How I Lost My $50,000 Twitter Username

by micahgoulart • 12 years ago

1043 382 12 years ago

An interesting point made was to avoid using custom domains for the login emails, since a DNS takeover would compromise your accounts tied to that email.

zuccs• 12 years ago

Agree - never thought of that before!

ben0x539• 12 years ago

Or maybe DNS should be secured with something besides the honor system.

adrr• 12 years ago

Wonder how would you prevent or detect this hack attempt early. Are there services that monitor for DNS changes? Could you up the TTLs on the MX records so if you did notice a breach, you would have adequate time to resolve it?

scintill762• 12 years ago

This is quite frustrating. I don't use Gmail or Google Apps mail, so that I can't be compromised by a malicious insider (however unlikely) or a flaw in their authentication systems. Instead my security is exactly as weak as my registrar's authentication.

ereckers• 12 years ago

Yes. This seems like his final conclusion. Gave me something to think about.

Wild story coming out today because I was just setting up a couple domains/emails today on Google Apps. There's actually a section in the process in which they suggest setting the MX TTL to 1 Week.

acangiano• 12 years ago

The counterargument is that Google's notoriously poor customer care team could ignore your plea when they deny you access to your own gmail address for god-only-knows-what reason. But it's still probably safer to go the gmail two-factor authentication route.

troels3• 12 years ago

I think that's missing the point a bit. Using gmail as your primary address will make you vulnerable to Google arbitrarily (or even justified) shutting down your access. We all heard stories about that.

What you should do, is make sure that you trust your registrar. Paypal sure have some questionable practises, but the real culprit in this story is clearly GoDaddy.

josteink• 12 years ago

An interesting point made was to avoid using custom domains for the login emails

That's horrible advice. That sort of attitude taken to the extreme means we shouldn't be using DNS for anything ourselves and put everything in Google's (or Amazon's) big bag.

Should I redirect my customers to facebook.com/company as well in fear of someone taking over my DNS?

The lesson from this whole charade is to not trust something as crucial your DNS to untrustworthy companies like Godaddy. We've heard the horror stories before and we keep on hearing them again.

Relying on Google, a company with no direct end-user support and no emergency hotline to secure the most important thing you have, DNS, is even bigger madness. I've been locked out from a Gmail account before. It took me weeks to get it back, because Google has no support.

So yeah. Get a proper DNS-provider, and don't dig yourself deeper into the hellhole you're currently setting up.

brown9-2• 12 years ago

Why is anyone still using GoDaddy?

RexRollman• 12 years ago

and Network Solutions.

rikacomet• 12 years ago

Payment channel option is one reason. Linode/DigitalOcean for example are not available in India, due to restrictions on Debit Cards of Indian users. Credit cards are very uncommon here, compared to Debit Cards.

Btw, I personally use Bigrock instead. They have a very a good customer support.

http://rikacomet.blogspot.in/2013/12/quick-comparison-betwee...

moondowner• 12 years ago

I have been using a debit card (Visa Electron) for both Linode and DigitalOcean. Works fine.

tagabek• 12 years ago

The 99c domain names.

MildlySerious• 12 years ago

Guess these still have their price...

chmars3• 12 years ago

Affordable pricing. If you are used to GoDaddy, you simply ignore all the, ehmmm, special offers …

fletchowns• 12 years ago

The pricing isn't even that good though

prawn• 12 years ago

Why did someone not sell a Twitter username for $50k?

Nicholas_C• 12 years ago

I doubt that the $50k offer was serious. Probably some feeble attempt to scam the guy or something.

adventured2• 12 years ago

It's against Twitter's terms of service to sell usernames. Technically. Lots of people get away with it I'm sure.

https://support.twitter.com/articles/18311-the-twitter-rules

Abuse and Spam > Selling usernames: You may not buy or sell Twitter usernames.

georgemcbay• 12 years ago

Seems like Twitter could easily verify the story based on their own logs and then restore access to his N account. He doesn't mention pursuing that, though.

timhaines2• 12 years ago

Have just been talking with him. He first asked Twitter for it back on the 20th of Jan. 8 days ago.

brador2• 12 years ago

He said he wasn't using it much. Thus, isn't he basically a squatter?

harryh11• 12 years ago

Ya, the fact that he tweeted a grand total of twice in 2013 (see https://twitter.com/N_is_stolen) makes me have a little less sympathy.

timhaines2• 12 years ago

He tweeted pretty heavily previously. Was one of the small team who made @echofon. He'd reduced his tweeting, but was still using the account in other ways.

nicolethenerd• 12 years ago

Twitter's official policy is that an account becomes inactive after 6 months - at that point, they reserve the right to release the account (in practice they rarely do this, though - there isn't an automated job releasing inactive accounts or anything)

https://support.twitter.com/articles/15362-inactive-account-...

@N (now @N_is_stolen)'s last post was 4 months ago, so he is still technically considered an active user.

hrabago• 12 years ago

It depends. I know of several people who have Twitter accounts so they can follow other people, but they don't tweet much (or at all) themselves.

baby• 12 years ago

But you can use your twitter account to log into some websites now.

jrs996• 12 years ago

He's definitely a squatter. If you own something and you don't use it, you're a squatter. I own an old original Nintendo that I haven't used all year. That's why if someone comes into my house and takes it, it's my own fault.

aptwebapps2• 12 years ago

If he was trying to shake down someone who had a legitimate claim to it, yeah. Otherwise he's just a speculator, not a squatter. Or an opportunist maybe.

dspillett2• 12 years ago

Not using something much is not the same as not using it at all, nor is it the same as not planning to use it in future.

It doesn't appear that he is trying to sell it, which is the usual behaviour of an account/name squatter.

I have several domains that I plan to use for little projects over the coming year (though given my lack of free time right now that may not happen like it didn't last year...). Am I a squatter for having paid for something I intend to use but have not got around to doing anything with yet? A couple of them are password/credentials related, for an example of a squatter talk to the person who owns password.net and sends me unsolicited email regularly trying to get me to offer to buy it as it will "help my brand" (the names I've got are the intended "brand", the generic short name is worth no more to me than standard registration fees - who slaps short names into their address bar instead of using a search engine these days?).

chris_wot• 12 years ago

No. A squattor who takes over something that is abandoned or little used. Someone who does the abandoning or little uses the thing they own is the one being squatted upon.

Now I reread that, it sounds a little... sexual.

simeonf• 12 years ago

(I work at twitter but don't have anything to do with account security, etc)

I think something is in the works...

nh7a3• 12 years ago

Let me know if you need a copy of emails :)

Dontlook• 12 years ago

This thread could be renamed "How I Lost My Job at Twitter"

Oculus2• 12 years ago

If the author is reading, did you end up getting back your @n username? If so, did you simply go to Twitter and explain to them the whole story?

owenwil2• 12 years ago

I don't think you realize how unresponsive and poor Twitter's support is. I was once locked out of my Twitter account via anything but Tweetdeck (due to two-factor authentication suddenly breaking and not sending SMS') for four weeks before I wound up accidentally finding a PC that I hadn't signed out of previously and was able to disable. I logged a ticket on the first day it happened and never even received a response.

rickyc0912• 12 years ago

I can concur with their shitty support. I guess iOS 7 autoupdated my Vine app and somehow logged me out. I tried password resetting every email I could think of, I tried to connect via my social network. No dice. My account couldn't be found. I email their support team with my username asking them if they could provide me with my email, do a forgot password to the email. I even linked them to a few direct vines I had created and saved the URL to. Their response was unless I could provide them with the Vine ID number of my user account they could not locate my account.

Seems I emailed them back and forth six times and I kept getting this canned message from them. Needless to say, I've given up and deleted Vine from my phone.

"Unfortunately, we are unable to locate the Vine account in question. If you can still log in to your Vine account, go to your profile settings and select either "Invite via text" or "Invite via email." From there you will see your Vine account ID number. Can you reply to this message with the Vine ID number?

If you no longer have access to this account, but can see the account in Vine search, press the more icon (three dots) on the top right of the profile. After that, tap on "Share this profile" and from there you will see your Vine account ID number."

nh7a3• 12 years ago

Nope. A week ago when I explained the situation, Twitter seemed to think I just gave it up, willingly or not.

Oculus2• 12 years ago

Man that sucks, sorry to hear it. I guess on the bright side, you didn't have your entire online identity destroyed which was possible given the attacker had your email.

owenwil2• 12 years ago

Wow, this is both interesting and terrifying. I have a two character Twitter handle that I use actively and it makes me worry that one day I might be targeted too using a similar method, although so far I've had no problems.

andre• 12 years ago

I have a two character twitter handle also, and am active on it. Used to receive several "reset" emails per day before two-factor authentication.

seniorsassycat• 12 years ago

I found it interesting how open the attacker was about how they did it.

scott_s• 12 years ago

He probably wanted to brag to someone about how he did it. It just so happened to be his victim.

troels3• 12 years ago

Or he felt a bit remorseful about the whole thing and figured that at least he could help the guy not getting caught in the same net again.

650REDHAIR• 12 years ago

I felt very angry and uncomfortable reading that. I can't imagine being in a helpless position like that.

pmorici2• 12 years ago

Another reason to use Bitcoin. No credit card number to give away to the attacker and identity can be verified by signing a message with a private key instead of guessing at personal information.

OafTobark• 12 years ago

Did you even bother to read the damn article or are you throwing blind shit on the wall here.

knocte• 12 years ago

I believe he read the article.

pmorici2• 12 years ago

Yes, did you? The Attacker got Paypal to give up the last 4 digits of the victim's credit card number. Then he called GoDaddy which allowed him to verify his identity by giving them the last 4 of his credit card number though the attacker said they would have let him guess multiple times.

If GoDaddy accepted Bitcoin PayPal wouldn't even be involved and GoDaddy instead of asking for information which is apparently easily pilfered could have requested the caller sign a message with their private key Bitcoin key corresponding to the public key from which they paid GoDaddy for the domain services to begin with.

ChrisArchitect• 12 years ago

pretty freaky stuff. Also, what was the attacker so interested in the @N for anyways? future investment in case some big company/celeb comes along wanting the username? Seems so crazy to go after it...... if Twitter can't sort this out, can't we all just shame the acct into inactivity... Is squatting on it worth all this Mitnick-attack-work?

bryan_rasmussen• 12 years ago

Well, if this story is true ( I put the if because it seems silly to have that account be the target ) then access to the account is proof of a crime (this is why it seems silly)

If they sell it to someone I guess that is a reason to take it, but it also seems like some enterprising DA would want to use it as an example of receiving stolen property ( because News! Hacking! Fame!) So if anyone buys this name they might be in trouble at some unspecified point in the future.

ericcumbee• 12 years ago

And in this case I would be pulling for the DA to tear this hacker a new one.

RawData• 12 years ago

So who are you planning on suing? PayPal, godaddy, twitter, or all three?

TwoBit2• 12 years ago

The Terms of Service agreements for those companies probably all allow them to get away with it.

jkrems• 12 years ago

Terms of service normally don't override law. So, if there is something unlawful about their behavior, it doesn't matter what they wrote in their TOS. At least in many countries, not sure about US.

harryh11• 12 years ago

Who are people's current favorite domain registrars? I've been with name.com for the last year or so and have been happy, but I'm always curios to hear from others.

rickyc0912• 12 years ago

I've heard really good things with gandi and hover. I myself use namecheap, cause well, it's decent service for its price.

dombili• 12 years ago

I use Gandi (for hosting, domain and email) and Hover. Can't recommend them enough.

kawera2• 12 years ago

Been with gandi.net for a few years now; excellent service and 2-factor auth.

Noxchi2• 12 years ago

Wouldn't recommend them. I heard they have a "moral contract" you have to agree to. If they don't like what you're doing with your domains (even if it's legal), they can (I forget, seize or kick you out, but bad stuff).

nthj• 12 years ago

http://DNSimple.com for us. Their template system and support is fantastic.

patio113• 12 years ago

I've heard good things about them from friends. This article was the last straw for me -- I just migrated my 90 domains off of GoDaddy. Actually, I didn't. I just told DNSimple to do all the work, via their (brilliant) concierge onboarding option: http://blog.dnsimple.com/2014/01/domain-transfer-concierge-s...

"Here's my credit card and GoDaddy creds, guys, and here's a technical note about my DNS settings that I want you to pay extra special attention to. Tell me when I should expect to start getting the GoDaddy confirmation emails. Other than that, have fun playing with DNS settings -- I never want to even think about them again."

This post is 5% "Here's my recommendation for a DNS service" and 95% "Notice how in return for an hour or two of grunt work a SaaS company just made it very easy for me to award them $2,000 of high-margin recurring revenue a year despite being twice as expensive as my pre-existing option by successfully overcoming my 'I would love to move off my existing solution but it requires grunt work so I think I'll punt on that decision for, oh, eight years' objection? That's a really good trade. You should consider offering it in your SaaS business, too, in any way that makes sense for it."

ckrailo• 12 years ago

+1 DNSimple. 2FA and a truly simple interface. VERY easy templates for common things like blogs, email, etc. Really easy to get up and going on a domain there.

Referral link, gets both of us 1 month free service: https://dnsimple.com/r/96a980397648e9

Also everything patio11 said above. :)

Gracana• 12 years ago

About a year ago I registered at DNSimple to check out their services, because I was frustrated with my current registrar/DNS host (1and1.) One of the owners must have noticed I registered but didn't buy anything, because he contacted me to ask if there was anything in particular I needed. I appreciated the courtesy and told him I'd switch over when my domain neared expiration... and when the time came, I did!

Honestly I don't have enough experience with them to really evaluate their services, but they seem trustworthy and competent, and I like working with people I know I can talk to.

krrishd• 12 years ago

http://hover.com is my go to for domains

rbritton• 12 years ago

I use them as well, but they still have not added two-factor authentication. There's a feature request dated 2011 for it.

joelrunyon2• 12 years ago

Namecheap [1] & IWantMyName [2]

[2] http://namecheap.com [2] http://iwantmyname.com

ToastyMallows• 12 years ago

+1 for Namecheap, I have 2 (going on 3 soon) domains with them and I've never had a problem. They also have a coupon code for pretty much anything you want to purchase for them.

lingben3• 12 years ago

namesilo has extremely tight security and is very price competitive:

* 2 factor authentication

* 5 security Q/A's before you can make an account change!

http://www.namesilo.com/Support/Domain-Defender

there is no WAY this guy would have had an issue if he was with namesilo and had both protections enabled

(I'm just a happy client and in no other way related to them)

agwa3• 12 years ago

there is no WAY this guy would have had an issue if he was with namesilo and had both protections enabled

Except their customer support has a process to bypass those 5 security questions:

http://www.namesilo.com/Support/Forgot-Domain-Defender-Answe...

How can you be sure their customer support can't also be socially engineered? I'm actually hesitant to use a service which requires 5 security questions to make a change, because I bet so many people forget their answers that their support is lax when it comes to bypassing them.

ohashi2• 12 years ago

If you have a lot of domains (or willing to pay a premium), I am a huge fan of Fabulous.com. Good support, good pricing, my impression is fairly secure. They have an executive lock feature:

Executive-lock (E-Lock) allows for the domain name to be frozen. This means that the domain name is:

1. Unable to be transferred out to another Registrar.

2. Unable to be pushed to another Fabulous account.

3. Unable to have changes to its nameservers.

4. Unable to have the registrar-lock status removed.

You can define whatever conditions you want and they manually do them if you want it unlocked. It could take many days to unlock your domain, but it definitely isn't going anywhere.

techsupporter• 12 years ago

Holy cow:

"If your portfolio generates US$750 a month or you are willing to transfer 750+ domains to Fabulous, please complete the form below."

That's a little out of my range though I'd be willing to pay a premium (how much of a premium?).

troels3• 12 years ago

I'm using a small local regitrar, europeandomaincentre.com - I originally picked them because they can accommodate all sorts of international domains, and partially because they are within walking distance of my office. That way, if something goes wrong, I could go there and talk to them in person.

Their customer service has been really great since, so I'm staying. It's probably slightly more expensive than I could get elsewhere, but for the sense of security I get, it's completely worth it.

Point being- In this shitty business, where trust is everything - I prefer a small player who I can have a direct personal relation to, over some big nameless corporation.

eik3_de• 12 years ago

I can recommend www.inwx.de

Have been using them since 2006 both personally and at work. They do have 2 factor auth.

Tepix2• 12 years ago

INWX https://www.inwx.de/en They are knowledgable, helpful, competitive and they offer 2-factor-authentication.

mcb3k• 12 years ago

My friends run sliqua.com, so I go through them. I haven't had any issues with them, their support is pretty good, and the price is good. I would definitely recommend them to other people.

izolate• 12 years ago

I quite like badger.com

snotrockets• 12 years ago

I like http://www.gandi.net/ Not the cheapest registar around, but great service, allows me to edit the zone file directly, and also sells dirt-cheap PaaS.

zzzeek• 12 years ago

what's more likely, someone hacks your domain name / DNS gaining control of your MX records or someone hacks your username @gmail.com?

girvo• 12 years ago

Hacking (via social engineering) your GoDaddy account would be easier, IMO. And that looks like what's happened here?

dabernathy89• 12 years ago

possibly depends on whether you are using 2-factor auth with gmail.

gcp2• 12 years ago

Just Google's notification "why are you suddenly using your accounts from a different country" can be life-saving.

(As well as not putting any important stuff there)

poopsintub• 12 years ago

$50,000 twitter username. Sigh...

markdown2• 12 years ago

I feel bad for this guy, and twitter needs to do the right thing and return to him his handle.

Then I can come back here and post nasty comments about squatters.

reuven2• 12 years ago

Yes, absolutely.

The guy has given a clear and convincing story of what happened. I'm sure that it would be pretty easy for someone on Twitter's security team (assuming that they have one) to verify that the username was taken when he said it was.

I don't know what I find more shocking -- that PayPal would actually give the last four digits of a credit-card number to a complete stranger, that GoDaddy would let someone guess a two-digit number, or that a credit-card number is all you need to identify yourself. (In Israel, it's common for companies to ask for the last four digits of your credit card number in addition to other details, but never on its own.)

Actually, I'm willing to believe just about anything about GoDaddy. But PayPal is known for being surprisingly harsh and paranoid about security, shutting down accounts and holding money when they suspect problems. It's sad and rather surprising to me that they're willing to give out such information so easily, unless you specifically ask them not to. Shouldn't it be the other way around, that they refuse to provide such details unless you allow them to?

I really hope that Twitter and PayPal apologize profusely to this author, and undo the damage they've done as best as possible.

jrs996• 12 years ago

Do you mean Godaddy and Paypal should apologize? I don't think twitter did anything wrong yet. They are just looking into what happened.

Domenic_S• 12 years ago

https://www.paypal-forward.com/leadership/paypal-takes-your-...

apl002• 12 years ago

Any thoughts why the attacker would tell the guy how he did it if this is the obvious solution?

aragot4• 12 years ago

Yeah why is that attacker so nice and kind? No joking, it's bad for their business.

Zakuzaa• 12 years ago

An attempt to induce Stokholm Syndrome?

duiker101• 12 years ago

The attacker was hired and once he finished the job he had no reason to be mean to the guy or not help him to improve his security. Maybe he even is a security expert that was in need of a bit extra cash and picked up this job.

kybernetyk• 12 years ago

I guess it's that "security researcher god complex" many security people show. They come around, fuck up your daily routine and expect you to be thankful for making your day hell.

gizzlon• 12 years ago

Reminds me of this Seinfeld episode where Jerry calls a car thief :)

http://www.youtube.com/watch?v=hG-_tz5YuZE

Noxchi2• 12 years ago

Narcissism. Ooh look at how clever I am! I'm so smart! Please victim, will you validate my cleverness?

aragot4• 12 years ago

The problem is stealing @N is, someone will have to use it one day. How can they hope not to be traced?

Houshalter2• 12 years ago

The hacker sells it anonymously to someone who isn't aware of the controversy or who doesn't care. It will probably shrink the value of the username but I bet it's still worth something.

aptwebapps2• 12 years ago

Might piss off the attacker pretty bad, though. Not saying that's wrong, just that resulting shenanigans might be a little asymmetric.

dunk010• 12 years ago

"that resulting shenanigans might be a little asymmetric. " - What does this statement even mean? You should think before you just throw a load of cliches into a sentence.

fjcaetano• 12 years ago

I believe that it is ISO 9001 (quality assurance) that states that a company must be able to audit any stored data and data changes dating back some time. Judging by Paypal (specially for being a financial company), Twitter (for being an open capital company), and GoDaddy's size they may all comply to ISO 9001, but I'm just guessing.

Anyhow, if any of them actually comply to ISO 9001, it is possible to audit previous data to establish the true identity of the owner in some arbitrary date before any of this happened.

Quite possibly, to avoid unnecessary user annoyance, these companies will only subject themselves to the effort of analyzing that data under court order, so it's fair to suppose there is need to open a judicial process. Therefore, I believe it's possible to regain access to everything that was supposedly stolen, even though it may take quite some time.

dmak• 12 years ago

And we all know how this would end. GoDaddy and Paypal will try to make this right because of the negative publicity. Why does it always take a post like this to call for help?

eplumlee• 12 years ago

GoDaddy and Paypal have every incentive to bury their shoddy security practices and deny everything that the OP is claiming, to avoid a PR disaster. They might quietly return to the issue later and perhaps address some of their security issues... maybe.

mrbill• 12 years ago

It's not a $50K Twitter username unless someone actually paid $50K for it at one point, is it?

"Not accepting an offer of $50K for a twitter username I didn't use" doesn't really count...

joelrunyon2• 12 years ago

It's a close approximation of value.

Much closer than saying "I would sell this if I received a 50k offer."

enscr2• 12 years ago

It has a lot of value for brands like Nike, Nokia, Netflix, Nordstrom... Or a News channel - @N is very attractive to advertise. I don't see any trouble selling it for more than that.

Buge2• 12 years ago

It's worth what people are willing to pay for it. If people are willing to pay $50k then it is worth $50k. Of course it might have gone down in value since the offer.

stanleydrew• 12 years ago

That logic only works once an actual payment is made. Claiming you are willing to pay and actually paying are two very different things.

bredren2• 12 years ago

This is a scary story!

Focusing on the Twitter handle sale part: I have the twitter handle @jetsetter, and have been offered multiple thousands of dollars for it (guess who!).

Unfortunately, selling a twitter handle is against TOS. Only @israel has been officially allowed to transfer hands for money, that I'm aware of.

So trying to broker the sale of a twitter account can allow the buyer to report your 'behavior' to twitter. They can seize the account and make it so no one has it, which may be what the buyer prefers to you having it.

So no matter the price you could command, it isn't like you could just list @n up for sale and make it rain.

jordsmi• 12 years ago

Unless you are talking on the actual twitter account about selling it you should be fine.

If not I could just make fake email logs and report you.

lingben3• 12 years ago

actually several twitter handles have been "sold" although the transaction was done in such a way that it was not as straightforward to get around the TOS

the most famous is the CNNbrk handle

markdown2• 12 years ago

Only @israel has been officially allowed to transfer hands for money, that I'm aware of.

Twitter: "I'm sorry, you can't do that."

Israel: "What are you, some kind of Anti-semite!?!"

Twitter: "OK, OK, go ahead and do what you want. See, we're not anti-semite :)"

vxNsr2• 12 years ago

Well at least you didn't make some bad pun involving Israel, jews and money....

vxNsr2• 12 years ago

If you're refering to this: http://www.theguardian.com/technology/2010/sep/14/twitter-us...

at the bottom a twitter representative is quoted as saying that as long as they give you permission to sell/buy a handle they won't block/lock the account.

Also apparently CNN also purchased a handle[1].

[1] http://www.businessinsider.com/cnn-acquires-cnnbrk-twitter-a...

bredren2• 12 years ago

I wrote in 2009 describing the situation and asked for approval. I was turned down. Reviewing the support ticket now, I think I could have handled the sale more professionally. Maybe that's why.

porlw• 12 years ago

How about setting up a company, GIVING the handle to the company, then selling the company?

codezero• 12 years ago

One thing that people should realize in why Twitter may not respond to these kinds of issues, or may be slow to respond, is that it's probably true that lots of people buy and sell Twitter accounts, and people may report them stolen when in fact they've already sold them to someone.

This kind of thing happened a lot in MMO games which is why they try to push account security into your hands so they don't have to attempt to arbitrate in deals that may or may not have happened outside of their sphere of control.

baddox2• 12 years ago

So what? If Twitter returned control of a handle if someone could prove that they had recently controlled the handle, that would quickly make the handles market dry up.

Herald_MJ• 12 years ago

Twitter has no interest in there being a handles market. In fact, I wouldn't be surprised if their T&Cs expressly forbids it.

Bluestrike2• 12 years ago

Heads really ought to start rolling at PayPal. Their general approach to security is, quite frankly, appalling.

Is there any possible rational for Paypal to give the last four digits of his card number to "him" over the phone? Given that they're routinely used for verification, it's as if they've never heard of social engineering. It's simply inexcusable.

And it's almost as bad as the ridiculous "Log In Without Your PayPal Security Key" option that lets you bypass 2-factor auth and head straight to the ultra-secure world of the ridiculous security questions such as the ever-popular "what city were you born [that's also listed on Facebook]" and what not. I still can't believe they think that's a good idea.

autarch• 12 years ago

The attacker was posing as a PayPal employee, not the card owner. Of course, PayPal still needs better security, but posing as an employee of the same company is a classic social engineering exploit.

Aqueous• 12 years ago

And that part was never really answered either. How can he pose as an employee calling in from an outside line? Does PayPal not tell you when an extension from PayPal is calling you?

aragot4• 12 years ago

Ironically, PayPal's core business _is_ security.

The founder's interview [1] describe the beginning as a constant race against fraud, which no other bank was willing to compete in: "You're going to go bankrupt when the chargebacks start".

The was a locked room with a screen-and-keyboard-only computer where you could research about transactions and find suspicious and fraudulent ones. According to the founder, it became PayPal's core asset.

[1] in the book Founders At Work, which I recommend.

philliphaydon• 12 years ago

Ditch GoDaddy - They are a terrible company.

Also considering closing my paypal account now.

cpayne2• 12 years ago

I'm consistently surprised at the number of complaints against GoDaddy. They are a horrible company! You get what you pay for...

Osiris5• 12 years ago

Just a side note here, GoDaddy has been under new management for a little under two years. There's a lot internal changes happening specifically aimed at improving usability and infrastructure.

driverdan• 12 years ago

Do it. Paypal is a terrible company who doesn't give a shit about its users.

mikevm• 12 years ago

What are the alternatives for for non-Americans?

purephase• 12 years ago

I closed my Paypal account after the whole Wikileaks fiasco. I was expecting to be a burden, but it really hasn't been at all.

nevi-me• 12 years ago

My custom domain address was stolen with the Dropbox data leak, got so much spam that I set my Gmail to pull my mails via POP3. Then I changed everything to use my Gmail, and locked down my Gmail account.

I've heard people go on about how Google (and I suppose other corporations) are evil, and how they are rolling their own custom mail solutions etc. It's times like these that people lose important things.

Also, I really don't understand why US companies must store credit card details. I understand the convenience, but there's been a lot of security compromises to let this practice continue. In South Africa online retailers don't store CC info, yet we aren't being brought to our knees by inconvenience.

At least the attacker mentioned his methods, so GoDaddy and PayPal can educate their staff better.

TwoBit2• 12 years ago

What do you mean by Dropbox data leak?

_ikke_• 12 years ago

A project document with e-mail addresses was retrieved through the account of a dropbox employee[1].

Some people noticed they got e-mail through unique non-disclosed e-mail addresses.

[1] http://lifehacker.com/5930706/dropbox-confirms-user-email-le...

hhw• 12 years ago

A custom domain address can also be used with a custom mail server configuration that includes spamassassin. You can even setup IMAP folders for you to drag and drop mail into to be learned automatically as spam, ham, or forgotten. You can also setup fairly sophisticated rules with procmail or sieve. A good mail provider will also have this implemented for you.

Aside from mining your data for marketing purposes, Google is evil because they continue to store your e-mails even after you delete them. Custom mail solutions are markedly superior if you know what you're doing, like anything else in life that you assume your own direct control over rather than leaving it to someone else.

seanlinmt• 12 years ago

Interesting that GoDaddy does not keep an audit trail for account detail changes that might help detect malicious activity. I guess they'll rather lose customers and reputation than do this.

hackmiester• 12 years ago

They don't have much to lose reputation-wise...

aestra7• 12 years ago

I am surprised anyone can take them seriously as a company after their Superbowl commercials.

joshmlewis• 12 years ago

I could be wrong but what is the value of a stolen Twitter handle? Just like a stolen car or phone if someone starts using it won't it be obvious that it's the thief or the thieves buyer? That's like stealing a Porsche and then showing it off downtown in front of everyone.

obiterdictum• 12 years ago

Comparatively few people will read this story. Even fewer will care enough to continue the crusade against the attacker for any prolonged period of time to raise awareness among the potential future audience that this account was stolen.

High chance the story will be quickly forgotten and the account will be re-used.

scott_karana• 12 years ago

Or resold, even more sensibly...

vysakh0• 12 years ago

Since medium also depends on Twitter, his page is no longer available. I checked @N_is_stolen page, it is fresh. So, all his posts in medium is gone, just because there is a change in username?

nitinag• 12 years ago

No domain registrar should be taking the last four of your credit card number as proof of account identity or ownership. We certainly don't. Have you confirmed they reset the password based on just the last four of the credit card OR was your account's email address itself comprised, allowing them to reset the password via your email address?

enscr2• 12 years ago

Can't you sue paypal or godaddy ? Or better yet, both. Shouldn't be hard to track down the attacker either if you report the crime.

pyk• 12 years ago

No lawyer? Any reason why none was mentioned? Extortion is serious federal crime (across state lines, multiple companies, even clear admission of guilt). At the least it would get GoDaddy's attention vs. just asking nicely.

ivanbrussik4• 12 years ago

It is a long shot, and would take ton of money in fees mainly for a very skilled private investigator but you are absolutely correct this is one route to go.

nroach• 12 years ago

I was surprised that the victim didn't get an attorney involved. This is an example of a situation in which a court could very swiftly (same day, usually) issue an injunction to preserve the status quo while the merits get sorted out in court. Most domain providers I've dealt with will freeze a disputed account pending legal resolution of ownership, which can be decided via the court system or a WIPO arbitration.

betenoire• 12 years ago

What was up with the part with the facebook message? Why would the attacker tip him off rather than just take what he came for? Or did I read that wrong?

Buge2• 12 years ago

Maybe the hacker was bragging about the hack and someone who heard that tipped him off.

Zancarius• 12 years ago

Never underestimate the enticing nature of boasting. I can think of more than a few would be anonymous attackers who were caught precisely because they wanted to brag about their achievements.

I'm not really sure I understand the psychology behind it and whether it's a juvenile attempt to demonstrate relative power (e.g. "I did this to you, ergo I'm more powerful/smarter/whatever") or something else entirely.

Shank• 12 years ago

I don't understand why Twitter doesn't have the standard 30 day wait period on handle changes that most sites have. For a while it was a standard to not let old usernames be available until 30/60/90 days after a change, so that in the event that this kind of thing happened, it could be reclaimed with ease as soon as the GoDaddy account is in his possession.

smartician• 12 years ago

That reminds me, a few months ago I had a weird Twitter experience. Someone gained access to my rarely used Twitter account @smartician and started posting spam. Somehow Twitter noticed, reset the password and notified me via email. I have no idea how that was possible.

rth• 12 years ago

It happened me as well, I just shut down the account.

westi• 12 years ago

Somehow Twitter noticed, reset the password and notified me via email. I have no idea how that was possible.

This sounds like pretty normal automated monitoring for what looks like compromised account behaviour.

aestra7• 12 years ago

This happened to a friend of mine too, and he even forgot he had a twitter account.

zaidf• 12 years ago

I have a four letter twitter handle(zaid) and I probably average a half dozen forgot-password requests daily...many of them people in the middle east with the same name as me trying to take over my account.

I've had two users offer to buy my username.

lancewiggs• 12 years ago

Everyone looks bad here, but I want to focus on Twitter. For me this case is yet another demonstration that Twitter sees its customers as advertisers and places low priority on the community.

I pay Twitter nothing, and yet the service is valuable to me. So instead of continuously crippling the service in the name of goodness knows what, why not actually charge users for a premium experience. Things like customer service that works, a gold member status flag, controls on swapping account ownership, analytics and so on. Offer 3 paid levels - personal, business and corporate, and obviously keep the free level forever. Once revenue comes from customers, then perhaps it will help in understanding that while other revenue night be larger, the true value of Twitter is derived from the community.

riffic6• 12 years ago

Or look into alternatives in the microblogging space. What ever happened to Status.net/ostatus?

slazaro• 12 years ago

But the problem with alternatives is the fact that they're alternatives. Not what other people are using. If it's a social app, it's important.

odinho• 12 years ago

They started pump.io instead. Which is a much more low-level project than StatusNet. Trying to build a federation-server that other people can make services on top of.

Trying to win a market that way. If only one popular site starts to use it, -- you might be getting some network effect out of it.

I think it was a better level to work on. Let others help with the network.

theintern• 12 years ago

I constantly think this about free services. There are a lot of things I'd love to pay a small monthly fee for that would give me peace of mind that the company is actually going to try and do things in my best interests and not in the interests of it's real 'customers', the advertisers.

Just today I got a notification from Facebook saying that videos are going to play silently automatically in my feed on my phone, meaning that if I'm on mobile data, my cap will be used quicker. This is the kind of thing I'd like to be able to pay to avoid.

kalleboo• 12 years ago

So instead of continuously crippling the service in the name of goodness knows what, why not actually charge users for a premium experience.

Because then they couldn't justify their $50 Billion valuation. They'd "just" be a $1 billion company or something.

Sites like Twitter or Facebook could be perfectly fine profitable ventures that worked in their users' interests. But instead they got unobtainable market values, so they have to look like they're on track to meet them, and the easiest way to do that is to exploit their users.

benatkin2• 12 years ago

It's sad, but twitter's not transferring it back in a week's time gives me more confidence in twitter, not less. There isn't any evidence of the stealing of the domain names and the extortion available besides OP's copies of the email messages and information that GoDaddy won't provide. With the value twitter ID has, twitter shouldn't do anything without clear evidence.

He might have been able to get it back if it was his trademark or even name that he lost and not some witty username.

ivanbrussik4• 12 years ago

I value any company's committment to security however there are ways that Twitter can prove who the owner of the account was, if they really wanted to.

Let's see if this story hits real news headlines and affects Twitters stock before closing bell tomorrow and action will happen.

xauronx2• 12 years ago

I was thinking how witty that would be if THIS was the actually hacker, and he was using us to create a shitstorm in order to rush Twitter into giving him the account. I'm sure there is sufficient data to support that he was the original owner though.

tedchs2• 12 years ago

Twitter hopefully has an audit trail of account changes they could review to make a decision to revert the change.

benatkin2• 12 years ago

True. I believe the original poster, no question about that. I hope twitter reverses it, but I can see why they haven't yet.

Dnguyen• 12 years ago

I lost a nice handle (@Houselogic) a few years back. Sent Twitter all the proof and email trail and everything, but they were useless. Every time I email their support, it's a new ticket and I have to explain the whole situation again and again. I gave up after two years.

mannat• 12 years ago

Woah ! What a story. You can trust nobody. Well hope that twitter people are reading this and can understand how badly they are trolled. All the best buddy. All the best.

Ryel• 12 years ago

I'm still wondering WHY the hacker took a twitter handle and why he didn't blackmail his victim into keeping quiet.

$50k is hardly worth such a bold crime with no exit strategy.

unreal374• 12 years ago

Who's going to pay $50K for a stolen twitter handle? The value has surely dropped quite a bit.

downandout• 12 years ago

Was @n private before? It is now. If this kid is trying to sell the handle to someone, the buyer is likely in for a rude awakening if and when Twitter does the right thing and returns it.

ivanbrussik4• 12 years ago

story archived here in case it did/does go down:

http://pastebin.com/g7R6Ren2

hoektoe• 12 years ago

Just find it interesting to see how different the conversation on the same topic is over at reddit, http://www.reddit.com/r/technology/comments/1wfwfp/how_i_los...

unreal374• 12 years ago

Sad to say, reddit sounds more human today than HN. So many people here saying, "He only tweeted 3 times in 2013, he deserves to lose it". Have some empathy!

You think the hacker who tricked Paypal and Godaddy is in the right here to steal it? I can't believe it.

rangibaby• 12 years ago

I found this story interesting for the social engineering aspect. The lack of "outrage" is actually quite refreshing.

lucaspiller• 12 years ago

But guessing 2 digits correctly isn’t that easy, right?

The first few digits of card numbers refer to the provider (Visa, Amex, etc) [0]. Given that Paypal gave the last four digits of the card, I'm surprised they wouldn't give out the provider as well, so guessing this would be even easier.

[0] https://github.com/stripe/jquery.payment/blob/master/src/jqu...

eridius2• 12 years ago

It wasn't the first 2 digits that were guessed, it was the 2 digits prior to the final 4.

callesgg• 12 years ago

Don't use godady is what I would take away from the story.

chavesn2• 12 years ago

Why would a company ever ever ever accept 6 digits of a credit card number as a way to authenticate an identity??

Credit card numbers are not secure. Therefore, they should not ever be accepted as authentication. Especially only 6 digits of it! This is by far the most shocking part of this story. As if I needed another reason to despise GoDaddy.

[Edited to add] I would sure love to see a scarlet letter list of companies which allow such practices, so I can never use them.

ivanbrussik4• 12 years ago

I actually think it was 4.

eridius2• 12 years ago

GoDaddy requires 6 digits, but the agent let the attacker guess 2 of them (repeatedly, until he got it right). That's truly awful.

hkmurakami• 12 years ago

The attacked got the last 4 from Paypal and Godaddy asked him to guess two more digits.

Osiris5• 12 years ago

When a customer calls into the GoDaddy call center, they are supposed to provide a 4 digit pin in order to gain access to their account.

I don't work in that department, but I'll forward the page to the CEO and make sure it gets read and addressed.

Osiris5• 12 years ago

UPDATE: GoDaddy's CEO let me know that they contacted the affected party, the internal security team, and Twitter security. I'd hope they are also looking at policy/training changes for customer support, but that wasn't mentioned.

SimHacker• 12 years ago

While you're at it, tell him to stop shooting elephants, donating money to Mitt Romney, decorating your web site with scantily clad women, and acting like a sexist pig.

Edit: I see you got a new CEO since I and so many other customers left in disgust about your company's support of SOPA and all those other issues. I'm sure you still have binders full of scantily clad women to decorate your booths at trade shows. Your company is permanently tainted, one of the worst examples of what's wrong with the computer industry, and I'm never coming back.

blazzar• 12 years ago

The reason for the 6 digits is probably linked to PCI DSS compliance where agents are allowed to view the first 2 and last 4 of stored card numbers.

gaius2• 12 years ago

The first digit of a credit card number identifies the type of company the issuer is, e.g. 1 is an airline, 3 is a travel agency, 4 and 5 are credit card companies, 7 is an oil company. The final digit is a checksum. Two things about this baffle me: 1) that websites feel the need to have a dropdown to identify what sort of card you have instead of just figuring it out and 2) why they need to ping it off the issuer's servers to detect you've entered an invalid number e.g. a typo.

blueskin_5• 12 years ago

well, http://plaintextoffenders.com exists - someone should make creditcardoffenders.com .

qznc• 12 years ago

Now there needs to be a browser plugin, which warns you when you are about to create an account on such a website.

Achshar• 12 years ago

Kind of off topic but that site also shows sites that email users their password when they create the account. That does not necessarily mean they store it plain text. Though the kind of devs that would send the password in email are likely to store it in plain text, but it's not necessary.

mathattack• 12 years ago

Credit card #s and social security #s are not secure. But what should companies use instead? We're a long way from everyone having fingerprint scanners, and I'm sure there will be a way to break that too.

Isn't the solution more around recovering from when the break-ins inevitably happen?

if_by_whisky• 12 years ago

Fingerprint scanners sound worse than credit cards to me... Why would you want a password that you can't ever change and leave copies of everywhere you go?

aestra7• 12 years ago

Does Go Daddy require recurring payments or can you pay for a couple years up front? If so you could have generated a one time card number OR had been issued a new card since you paid you you might not even know your card number. How would this even work for everyone?

https://www.namecheap.com/ accepts bitcoin as payment to avoid this situation.

adventured2• 12 years ago

You can pay up to 20 years in advance on a domain with GoDaddy if I recall.

ksk• 12 years ago

The "we take X seriously at Y company" line is so tired. These companies are so incompetent that it would be funny if not for people getting screwed IRL.

WA2• 12 years ago

Reminds me of harvesting ICQ numbers. There was a time when you could search 6-digit ICQ numbers for expired freemail addresses like Hotmail (they deleted your account after a while), register that freemail address and reset your ICQ number password to get a brand "new" 6-digit number. I think this doesn't work anymore, since most freemail hosters don't "free" expired email addresses but keep them locked.

It still works if you find an expired domain name, register the domain name and then do the whole password-reset procedure. Might be cheaper to buy a 6 digit number on eBay though :)

fredsted2• 12 years ago

Maybe I'm missing something, but who uses ICQ still? And why not focus on 3-digit numbers? There's a million 6-digit ICQ numbers; not that unique.

WA2• 12 years ago

This was ~10 years ago. 3-digit numbers were all gone. Having a million 6 digit numbers increases chances to actually get one by registering an expired domain/email address.

In times of 9 digit numbers, 6 digit numbers were still sufficiently unique :)

lurkinggrue2• 12 years ago

I still use my ICQ account.... Mind you it's combined into trillian.

erikb• 12 years ago

Is it not possible to use the last bills as verification of who you are? screenshot of the bank statements and asking GoDaddy to verify their bank data and you've shown that it is in fact you who paid the bills.

Also if account data is changed they MUST keep a log of what your data was before. At least anything beside passwords.

quackerhacker• 12 years ago

I feel so bad for Naoki that he was compromised in this scary manner. While the hacker did con his way on the phone for personal information, at the minimum, it's...hmmm....not nice...but "informative/narcissistic," of the hacker to describe his method to the victim.

Makes me happy that companies are moving towards text authentication since emails are easy (or at least well practiced) to compromise.

Note: Time to change my Time To Lives on my MX records and up my security.

GunlogAlm• 12 years ago

Why on earth are people still using GoDaddy?

sdaityari• 12 years ago

Serious lapses on the parts of PayPal and GoDaddy. Ironically, there are sites which even refuse to identify the real person - like this one posted on HN a few days back(http://kevinchen.co/blog/square-identity-verification/)

yaeger• 12 years ago

What I take away from this is that:

a) Two Factor should be mandatory and as soon as it is, any representative of the company MUST insist that a reset cannot be done over the phone. It should be highly suspicious if someone comes up and says "Hi, I lost my email account access AND my phone so could you please reset my password via phone now?"

b) If not Two Factor, the security questions should also be mandatory. No other "data" like past addresses or cc numbers should suffice to reset over the phone if the person doesn't know the answers to all security questions.

And, speaking of these questions, of course they should be stuff that you know and cannot be "guessed" by anyone who is able to read your facebook page or similar. Maybe even some non nonsensical thing like "Favorite Food" - "Horse Droppings". As long as you remember this, nobody should be able to "hack" that over the phone. Even if you go on and on on facebook about how you "could eat your way through a giant bowl of pasta you love it so much"

aestra7• 12 years ago

As long as you remember this

I would NEVER remember this. EVER.

blueskin_5• 12 years ago

Don't use GoDaddy. Simple as that.

If that hadn't happened, he'd still have his twitter account.

If I were using an @gmail.com email address for my Facebook login, the attacker would not have been able to access my Facebook account.

Just google and the NSA then. Also, Gmail has an exposed password reset and social-engineerable support. A server running Postfix/Exim doesn't.

I'd consider a domain with a good registrar far more secure than google.

Tepix2• 12 years ago

I read the article. Sounds like an epic fail by GoDaddy, I blame them for 99% of what happened. Glad I'm not a customers of theirs... Oh btw, try to find a registrar that does 2factor authentication!

bjpirt• 12 years ago

Try Gandi:

http://wiki.gandi.net/en/contacts/login/2-factor-activation

(note to self: activate 2FA)

bevacqua• 12 years ago

http://xkcd.com/1279/

vladtaltos• 12 years ago

besides the obvious stupidity of the parties involved, why would anyone pay for such an uninformative handle 50k ? @N ? seriously -- doesn't spam occur for twitter feeds yet ? I remember when google started off they didn't allow you to have email addresses less than 6 characters to avoid spam...

btw, @! google search returns 0 results. interesting... hmm, twitter apparently allows alphanumeric handles only...

edem• 12 years ago

This was the last straw. I'm moving away from GoDaddy.

ck22• 12 years ago

This story is horrifying because PayPal was the enabler.

PayPal gave the attacker the last four digits of my credit card number over the phone

That person should lose their job if it is not PayPal policy.

I really hope by some small chance the person that did this gets some serious prison time, if not for this then anything else prior or down the road. Then maybe one of those mornings they wake up in prison they can ponder if it was all worth it.

fuj• 12 years ago

This wasn't paypal's fault. I mean entirely. The problem was with goDaddy. The last 4 digits of credit cards show's up everywhere. Check your receipts. Related question in stackexchange: http://security.stackexchange.com/questions/37758/safety-of-...

GoDaddy should not use the 4 last digits as a way to confirm identity, exactly for the reason I mentioned above

ck22• 12 years ago

PayPal gives out info to someone completely unverified and it is not their fault?

It would be one thing if this was a spouse or someone intercepting their physical mail. It's not. It's someone out of the blue who called PayPal to get the last four of a complete stranger.

GoDaddy's verification is bad too but at least they had some kind of attempt.

baldfat• 12 years ago

Why oh why do people support GoDaddy?

I find their TV Commercials the worst and makes us as a community go back to the 1950s stereo types????

Love it when I help churches with their websites and it has a GoDaddy account :(

mseebach4• 12 years ago

It's possible that this was gross negligence on part of the employee and that the thief just got really, really lucky - but that seems unlikely.

This is a systemic fault of PayPal and firing a lowly phone-jockey will not solve that. There are computer system protections that were clearly not in place (the representative was able to see this data on the screen, rather than having to enter it blind and have it validated - or, if they did, they had infinite re-tries which is also bad. Three wrong attempts, and the account should be locked and have to be escalated) but there are also culture/training problems: Until otherwise satisfactorily proven, anyone calling must be assumed to be in bad faith when they call. A representative with this mindset would not let a caller start guessing the "password".

jotm2• 12 years ago

See, that "account should be locked" is what got people to hate Paypal in the first place - they used to be quick on the trigger, wrong IP = locked account; transfer to new account = locked account, etc. And it took 1-2 weeks to restore.

Now they laxed the security somewhat and people give them sheet for that... There's no winning for them, is there?

But really, the employees should not give away any user information, ever. It should be a one way street here. That would have stopped the attacker in this case, as well, I believe...

yuhong• 12 years ago

I wonder if David Marcus can help here.

twice• 12 years ago

This is quite frustrating even to read!

benjamta• 12 years ago

Crumbs, this makes interesting reading - clearly lots of failings by the companies involved here.

However. If someone were to steal a physical asset in order to extort something else out of me I would go immediately to the police. I'd have thought I'd do the same if the assets involved were digital.

I've no idea if a criminal offence was committed in what ever jurisdiction this happened. But I'd have thought extortion is illegal is many parts of the world?

klapinat0r• 12 years ago

In case OP reads HN: If your websites are hosted with GoDaddy, I would consider them compromised aswel.

He may say that he has left them alone, but you have no chance of knowing.

abus• 12 years ago

Why does anyone believe the hacker's story of how he did it? It's possible he told the truth but it's likely he did not.

outericky• 12 years ago

Regardless of how this all went down, and is responsible... It is still theft right? Falsifying ones identity and taking possession of @n is stealing and should be covered under some law, no?

EA• 12 years ago

Up until late 2013, it was very easy to social engineer your way past Customer Sales Rep call screens to gain access to an AT&T account once you put together a few pieces of personal data (which was even easier to obtain) of the account owner. You didn't need to know the account password to gain access if you had other pieces of information. Those bits of information leak out through other service providers and are sometimes available through State and Federal Government systems.

That meant that anyone using SMS via AT&T for two-factor auth was vulnerable.

The extra layer of security is only enabled if you call AT&T and ask them to further protect your account from future changes.

kristiandupont• 12 years ago

Using my Google Apps email address with a custom domain feels nice but it has a chance of being stolen if the domain server is compromised.

Sigh I use Google Apps exactly so that I have control over the domain and aren't subject to the good will of Google. I had never thought of this particular problem. Now I don't know what to do.

cbhl• 12 years ago

This really boils down to who is a better sysadmin-- you or the Google SREs. Choose reliable and paranoid providers that actually verify your identity before shenanigans and you can mitigate the entry vector.

konklone2• 12 years ago

Yeah, I disagree with Naoki's conclusion. I'm pretty sure he just didn't have 2FA turned on with GoDaddy (which I understand - I didn't think to turn 2FA on with my provider until I read his story).

The admonition to use a @gmail.com address was annoying enough to me that I responded with a blog post: https://konklone.com/post/protect-your-domain-name-with-two-...

tedchs2• 12 years ago

The real solution is to use a DNS registrar and DNS hosting that properly verifies your identity before allowing changes. Google Apps has nothing to do with it, and in fact has enabled 2-factor auth for a long time. Everyone should be using it.

patrickwiseman• 12 years ago

Have you reported it to someone with prosecution powers?

http://www.fbi.gov/about-us/investigate/cyber

http://www.ic3.gov/default.aspx

barlescabbage• 12 years ago

What if this whole story was a lie? What if it was the hacker's final attempt to steal the @n twitter name.

wallzz• 12 years ago

you need to stop watching movies!

nogridbag2• 12 years ago

Slightly OT, but someone registered a Twitter account with my primary e-mail address. I received a "Confirm your e-mail account" email with a link "Not My Account". That link brings me to a page that says "Sorry, that page doesn’t exist!".

There doesn't appear to be any way to contact Twitter about this.

Shortly after, I received a second email "Welcome to Twitter, <username>"

Going to: https://support.twitter.com/forms/impersonation

..and selecting "Someone is using my email address without my permission." tells me to submit a general support ticket. That's fine except none of the general categories has anything to do with this problem and choosing "My issue is not in the list" simply redirects me immediately to the root support page. I submitted a ticket with a different topic and have not heard back from them in a week and expect I never will.

vehementi• 12 years ago

Doesn't this mean your email account is compromised?

nogridbag2• 12 years ago

I doubt it. I have two factor auth set up on my email. Looking at the timestamps, the Welcome email was sent the same minute as the "Please confirm" email, so it's possible the Twitter account is not live and this was just an automatic welcome e-mail. Still, it would be nice if the "Not My Account" link actually worked properly or there was some way to contact support about it.

metaphorm• 12 years ago

this story reeks of fake to me.

what sane person doesn't call the FBI when an attacker blatantly commits fraud against them, admits to it, and then commits extortion based on the successful fraud? Furthermore, what kind of attacker explains how they attacked? Thats ludicrous.

this has got to be some kind of roundabout way of advertising for the various competitors of godaddy mentioned in the post.

konklone2• 12 years ago

This is a terrifying story, and I'm very glad Hiroshima wrote it, because I didn't have two factor auth turned on with my domain provider. Now I do!

It seems like if he'd had 2FA turned on with GoDaddy, this may not have happened. So rather than use @gmail.com addresses to register for things, as he recommends, just turn on 2FA with your provider. And if your provider doesn't support it, leave them and tell them why.

The admonition to use a @gmail.com address was annoying enough that I actually put up a response blog post just on this point: https://konklone.com/post/protect-your-domain-name-with-two-...

owens992• 12 years ago

I hope Twitter can help this guy somehow.

jdrenterprises• 12 years ago

I'm not a programming expert, nor a process expert, but the way I see it...

... there has got to be a multi-stage process for authentication that does NOT use any CC or SSN. Of course, the responsibility lies with the account owner for maintaining passwords/authentication information.

If you lose the information, no way to recover it.

I say this because it seems (again, I'm not an expert) that these thieves use social engineering mostly in the "data recovery" stage of the process.

The only way to tighten that from my perspective is to put maximum responsibility on the account owner to keep their logins, passwords (again, for multi-stage authentication), and such on hand. Don't have a need to recover your info, and others can't use the recovery process to get to your account.

I guess it wouldn't be a perfect scenario but... this, or lose @N.

I am sorry to hear there are companies allowing these practices, though... sad.

rodrigocoelho• 12 years ago

Namecheap posted a tweet[1] with an offer to move domains out of GoDaddy:

How we make sure that you don't lose your $50,000 Twitter username: http://ow.ly/t4yR8 $5.99 domain transfers with code BYEBYEGD

[1] https://twitter.com/Namecheap/status/428555697882935296

pistle• 12 years ago

You can sell twitter @'s now? #itsNotWorth50k

Looks like a typo. Imparts zero cred since 99.999% of people will not take your ability to "possess" a short twitter account name as helpful for whatever else you may be trying to do.

As far as the "Sorry I am so technically gifted. Let me tell you what you should do to prevent me next time..." thing, what kind of cartoon caper is this?

rdl• 12 years ago

The advice to use @gmail.com vs. a custom domain name seems kind of questionable if you use a reasonably secure registrar. Not GoDaddy.

Using an unusual/unknown address for account validation mails (maybe with forwarding of other communications) probably would make sense, though. And/or sites coming up with a better account-recovery procedure, perhaps outsourced to a startup.

There's probably a market for a super-secure email address for account login mails, but that isn't a free gmail account.

amrita1306• 12 years ago

Thats awful.. I use both GoDaddy and Paypal for my website and this has certainly made me a more cautious of securing sensitive information

jimwalsh• 12 years ago

Yet another example of a compromised GoDaddy account and someone potentially losing their domain. Yet people continue to use GoDaddy time and time again.

lurkinggrue2• 12 years ago

It was worth ditching GoDaddy just so I wouldn't have to use that horrible interface ever again.

ests• 12 years ago

It was like I read some scary book.

maxk42• 12 years ago

Someone tracked down the hacker: http://www.reddit.com/r/hacking/comments/1whk3a/tracking_the...

Brandork• 12 years ago

I have seen great articles that document the best practices, patterns and anti-patterns for authentication within an application or storing passwords etc. But where is the gold standard for authenticating people over the phone?

Good Developers understand how critical it is to handle authentication and password storage well. It can be complicated thing and is very easy to screw up.

But all that goes out the window when somebody calls the support line. There needs to be just as much scrutiny placed on over the phone authentication as there is within an application. The problem is likely that those over the phone patterns/anti-patterns are not well documented and available.

How I Lost My $50,000 Twitter Username

Related Stories