How I Would Try to Hack Your Mint.com Account

http://www.jasonowens.com/how-i-would-try-to-hack-your-mint-account/

by jowens • 16 years ago

22 11 16 years ago

rdamico• 16 years ago

Great article. It seems that simply using Gmail over SSL would mitigate the email-related issues here, no?

macrael• 16 years ago

Absolutely. And, I can't think of any email service that sends passwords in clear text. I'm not convinced it is this easy to compromise someone's email account.

jowens• 16 years ago

What I was thinking about was someone using say POP and a client like Thunderbird. The POP traffic by default is clear-text, so when you send your password to the server, it's in the clear unless you're either tunneling your traffic or going to a secure port to your ISPs mail server.

jrockway• 16 years ago

What's the value of hacking my Mint.com account? Learning where I bank so that you can send me phishing emails?

(Downmodded? Last time I checked, there's no "transfer all my money to an offshore bank account" button, nor are the passwords to the linked sites available. So while annoying that some dude on the Internet can see that you have lunch at McDonalds every day, it's not going to cost you any money.)

rdl• 16 years ago

The main value would be in finding other accounts to attack (some of which might have known weak security).

Also, if I stole a credit card, seeing what purchases someone has made in the past would let you make a larger number of future purchases without getting the card blocked.

Hacking email account still seems to be one of the best rewards for lowest difficulty.

Confusion• 16 years ago

  Downmodded?

Please, wait a few hours before complaining about that and providing additional explanations. It usually evens out.

cookiecaper• 16 years ago

There probably wouldn't be much utility in doing this to some random stranger, but it could be useful if you were trying to blackmail or embarrass someone.

For instance, say that you're a senator and you've made some enemies. If these enemies could log in to your account, they could reveal some "suspicious charges" from an escort or pornography service, or perhaps they'd notice some large expenditures on airfare and travel when you were supposedly just off for a weekend hike (Mark Sanborn). All of these things are bad.

That's a prominent example, but the same could be done to anyone you wanted some leverage against, be it a teacher, supervisor, or anyone else. Yes, it'd be ideal if people didn't do things that destroy their careers and/or families in the first place, but often times that's not how people work.

hugh3• 16 years ago

So it's only the same amount of damage that you could do by stealing my mail and going through my bank statements.

You'd probably do far better at embarrassing someone by going through their email, which is a necessary step for several of these methods.

eds• 16 years ago

Last time I pulled my credit report, the security questions included "Choose which of the following is true: you have an account at XXX Bank / you have a loan in the amount of $YYY at ZZZ Bank / etc."

Yes, some other information was required too, and no, I don't know what good a credit report does you either.

shalmanese• 16 years ago

Eh, the amount of ways anyone could hack anything is so much staggeringly larger than the amount of times people actually end up getting hacked.

Pointing out one specific flaw in one specific service is about as useful & damaging as pondering new theoretical ways terrorists could strike the US.

How I Would Try to Hack Your Mint.com Account

Related Stories