Meet Mat Honan. He just had his digital life dissolved by hackers:



http://www.wired.com/gadgetlab/2012/08/ ... cking/all/

I'm glad that I dont use my Apple email for anything...Only Apple related stuff...

I'll also agree that the guy is an utter plonker. He's bought into pretty much the entire Apple ecosystem, but left out Time Machine, which would have saved the things he cares about most...

You don't need Time Machine, you just need an offline backup.
Any offline backup system will do, just make sure you have one.

Mark

The point of the article isn't really that he should have backed up his data.
It's more about thinking what you can do to make it as difficult for attackers to get access to your improtant accounts like google.
Using different passwords is a first step but there are also others like two step authentication.

I posted it in the meeting place for a reason: so people would see how easy it is for their life to get destroyed and that it pays to be careful.

Not hacked by cracking passwords - it was done by phoning up Apple support and using social engineering techniques.


http://www.forbes.com/sites/timworstall ... ts-hacked/

So, I'm this case the weak point was the tech support operative - something that anyone in any tech support call centre could fall prey to.

I know. Time Machine is the most obvious choice though, IMO. Touted as a major feature of Leopard, it has always been one of the big features Apple has pushed since. It's not hard to imagine that someone who is surrounded by the Apple ecosystem to use Time Machine. But as you say, anything would have been better.



Looking at this case, it's probably best to set up a new email account every time you sign up for a new service, at least until every service offers two step authentication. That way only one service is linked to an email account, minimising these sorts of attacks.

I'm surrounded by Apple gear; iPhone, iPad, iPod, MBP, Apple TV, Airport Extreme, Airport Express, iMac … four offline backup hard drives all managed manually.
I have about 0% interest in using Time Machine/iCloud for backing up.

\•/

Mark

Using different passwords is irrelevant - and he did use different passwords. If Apple will reset your password for anybody who has the last 4 digits of your credit card number, it doesn't matter how strong your password is! Also having to link mail accounts from one service to another (E.g. the Google and Twitter password resets were sent to his compromised Apple account) doesn't make things any better. If they manage to break into the account at the head of the chain, they can get to every account.

So what is the solution? Having a dedicated google account with 2 step auth. set up just for password recovery? Or maybe using your corporate email for that purpose?

Having a method of password recovery for an email service that doesn't depend on having another email service...

Send it by snailmail. Or by telegram?

What's the phrase... oh yes - 'You can have it cheap, you can have it convenient, you can have it secure. Pick any two'.

Jon

And Amazon are just as bad allowing you to add a new credit card over the phone with minimal security, and then use that credit card as a means of answering security questions to reset passwords.

Not any more, apparently

Text message?

Mark