal Grandmother's first name." Both of which would be very difficult to research.

Of course, it would be wise to make the answers to those questions just as complex as your password, so even if someone did happen to find the answer, they wouldn't know how you entered it.

[theprez98]

Re: Twitter hacked again

Doesn't Twitter allow unlimited logon attempts? That is a problem.

[barry99705]

Re: Twitter hacked again

Passwords are a problem people try to tackle from the wrong place. You can force people to do all sorts of god awful things to make it "more secure" but you will find that people will just find another way of compromising their security. I think the situation needs to be tackled on 2 fronts.

Firstly making sure techs don't do stupid things. Max password limits of 8? Fuck off (note: sorry for swearing but this is a stupid limit), its 2009 and we only have the computing capacity to handle the computation of 8 character passwords?

Secondly I do think good password creation should be taught in schools. I did a general computing course in school and it taught me endless useless things that I will never need but we can't add a module on good security practices and passwords creation?

The military pretty much guarantees that people will write down their passwords. Greater than 8 characters, has to have a capital, punctuation, and number. Can't be any part of your name or social. Gets changed every 60 days and you can't use the last 35 passwords over. It also won't let you just add a letter/number to the last password.

[Thsyrus]

Re: Twitter hacked again

Passwords are a problem people try to tackle from the wrong place. You can force people to do all sorts of god awful things to make it "more secure" but you will find that people will just find another way of compromising their security. I think the situation needs to be tackled on 2 fronts.

Firstly making sure techs don't do stupid things. Max password limits of 8? Fuck off (note: sorry for swearing but this is a stupid limit), its 2009 and we only have the computing capacity to handle the computation of 8 character passwords?

Secondly I do think good password creation should be taught in schools. I did a general computing course in school and it taught me endless useless things that I will never need but we can't add a module on good security practices and passwords creation?