Many hundreds at the NC Legislature for #MoralMonday.
Moral Monday
Author: Ruby Sinreich
Usable Security » Blog Archive » Cynthia Kuo, Sasha Romanosky, and Lorrie Faith Cranor: Human Selection of Mnemonic Phrase-Based Passwords
We’re screwed no matter what if someone targets us. 🙁
Twitter <3's hackers, apparently
I think this makes it pretty clear how seriously Twitter takes their security: The guy who hacked my account is still happily tweeting away about the latest social engineering methods and how it was my fault that he hacked into my personal accounts so he could try to sell @Ruby on hackerforum.net.
Better late than never, Twitter added two-step authentication for accounts last month, but it’s clear they aren’t really concerned about their users when they do nothing to help protect users like me or @Mat, even when we know people are targeting us, and let genuine security risks chill out indefinitely.
twitter.com/isol8te
Please share this post if you agree that Twitter should take action against “Isolate” and any users who are known to have hacked other people’s Twitter accounts in the past.
Shits & giggles for the rest of us
I’m not going to post everything that has been going on yesterday and today (yet) as the hackers are reading my Tumblr. I have to share some amusing and quite public links.
Meet my hacker “Isolate.” This is the person who hacked most of my digital life so he could try to sell @ruby for $80. I alerted Twitter about his account this over an hour ago. It’s obviously fine with them to hack other people’s accounts AND brag about it with their service.
Poor guy is concerned that I am giving some clueless teenager credit for his brilliant social engineering hack. Don’t worry d00d, it’s pretty obvious when you read the conversations at Hack Forums where Isolate first asks what it’s worth (the page has been removed, but I saved it), then trades it to —— J —— (Jacob Glickman) for a YouTube ID. Then —— J —— tries to sell it even though the other hackers are telling him that it belongs to someone else (me) and even tell him to read my Tumblr.
Jacob then contacted me offering to get me back the account. He even tried to get me to e-mail him by putting his address in my Twitter bio. Not only was it not his to give, he would never have been able to restore my posts and followers, as Twitter eventually rightfully did.
Here is the best of all, —— J —— now files a complaint against Isolate for ripping him off! Have fun, you guys!
I’m baaack!
Last night at about 12:30 am I recovered access to my web hosting account at Dreamhost. This contains personal and professional websites and e-mail accounts for me, and several former clients and employers. Importantly, this allowed me to get back the only address through which Twitter would talk to me.
So early this morning I was able to recover access to @ruby, hurrah. There’s a little bug where on my profile I have no followers nor following:
But on my followers page, I see all the correct numbers:
Hopefully this will all be cleared up soon. I cannot strongly enough express my gratitude to all the people that spoke out and even fought for me in the last couple of days.
Stay tuned for future posts about the losers who did this. I have some really funny e-mails and things to share.
Thank you, Dreamhost!
I am back into my account! I think the social pressure helped, so thanks to EVERYONE who has been sharing my story.
Next up, restoring my Twitter profile, including the content. This looks promising:
@ruby for sale
A few people now have contacted me about the hacker forum where my Twitter name (with no tweets and no followers) is now available for the low, low price of $70!
You have to register on the forum to see it, but the URL is http://www.hackforums.net/showthread.php?tid=3508538 in case you’re curious.
My friend Christina actually logged in. She says the person selling it presents as a 17 year old male form NY, and he says the person who hacked me traded the ID to him. Then my friend Jackson also logged in to the forum and took these amazing screenshots:
Really, Twitter?
You don’t think you can do anything about this? Cause you’re not sure if the account maybe doesn’t belong to the person in control of it? Really???
Thanks to Travis C for the tip about the new Twitter bio.
In case anyone is curious, I’m not going to buy my own account back from some juvenile criminal. Twitter needs to do right and restore this account properly.
Thawing at Dreamhost?
Are they getting sick of my complaining e-mails or is the social pressure working? I don’t know but this evening Dreamhost offered me a different way to authenticate myself, which I have now done! It will be hours before they reply of course, if not more.
I also spent some time rifling through all my old credit card bills and I couldn’t find any with Dreamhost charges on them. In fact, I thought I was paying them through PayPal. It’s been years since I fiddled with that account.
Tickets, please
A few folks have asked for my support ticket numbers with Twitter and Dreamhost to follow up. I’m a little nervous about posting them publicly as the hacker might try to engineer that against me.
If you have a contact at either company and would like the ticket number, either comment on this post and I’ll reply to you at the e-mail on your Disqus account, or use Tumblr’s Ask-me-a-question thingy and I’ll send them privately (if I know you).