How I Lost My $50,000 Twitter Username - <AUTHOR> https://medium.com/p/24eb09e026dd <comment><USER2> Why would a company _ever ever ever_ accept 6 digits of a credit card number as a way to authenticate an identity??

Credit card numbers are not secure. Therefore, they should not _ever_ be accepted as authentication. Especially only 6 digits of it! This is by far the most shocking part of this story. As if I needed another reason to despise GoDaddy.

[Edited to add] I would sure love to see a scarlet letter list of companies which allow such practices, so I can never use them.

<comment><USER3> When a customer calls into the GoDaddy call center, they are supposed to provide a 4 digit pin in order to gain access to their account.

I don't work in that department, but I'll forward the page to the CEO and make sure it gets read and addressed.

<comment><USER4> While you're at it, tell him to stop shooting elephants, donating money to Mitt Romney, decorating your web site with scantily clad women, and acting like a sexist pig.

Edit: I see you got a new CEO since I and so many other customers left in disgust about your company's support of SOPA and all those other issues. I'm sure you still have binders full of scantily clad women to decorate your booths at trade shows. Your company is permanently tainted, one of the worst examples of what's wrong with the computer industry, and I'm never coming back.

<comment><USER3> I get it. I came on 2 years ago after Bob had already left. GoDaddy has also officially stopped doing "GoDaddy Girls", which is a relief. Those old commercials were awful.

</comment></comment></comment></comment><comment><USER5> I feel bad for this guy, and twitter needs to do the right thing and return to him his handle.

Then I can come back here and post nasty comments about squatters.

<comment><USER6> Any thoughts why the attacker would tell the guy how he did it if this is the obvious solution?

<comment><USER7> Yeah why is that attacker so nice and kind? No joking, it's bad for their business.

<comment><USER8> Maybe just 'pride' of what he accomplished.

<comment><USER9> Or an axe to grind.

Perhaps he has something against GoDaddy (many do) and/or PayPal (again, many do) so took the opportunity to make them look bad by making sure that their effective complicity in the hack is well known.

</comment></comment></comment></comment></comment><comment><USER10> Heads really ought to start rolling at PayPal. Their general approach to security is, quite frankly, appalling.

Is there any possible rational for Paypal to give the last four digits of his card number to "him" over the phone? Given that they're routinely used for verification, it's as if they've never heard of social engineering. It's simply inexcusable.

And it's almost as bad as the ridiculous "Log In Without Your PayPal Security Key" option that lets you bypass 2-factor auth and head straight to the ultra- secure world of the ridiculous security questions such as the ever-popular "what city were you born [that's also listed on Facebook]" and what not. I still can't believe they think that's a good idea.

<comment><USER11> The attacker was posing as a PayPal employee, not the card owner. Of course, PayPal still needs better security, but posing as an employee of the same company is a classic social engineering exploit.

<comment><USER12> And that part was never really answered either. How can he pose as an employee calling in from an outside line? Does PayPal not tell you when an extension from PayPal is calling you?

<comment><USER13> he was probably posing as an employee of the account holder, not paypal

<comment><USER14> Ohh, good point. I never thought of that. I assumed employee of Twitter as well.

</comment></comment></comment></comment></comment><comment><USER15> Seems like Twitter could easily verify the story based on their own logs and then restore access to his N account. He doesn't mention pursuing that, though.

<comment><USER16> He said he wasn't using it much. Thus, isn't he basically a squatter?

<comment><USER17> He's definitely a squatter. If you own something and you don't use it, you're a squatter. I own an old original Nintendo that I haven't used all year. That's why if someone comes into my house and takes it, it's my own fault.

<comment><USER18> I tend to disagree:

The right of ownership includes to right to use what you own in your own way.

<comment><USER19> The ownership of twitter namespace is Twitter's alone, not the user's

<comment><USER8> IIRC, Twitter officially doesn't allow you to sell your handle.

<comment><USER19> I did not know that but I'm not surprised.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> This story is horrifying because PayPal was the enabler.

 _PayPal gave the attacker the last four digits of my credit card number over the phone_

That person should lose their job if it is not PayPal policy.

I really hope by some small chance the person that did this gets some serious prison time, if not for this then anything else prior or down the road. Then maybe one of those mornings they wake up in prison they can ponder if it was all worth it.

<comment><USER21> This wasn't paypal's fault. I mean entirely. The problem was with goDaddy. The last 4 digits of credit cards show's up everywhere. Check your receipts. Related question in stackexchange: [http://security.stackexchange.com/questions/37758/safety- of-...](http://security.stackexchange.com/questions/37758/safety-of- publishing-last-4-credit-card-digits-in-age-of-fast-computing)

GoDaddy should not use the 4 last digits as a way to confirm identity, exactly for the reason I mentioned above

<comment><USER20> PayPal gives out info to someone completely unverified and it is not their fault?

It would be one thing if this was a spouse or someone intercepting their physical mail. It's not. It's someone out of the blue who called PayPal to get the last four of a complete stranger.

GoDaddy's verification is bad too but at least they had some kind of attempt.

</comment></comment></comment><comment><USER22> I believe that it is ISO 9001 (quality assurance) that states that a company must be able to audit any stored data and data changes dating back some time. Judging by Paypal (specially for being a financial company), Twitter (for being an open capital company), and GoDaddy's size they may all comply to ISO 9001, but I'm just guessing.

Anyhow, if any of them actually comply to ISO 9001, it is possible to audit previous data to establish the true identity of the owner in some arbitrary date before any of this happened.

Quite possibly, to avoid unnecessary user annoyance, these companies will only subject themselves to the effort of analyzing that data under court order, so it's fair to suppose there is need to open a judicial process. Therefore, I believe it's possible to regain access to everything that was supposedly stolen, even though it may take quite some time.

</comment><comment><USER23> Everyone looks bad here, but I want to focus on Twitter. For me this case is yet another demonstration that Twitter sees its customers as advertisers and places low priority on the community.

I pay Twitter nothing, and yet the service is valuable to me. So instead of continuously crippling the service in the name of goodness knows what, why not actually charge users for a premium experience. Things like customer service that works, a gold member status flag, controls on swapping account ownership, analytics and so on. Offer 3 paid levels - personal, business and corporate, and obviously keep the free level forever. Once revenue comes from customers, then perhaps it will help in understanding that while other revenue night be larger, the true value of Twitter is derived from the community.

<comment><USER19> Or look into alternatives in the microblogging space. What ever happened to Status.net/ostatus?

<comment><USER24> But the problem with alternatives is the fact that they're alternatives. Not what other people are using. If it's a social app, it's important.

<comment><USER19> I dug a little deeper, and ostatus is a currently working group committee within the w3c.

If I was the cio at oh, say an org in the public realm (generic government agency for example), I'd rather have control over the publishing and namespace of its tweet-like messages rather than putting every egg into the single- basket solution. Who knows if twitter will be around 20 years from now?

The nice thing about standards is that there are so many to choose from.

</comment></comment></comment></comment><comment><AUTHOR> An interesting point made was to avoid using custom domains for the login emails, since a DNS takeover would compromise your accounts tied to that email.

<comment><USER25> I think that's missing the point a bit. Using gmail as your primary address will make you vulnerable to Google arbitrarily (or even justified) shutting down your access. We all heard stories about that.

What you should do, is make sure that you trust your registrar. Paypal sure have some questionable practises, but the real culprit in this story is clearly GoDaddy.

</comment></comment><comment><USER26> Ditch GoDaddy - They are a terrible company.

Also considering closing my paypal account now.

<comment><USER27> I'm consistently surprised at the number of complaints against GoDaddy. They are a horrible company! You get what you pay for...

<comment><USER3> Just a side note here, GoDaddy has been under new management for a little under two years. There's a lot internal changes happening specifically aimed at improving usability and infrastructure.

<comment><USER27> (I didn't know that). That's fine, but there are just SO many other companies that provide the same service...

</comment></comment></comment></comment><comment><USER28> One thing that people should realize in why Twitter may not respond to these kinds of issues, or may be slow to respond, is that it's probably true that lots of people buy and sell Twitter accounts, and people may report them stolen when in fact they've already sold them to someone.

This kind of thing happened a lot in MMO games which is why they try to push account security into your hands so they don't have to attempt to arbitrate in deals that may or may not have happened outside of their sphere of control.

<comment><USER29> So what? If Twitter returned control of a handle if someone could prove that they had recently controlled the handle, that would quickly make the handles market dry up.

<comment><USER30> Twitter has no interest in there being a handles market. In fact, I wouldn't be surprised if their T&Cs expressly forbids it.

</comment></comment></comment><comment> brown9-2 Why is anyone still using GoDaddy?

<comment><USER31> Why did someone not sell a Twitter username for $50k?

<comment><USER32> It's against Twitter's terms of service to sell usernames. Technically. Lots of people get away with it I'm sure.

[https://support.twitter.com/articles/18311-the-twitter- rules](https://support.twitter.com/articles/18311-the-twitter-rules)

Abuse and Spam > Selling usernames: You may not buy or sell Twitter usernames.

<comment><USER33> What happens if you do, surely it's caveat emptor?

The rules only say:

"If such permission is not granted, there is no (zero) market value or worth to this account."

If you walk away, cash in hand, are you liable for any punishment other than the banhammer from Twitter?

</comment></comment></comment></comment><comment><USER34> I felt very angry and uncomfortable reading that. I can't imagine being in a helpless position like that.

</comment><comment><USER35> I lost a nice handle (@Houselogic) a few years back. Sent Twitter all the proof and email trail and everything, but they were useless. Every time I email their support, it's a new ticket and I have to explain the whole situation again and again. I gave up after two years.

</comment><comment><USER36> Slightly OT, but someone registered a Twitter account with my primary e-mail address. I received a "Confirm your e-mail account" email with a link "Not My Account". That link brings me to a page that says "Sorry, that page doesn't exist!".

There doesn't appear to be any way to contact Twitter about this.

Shortly after, I received a second email "Welcome to Twitter, <username>"

Going to: [https://support.twitter.com/forms/impersonation](https://support.twitter.com/forms/impersonation)

..and selecting "Someone is using my email address without my permission." tells me to submit a general support ticket. That's fine except none of the general categories has anything to do with this problem and choosing "My issue is not in the list" simply redirects me immediately to the root support page. I submitted a ticket with a different topic and have not heard back from them in a week and expect I never will.

<comment><USER37> Doesn't this mean your email account is compromised?

<comment><USER36> I doubt it. I have two factor auth set up on my email. Looking at the timestamps, the Welcome email was sent the same minute as the "Please confirm" email, so it's possible the Twitter account is not live and this was just an automatic welcome e-mail. Still, it would be nice if the "Not My Account" link actually worked properly or there was some way to contact support about it.

<comment><USER38> Maybe the "Please confirm" mail was fake and actually meant to get you to click on the "Not My Account" link ...

</comment></comment></comment></comment><comment><USER39> I found it interesting how open the attacker was about how they did it.

<comment><USER40> He probably wanted to brag to _someone_ about how he did it. It just so happened to be his victim.

<comment><USER25> Or he felt a bit remorseful about the whole thing and figured that _at least_ he could help the guy not getting caught in the same net again.

</comment></comment></comment><comment><USER41> Don't use GoDaddy. Simple as that.

If that hadn't happened, he'd still have his twitter account.

>If I were using an @gmail.com email address for my Facebook login, the attacker would not have been able to access my Facebook account.

Just google and the NSA then. Also, Gmail has an exposed password reset and social-engineerable support. A server running Postfix/Exim doesn't.

I'd consider a domain with a _good_ registrar far more secure than google.

</comment><comment><USER42> And we all know how this would end. GoDaddy and Paypal will try to make this right because of the negative publicity. Why does it always take a post like this to call for help?

<comment><USER43> GoDaddy and Paypal have every incentive to bury their shoddy security practices and deny everything that the OP is claiming, to avoid a PR disaster. They _might_ quietly return to the issue later and perhaps address some of their security issues... maybe.

</comment></comment><comment><USER44> I don't understand why Twitter doesn't have the standard 30 day wait period on handle changes that most sites have. For a while it was a standard to not let old usernames be available until 30/60/90 days after a change, so that in the event that this kind of thing happened, it could be reclaimed with ease as soon as the GoDaddy account is in his possession.

</comment><comment><USER45> This is a terrifying story, and I'm very glad Hiroshima wrote it, because I didn't have two factor auth turned on with my domain provider. Now I do!

It seems like if he'd had 2FA turned on with GoDaddy, this may not have happened. So rather than use @gmail.com addresses to register for things, as he recommends, just turn on 2FA with your provider. And if your provider doesn't support it, leave them and tell them why.

The admonition to use a @gmail.com address was annoying enough that I actually put up a response blog post just on this point: [https://konklone.com/post/protect-your-domain-name-with- two-...](https://konklone.com/post/protect-your-domain-name-with-two-factor- authentication)

</comment><comment><USER46> Someone tracked down the hacker: [http://www.reddit.com/r/hacking/comments/1whk3a/tracking_the...](http://www.reddit.com/r/hacking/comments/1whk3a/tracking_the_hacker_of_the_50000_twitter_handle/)

</comment><comment><USER47> No lawyer? Any reason why none was mentioned? Extortion is serious federal crime (across state lines, multiple companies, even clear admission of guilt). At the least it would get GoDaddy's attention vs. just asking nicely.

<comment><USER48> I was surprised that the victim didn't get an attorney involved. This is an example of a situation in which a court could very swiftly (same day, usually) issue an injunction to preserve the status quo while the merits get sorted out in court. Most domain providers I've dealt with will freeze a disputed account pending legal resolution of ownership, which can be decided via the court system or a WIPO arbitration.

</comment></comment><comment><USER49> >Using my Google Apps email address with a custom domain feels nice but it has a chance of being stolen if the domain server is compromised.

 _Sigh_ I use Google Apps _exactly_ so that I have control over the domain and aren't subject to the good will of Google. I had never thought of this particular problem. Now I don't know what to do.

<comment><USER50> This really boils down to who is a better sysadmin-- you or the Google SREs. Choose reliable and paranoid providers that actually verify your identity before shenanigans and you can mitigate the entry vector.

</comment></comment><comment><USER51> Reminds me of harvesting ICQ numbers. There was a time when you could search 6-digit ICQ numbers for expired freemail addresses like Hotmail (they deleted your account after a while), register that freemail address and reset your ICQ number password to get a brand "new" 6-digit number. I think this doesn't work anymore, since most freemail hosters don't "free" expired email addresses but keep them locked.

It still works if you find an expired domain name, register the domain name and then do the whole password-reset procedure. Might be cheaper to buy a 6 digit number on eBay though :)

<comment><USER52> Maybe I'm missing something, but who uses ICQ still? And why not focus on 3-digit numbers? There's a million 6-digit ICQ numbers; not that unique.

<comment><USER51> This was ~10 years ago. 3-digit numbers were all gone. Having a million 6 digit numbers increases chances to actually get one by registering an expired domain/email address.

In times of 9 digit numbers, 6 digit numbers were still sufficiently unique :)

</comment></comment></comment><comment><USER53> This is a scary story!

Focusing on the Twitter handle sale part: I have the twitter handle @jetsetter, and have been offered multiple thousands of dollars for it (guess who!).

Unfortunately, selling a twitter handle is against TOS. Only @israel has been officially allowed to transfer hands for money, that I'm aware of.

So trying to broker the sale of a twitter account can allow the buyer to report your 'behavior' to twitter. They can seize the account and make it so no one has it, which may be what the buyer prefers to you having it.

So no matter the price you could command, it isn't like you could just list @n up for sale and make it rain.

<comment><USER54> If you're refering to this: [http://www.theguardian.com/technology/2010/sep/14/twitter- us...](http://www.theguardian.com/technology/2010/sep/14/twitter-user-sells- israel-username)

at the bottom a twitter representative is quoted as saying that as long as they give you permission to sell/buy a handle they won't block/lock the account.

Also apparently CNN also purchased a handle[1].

[1] [http://www.businessinsider.com/cnn-acquires-cnnbrk- twitter-a...](http://www.businessinsider.com/cnn-acquires-cnnbrk-twitter- account-with-nearly-1-million-followers-2009-4)

<comment><USER53> I wrote in 2009 describing the situation and asked for approval. I was turned down. Reviewing the support ticket now, I think I could have handled the sale more professionally. Maybe that's why.

</comment></comment></comment><comment><USER55> It's sad, but twitter's not transferring it back in a week's time gives me more confidence in twitter, not less. There isn't any evidence of the stealing of the domain names and the extortion available besides OP's copies of the email messages and information that GoDaddy won't provide. With the value twitter ID has, twitter shouldn't do anything without clear evidence.

He might have been able to get it back if it was his trademark or even name that he lost and not some witty username.

<comment><USER14> I was thinking how witty that would be if THIS was the actually hacker, and he was using us to create a shitstorm in order to rush Twitter into giving him the account. I'm sure there is sufficient data to support that he was the original owner though.

<comment><USER55> True. I believe the original poster, no question about that. I hope twitter reverses it, but I can see why they haven't yet.

</comment></comment></comment><comment><USER56> Have you reported it to someone with prosecution powers?

[http://www.fbi.gov/about-us/investigate/cyber](http://www.fbi.gov/about- us/investigate/cyber)

[http://www.ic3.gov/default.aspx](http://www.ic3.gov/default.aspx)

</comment><comment><USER57> Who are people's current favorite domain registrars? I've been with name.com for the last year or so and have been happy, but I'm always curios to hear from others.

<comment><USER58> [http://DNSimple.com](http://DNSimple.com) for us. Their template system and support is fantastic.

<comment><USER59> I've heard good things about them from friends. This article was the last straw for me -- I just migrated my 90 domains off of GoDaddy. Actually, I didn't. I just told DNSimple to do all the work, via their (brilliant) concierge onboarding option: [http://blog.dnsimple.com/2014/01/domain- transfer-concierge-s...](http://blog.dnsimple.com/2014/01/domain-transfer- concierge-service/)

"Here's my credit card and GoDaddy creds, guys, and here's a technical note about my DNS settings that I want you to pay extra special attention to. Tell me when I should expect to start getting the GoDaddy confirmation emails. Other than that, have fun playing with DNS settings -- I never want to even think about them again."

This post is 5% "Here's my recommendation for a DNS service" and 95% "Notice how in return for an hour or two of grunt work a SaaS company just made it very easy for me to award them $2,000 of high-margin recurring revenue a year despite being twice as expensive as my pre-existing option by successfully overcoming my 'I would love to move off my existing solution but it requires grunt work so I think I'll punt on that decision for, oh, eight years' objection? That's a really good trade. You should consider offering it in your SaaS business, too, in any way that makes sense for it."

<comment><USER60> That does sound really good.

On the other hand, we're talking about security here, and, sadly, a company that has extra helpful support may be more easily socially engineered. The author's advice to use gmail.com addresses only works because Google basically has no customer support for gmail.com, so there's no one to social engineer!

<comment><USER59> This is, ironically, one of the reasons I feel more secure with their 3-man firm than with GoDaddy. GoDaddy has all the resources to put in place a well- architected ISOwhatever procedure with flow-charts, custom software, and government document review... and then fail at their one job. These guys, on the other hand, pretty much will be forced to having an actual human who knows me decide "Is this chap claiming to be Patrick really Patrick?" I feel really secure that a smart geek who has standing orders from me "I DON'T TRANSFER DOMAIN NAMES EVER." can reason out an ad hoc verification process which is much, much more likely to reject a fraudster than the GoDaddy CSR following the manual will be. (I mean, since they're two degrees of separation from me and our mutual friend is a business acquaintance well known to both of us, they could literally just call the friend and say "Someone is claiming to be Patrick and wants to transfer all his domains. You know that's a thermonuclear change since you're in this industry too. Call him and ask whether he knows about this. We'd both appreciate the favor. If he does we're good, if he doesn't, we're blocking this chump.")

<comment><USER60> Those are excellent points. Some of it only applies to you (being a large customer and having 2 degrees of separation), but I too would feel a lot more comfortable with 3 decent- and competent-sounding guys like them than with a larger company like GoDaddy.

</comment></comment></comment></comment></comment></comment><comment><USER61> Wow, this is both interesting and terrifying. I have a two character Twitter handle that I use actively and it makes me worry that one day I might be targeted too using a similar method, although so far I've had no problems.

<comment><USER62> I have a two character twitter handle also, and am active on it. Used to receive several "reset" emails per day before two-factor authentication.

</comment></comment><comment><USER63> If the author is reading, did you end up getting back your @n username? If so, did you simply go to Twitter and explain to them the whole story?

<comment><USER61> I don't think you realize how unresponsive and poor Twitter's support is. I was once locked out of my Twitter account via anything but Tweetdeck (due to two-factor authentication suddenly breaking and not sending SMS') for four weeks before I wound up accidentally finding a PC that I hadn't signed out of previously and was able to disable. I logged a ticket on the first day it happened and never even received a response.

<comment><USER64> I can concur with their shitty support. I guess iOS 7 autoupdated my Vine app and somehow logged me out. I tried password resetting every email I could think of, I tried to connect via my social network. No dice. My account couldn't be found. I email their support team with my username asking them if they could provide me with my email, do a forgot password to the email. I even linked them to a few direct vines I had created and saved the URL to. Their response was unless I could provide them with the Vine ID number of my user account they could not locate my account.

Seems I emailed them back and forth six times and I kept getting this canned message from them. Needless to say, I've given up and deleted Vine from my phone.

"Unfortunately, we are unable to locate the Vine account in question. If you can still log in to your Vine account, go to your profile settings and select either "Invite via text" or "Invite via email." From there you will see your Vine account ID number. Can you reply to this message with the Vine ID number?

If you no longer have access to this account, but can see the account in Vine search, press the more icon (three dots) on the top right of the profile. After that, tap on "Share this profile" and from there you will see your Vine account ID number."

</comment></comment></comment><comment><USER65> Just find it interesting to see how different the conversation on the same topic is over at reddit, [http://www.reddit.com/r/technology/comments/1wfwfp/how_i_los...](http://www.reddit.com/r/technology/comments/1wfwfp/how_i_lost_my_50000_twitter_username/)

<comment><USER66> Sad to say, reddit sounds more human today than HN. So many people here saying, "He only tweeted 3 times in 2013, he deserves to lose it". Have some empathy!

You think the hacker who tricked Paypal and Godaddy is in the right here to steal it? I can't believe it.

<comment><USER67> I found this story interesting for the social engineering aspect. The lack of "outrage" is actually quite refreshing.

</comment></comment></comment><comment> nevi-me My custom domain address was stolen with the Dropbox data leak, got so much spam that I set my Gmail to pull my mails via POP3. Then I changed everything to use my Gmail, and locked down my Gmail account.

I've heard people go on about how Google (and I suppose other corporations) are evil, and how they are rolling their own custom mail solutions etc. It's times like these that people lose important things.

Also, I really don't understand why US companies must store credit card details. I understand the convenience, but there's been a lot of security compromises to let this practice continue. In South Africa online retailers don't store CC info, yet we aren't being brought to our knees by inconvenience.

At least the attacker mentioned his methods, so GoDaddy and PayPal can educate their staff better.

<comment><USER68> What do you mean by Dropbox data leak?

<comment><USER69> A project document with e-mail addresses was retrieved through the account of a dropbox employee[1].

Some people noticed they got e-mail through unique non-disclosed e-mail addresses.

[1]: [http://lifehacker.com/5930706/dropbox-confirms-user-email- le...](http://lifehacker.com/5930706/dropbox-confirms-user-email-leaks-offers- new-security-features)

</comment></comment></comment><comment><USER70> what's more likely, someone hacks your domain name / DNS gaining control of your MX records or someone hacks your username @gmail.com?

<comment><USER71> possibly depends on whether you are using 2-factor auth with gmail.

<comment><USER72> Just Google's notification "why are you suddenly using your accounts from a different country" can be life-saving.

(As well as not putting any important stuff there)

</comment></comment></comment><comment><USER73> I have a four letter twitter handle(zaid) and I probably average a half dozen forgot-password requests daily...many of them people in the middle east with the same name as me trying to take over my account.

I've had two users offer to buy my username.

</comment><comment><USER74> It's not a $50K Twitter username unless someone actually paid $50K for it at one point, is it?

"Not accepting an offer of $50K for a twitter username I didn't use" doesn't really count...

<comment><USER75> It's worth what people are willing to pay for it. If people are willing to pay $50k then it is worth $50k. Of course it might have gone down in value since the offer.

<comment><USER76> That logic only works once an actual payment is made. Claiming you are willing to pay and actually paying are two very different things.

</comment></comment></comment><comment><USER77> Since medium also depends on Twitter, his page is no longer available. I checked @N_is_stolen page, it is fresh. So, all his posts in medium is gone, just because there is a change in username?

</comment><comment><USER78> > But guessing 2 digits correctly isn't that easy, right?

The first few digits of card numbers refer to the provider (Visa, Amex, etc) [0]. Given that Paypal gave the last four digits of the card, I'm surprised they wouldn't give out the provider as well, so guessing this would be even easier.

[0] [https://github.com/stripe/jquery.payment/blob/master/src/jqu...](https://github.com/stripe/jquery.payment/blob/master/src/jquery.payment.coffee#L11)

<comment><USER79> It wasn't the first 2 digits that were guessed, it was the 2 digits prior to the final 4.

</comment></comment><comment><USER80> The advice to use @gmail.com vs. a custom domain name seems kind of questionable if you use a reasonably secure registrar. Not GoDaddy.

Using an unusual/unknown address for account validation mails (maybe with forwarding of other communications) probably would make sense, though. And/or sites coming up with a better account-recovery procedure, perhaps outsourced to a startup.

There's probably a market for a super-secure email address for account login mails, but that isn't a free gmail account.

</comment><comment><USER81> Namecheap posted a tweet[1] with an offer to move domains out of GoDaddy:

 _How we make sure that you don 't lose your $50,000 Twitter username: [http://ow.ly/t4yR8](http://ow.ly/t4yR8) $5.99 domain transfers with code BYEBYEGD_

[1] [https://twitter.com/Namecheap/status/428555697882935296](https://twitter.com/Namecheap/status/428555697882935296)

</comment><comment><USER82> What I take away from this is that:

a) Two Factor should be mandatory and as soon as it is, any representative of the company MUST insist that a reset cannot be done over the phone. It should be highly suspicious if someone comes up and says "Hi, I lost my email account access AND my phone so could you please reset my password via phone now?"

b) If not Two Factor, the security questions should also be mandatory. No other "data" like past addresses or cc numbers should suffice to reset over the phone if the person doesn't know the answers to all security questions.

And, speaking of these questions, of course they should be stuff that _you_ know and cannot be "guessed" by anyone who is able to read your facebook page or similar. Maybe even some non nonsensical thing like "Favorite Food" \- "Horse Droppings". As long as you remember this, nobody should be able to "hack" that over the phone. Even if you go on and on on facebook about how you "could eat your way through a giant bowl of pasta you love it so much"

<comment><USER83> >As long as you remember this

I would NEVER remember this. EVER.

</comment></comment><comment><USER84> Why does anyone believe the hacker's story of how he did it? It's possible he told the truth but it's likely he did not.

</comment><comment><USER85> I'm not a programming expert, nor a process expert, but the way I see it...

... there has got to be a multi-stage process for authentication that does NOT use any CC or SSN. Of course, the responsibility lies with the account owner for maintaining passwords/authentication information.

If you lose the information, no way to recover it.

I say this because it seems (again, I'm not an expert) that these thieves use social engineering mostly in the "data recovery" stage of the process.

The only way to tighten that from my perspective is to put maximum responsibility on the account owner to keep their logins, passwords (again, for multi-stage authentication), and such on hand. Don't have a need to recover your info, and others can't use the recovery process to get to your account.

I guess it wouldn't be a perfect scenario but... this, or lose @N.

I am sorry to hear there are companies allowing these practices, though... sad.

</comment><comment><USER86> Is it not possible to use the last bills as verification of who you are? screenshot of the bank statements and asking GoDaddy to verify their bank data and you've shown that it is in fact you who paid the bills.

Also if account data is changed they MUST keep a log of what your data was before. At least anything beside passwords.

</comment><comment><USER87> I could be wrong but what is the value of a stolen Twitter handle? Just like a stolen car or phone if someone starts using it won't it be obvious that it's the thief or the thieves buyer? That's like stealing a Porsche and then showing it off downtown in front of everyone.

<comment><USER88> Comparatively few people will read this story. Even fewer will care enough to continue the crusade against the attacker for any prolonged period of time to raise awareness among the potential future audience that this account was stolen.

High chance the story will be quickly forgotten and the account will be re- used.

<comment><USER89> Or resold, even more sensibly...

</comment></comment></comment><comment><USER90> That reminds me, a few months ago I had a weird Twitter experience. Someone gained access to my rarely used Twitter account @smartician and started posting spam. Somehow Twitter noticed, reset the password and notified me via email. I have no idea how that was possible.

<comment><USER91> > Somehow Twitter noticed, reset the password and notified me via email. I > have no idea how that was possible.

This sounds like pretty normal automated monitoring for what looks like compromised account behaviour.

</comment></comment><comment><USER92> Up until late 2013, it was very easy to social engineer your way past Customer Sales Rep call screens to gain access to an AT&T account once you put together a few pieces of personal data (which was even easier to obtain) of the account owner. You didn't need to know the account password to gain access if you had other pieces of information. Those bits of information leak out through other service providers and are sometimes available through State and Federal Government systems.

That meant that anyone using SMS via AT&T for two-factor auth was vulnerable.

The extra layer of security is only enabled if you call AT&T and ask them to further protect your account from future changes.

</comment><comment><USER93> I have seen great articles that document the best practices, patterns and anti-patterns for authentication within an application or storing passwords etc. But where is the gold standard for authenticating people over the phone?

Good Developers understand how critical it is to handle authentication and password storage well. It can be complicated thing and is very easy to screw up.

But all that goes out the window when somebody calls the support line. There needs to be just as much scrutiny placed on over the phone authentication as there is within an application. The problem is likely that those over the phone patterns/anti-patterns are not well documented and available.

</comment><comment><USER94> I read the article. Sounds like an epic fail by GoDaddy, I blame them for 99% of what happened. Glad I'm not a customers of theirs... Oh btw, try to find a registrar that does 2factor authentication!

<comment><USER95> Try Gandi:

[http://wiki.gandi.net/en/contacts/login/2-factor- activation](http://wiki.gandi.net/en/contacts/login/2-factor-activation)

(note to self: activate 2FA)

</comment></comment><comment><USER96> So who are you planning on suing? PayPal, godaddy, twitter, or all three?

<comment><USER68> The Terms of Service agreements for those companies probably all allow them to get away with it.

<comment><USER97> Terms of service normally don't override law. So, if there is something unlawful about their behavior, it doesn't matter what they wrote in their TOS. At least in many countries, not sure about US.

</comment></comment></comment><comment><USER98> Interesting that GoDaddy does not keep an audit trail for account detail changes that might help detect malicious activity. I guess they'll rather lose customers and reputation than do this.

<comment><USER99> They don't have much to lose reputation-wise...

<comment><USER83> I am surprised anyone can take them seriously as a company after their Superbowl commercials.

</comment></comment></comment><comment><USER100> Regardless of how this all went down, and is responsible... It is still theft right? Falsifying ones identity and taking possession of @n is stealing and should be covered under some law, no?

</comment><comment><USER101> I feel so bad for Naoki that he was compromised in this scary manner. While the hacker did con his way on the phone for personal information, at the minimum, it's...hmmm....not nice...but "informative/narcissistic," of the hacker to describe his method to the victim.

Makes me happy that companies are moving towards text authentication since emails are easy (or at least well practiced) to compromise.

Note: Time to change my Time To Lives on my MX records and up my security.

</comment><comment><USER102> Crumbs, this makes interesting reading - clearly lots of failings by the companies involved here.

However. If someone were to steal a physical asset in order to extort something else out of me I would go immediately to the police. I'd have thought I'd do the same if the assets involved were digital.

I've no idea if a criminal offence was committed in what ever jurisdiction this happened. But I'd have thought extortion is illegal is many parts of the world?

</comment><comment><USER103> The "we take X seriously at Y company" line is so tired. These companies are so incompetent that it would be funny if not for people getting screwed IRL.

</comment><comment><USER104> What was up with the part with the facebook message? Why would the attacker tip him off rather than just take what he came for? Or did I read that wrong?

<comment><USER105> Never underestimate the enticing nature of boasting. I can think of more than a few would be anonymous attackers who were caught _precisely_ because they wanted to brag about their achievements.

I'm not really sure I understand the psychology behind it and whether it's a juvenile attempt to demonstrate relative power (e.g. "I did this to you, ergo I'm more powerful/smarter/whatever") or something else entirely.

</comment></comment><comment><USER106> You can sell twitter @'s now? #itsNotWorth50k

Follow us at @N on twitter.

Looks like a typo. Imparts zero cred since 99.999% of people will not take your ability to "possess" a short twitter account name as helpful for whatever else you may be trying to do.

As far as the "Sorry I am so technically gifted. Let me tell you what you should do to prevent me next time..." thing, what kind of cartoon caper is this?

</comment><comment><USER107> Can't you sue paypal or godaddy ? Or better yet, both. Shouldn't be hard to track down the attacker either if you report the crime.

</comment><comment><USER108> pretty freaky stuff. Also, what was the attacker so interested in the @N for anyways? future investment in case some big company/celeb comes along wanting the username? Seems so crazy to go after it...... if Twitter can't sort this out, can't we all just shame the acct into inactivity... Is squatting on it worth all this Mitnick-attack-work?

<comment><USER109> Well, if this story is true ( I put the if because it seems silly to have that account be the target ) then access to the account is proof of a crime (this is why it seems silly)

If they sell it to someone I guess that is a reason to take it, but it also seems like some enterprising DA would want to use it as an example of receiving stolen property ( because News! Hacking! Fame!) So if anyone buys this name they might be in trouble at some unspecified point in the future.

<comment><USER110> And in this case I would be pulling for the DA to tear this hacker a new one.

</comment></comment></comment><comment><USER111> No domain registrar should be taking the last four of your credit card number as proof of account identity or ownership. We certainly don't. Have you confirmed they reset the password based on just the last four of the credit card OR was your account's email address itself comprised, allowing them to reset the password via your email address?

</comment><comment><USER112> Serious lapses on the parts of PayPal and GoDaddy. Ironically, there are sites which even refuse to identify the real person - like this one posted on HN a few days back([http://kevinchen.co/blog/square-identity- verification/](http://kevinchen.co/blog/square-identity-verification/))

</comment><comment><USER113> Was @n private before? It is now. If this kid is trying to sell the handle to someone, the buyer is likely in for a rude awakening if and when Twitter does the right thing and returns it.

</comment><comment><USER114> Woah ! What a story. You can trust nobody. Well hope that twitter people are reading this and can understand how badly they are trolled. All the best buddy. All the best.

</comment><comment><USER115> I'm still wondering WHY the hacker took a twitter handle and why he didn't blackmail his victim into keeping quiet.

$50k is hardly worth such a bold crime with no exit strategy.

<comment><USER66> Who's going to pay $50K for a stolen twitter handle? The value has surely dropped quite a bit.

</comment></comment><comment><USER116> In case OP reads HN: If your websites are hosted with GoDaddy, I would consider them compromised aswel.

He may say that he has left them alone, but you have no chance of knowing.

</comment><comment><USER117> This was the last straw. I'm moving away from GoDaddy.

</comment><comment><USER118> Yet another example of a compromised GoDaddy account and someone potentially losing their domain. Yet people continue to use GoDaddy time and time again.

<comment><USER119> It was worth ditching GoDaddy just so I wouldn't have to use that horrible interface ever again.

</comment></comment><comment><USER120> besides the obvious stupidity of the parties involved, why would anyone pay for such an uninformative handle 50k ? @N ? seriously -- doesn't spam occur for twitter feeds yet ? I remember when google started off they didn't allow you to have email addresses less than 6 characters to avoid spam...

btw, @! google search returns 0 results. interesting... hmm, twitter apparently allows alphanumeric handles only...

</comment><comment><USER121> Thats awful.. I use both GoDaddy and Paypal for my website and this has certainly made me a more cautious of securing sensitive information

</comment><comment><USER122> What if this whole story was a lie? What if it was the hacker's final attempt to steal the @n twitter name.

<comment><USER123> you need to stop watching movies!

</comment></comment><comment><USER124> [http://xkcd.com/1279/](http://xkcd.com/1279/)

</comment><comment><USER125> Don't use godady is what I would take away from the story.

</comment><comment><USER126> story archived here in case it did/does go down:

[http://pastebin.com/g7R6Ren2](http://pastebin.com/g7R6Ren2)

</comment><comment><USER127> Why on earth are people still using GoDaddy?

</comment><comment><USER128> I hope Twitter can help this guy somehow.

</comment><comment><USER129> This is quite frustrating even to read!

</comment><comment><USER130> It was like I read some scary book.

</comment><comment><USER131> $50,000 twitter username. Sigh...

</comment><comment><USER132> this story reeks of fake to me.

what sane person doesn't call the FBI when an attacker blatantly commits fraud against them, admits to it, and then commits extortion based on the successful fraud? Furthermore, what kind of attacker explains how they attacked? Thats ludicrous.

this has got to be some kind of roundabout way of advertising for the various competitors of godaddy mentioned in the post.

</comment><comment><USER133> Another reason to use Bitcoin. No credit card number to give away to the attacker and identity can be verified by signing a message with a private key instead of guessing at personal information.

<comment><USER134> Did you even bother to read the damn article or are you throwing blind shit on the wall here.

<comment><USER133> Yes, did you? The Attacker got Paypal to give up the last 4 digits of the victim's credit card number. Then he called GoDaddy which allowed him to verify his identity by giving them the last 4 of his credit card number though the attacker said they would have let him guess multiple times.

If GoDaddy accepted Bitcoin PayPal wouldn't even be involved and GoDaddy instead of asking for information which is apparently easily pilfered could have requested the caller sign a message with their private key Bitcoin key corresponding to the public key from which they paid GoDaddy for the domain services to begin with.

<comment><USER135> > If GoDaddy accepted Bitcoin PayPal wouldn't even be involved and GoDaddy > instead of asking for information which is apparently easily pilfered could > have requested the caller sign a message with their private key

If GoDaddy separated authentication of requests from payment information and had any of a wide number of different authentication methods, this wouldn't have been an issue, either. Using PayPal -- or accepting credit card payments by other means -- does not imply (or normally involve) using the last four digits of CC number as if it were a PIN for authentication. (In fact, since CC numbers are widely exposed information, doing so is insane -- especially the last four digits, which are frequently used without the rest as a reference to identify a credit card to the owner of the card in contexts like receipts where the information is expected to be particularly public.)

Payment methods are really largely irrelevant here, GoDaddy could easily have adopted an equally stupid and brain dead authentication method if they took bitcoin as payment.</comment></comment></comment></comment>


Gmail: A Symbol Of Everything That Is Wrong With Google - <AUTHOR> http://www.businessinsider.com/henry-blodget-gmail-a-symbol-of-everything-that-is-wrong-with-google-and-the-reason-microsoft-is-still-winning-in-the-enterprise-2010-2 <comment><USER2> Quote: Consumers don't like to customize.

Quote: Because it would be so simple for Google to create a "Normal email view" for people like me.

So, Google should make it customizable.. ?

</comment><comment><USER3> I love conversations in Gmail, but I think the article makes a good point. Users coming from other email clients don't want to think about the difference between conversations and normal emails. There should be simple option to let them use the old style.

</comment><comment><USER4> Suppose Gmail was actually made by Apple, and that it was Apple that had concluded that the "Conversations" interface worked best for e-mail. Do you think Apple would have added a "Normal e-mail view" for people who didn't like it? I don't.

<comment><USER5> apple's mail.app has a threaded view which is basically what gmail's conversations are, and it can certainly be turned off.

<comment><USER6> No, it is not the same as gmail's conversations. The biggest difference is that gmail shows your replies in the same view.

<comment><USER5> ok, but the point is that apple still lets you decide which view you want.</comment></comment></comment></comment>


Ask HN: Is this really what America is like? - <AUTHOR>

Question:
I'm black and I live in Canada and I am hard at work at pivoting my business to position it for success. One option I've always considered for various reasons is to move the business to the US. At the same time, I've become increasingly concerned about the level of bigotry, division, and outright hate being spewed publicly by what seems like an increasing portion of the population. At first, I attributed this to TV sensationalism but the more I scour the internet, the more I come upon hateful videos, articles and comments from non-anonymous users.
This all culminated today when I read an article a friend shared about an NJ robber who was choked to death after he tried to rob and subsequently headlock one of his victims. My question is not about the appropriateness or legality of the action on either side. My question stems from the downright insensitive, hateful, divisive, racist views expressed in the comments section of the post on a seemingly neutral website like NY's Channel 4 NBC News: http://www.nbcnewyork.com/news/local/Smackdown-NJ-Robber-Killed-by-Former-HS-Wrestler-138711694.html
Is this really what America has become? Has the United States become a place where a shockingly large number of individuals feel comfortable with placing their name and image beside the same type of hateful rhetoric that would have been spewed back in the days of segregation?
Why am I asking this on HN?:
I am posing this question on HN because I generally feel that people on HN are rather open and deliberate with their responses. Scoble (after what he felt were numerous personal attacks) chastised this community about this a few days ago but there is definitely a benefit in this - most of the time. As such, I feel the HN community is more than capable of providing me with a response to this regardless of whether or not it's a tech question. <comment><USER2> I think it is a logical result of more and more people coming online and more people having access to more efficient ways (smartphones & always on 3g+...) of posting these comments/blogposts you are confronted with.

Did you ever go outside and talk to random people on the street, asking them for their views on several topics? Personal worlds are shielded by our social circles and our neighborhoods (which, if you read HN, is probably not the slums) and yet, if you really talk to random people, you'll find that a lot of these people say scary things. Interesting things as well, but also scary things. I stepped out of a hotel a few months ago, bumped into a man on the street; we started talking. He was French, a private jet pilot, sounded quite well educated. He was going to the drugstore to get cough medicine and I had to go in the same direction. When we were about halfway, an Middle eastern man passed us; when he was out of ears reach, the French guy said, while nodding to the man, 'we should bomb all those f _ckers, they don't deserve to live'. People who say this kind of crap to total strangers have no qualms posting it online either; these people were not online before in the numbers they are now.

How would they know that if you are logged in with Facebook or Gmail that your name/profile link automatically appears next to the post? People know very little about computers (including smartphones) and integration + apps make it very easy to blend in such a way that it would be _hard* for people to actually not make their name appear.

<comment><AUTHOR> In regards to the "random people" scenario, I have found that people who harbour such feelings will almost never make them public in a public forum even if they feel comfortable telling close friends or acquaintances. I have found that this has somewhat changed over the past few years where more and more people are somewhat saying "meh" and openly voicing any _anything_ -phobic thoughts.

I certainly think you're right about the fact that this can partly be attributed to the fact that more and more people have more efficient ways of posting these sorts of comments/articles but there also seems like there's something more to it. There seems to be some fundamental social change in the US that has emboldened people to feel comfortable to spew rhetoric publicly. It's almost like a legalized form of hate under the guise of free speech laws in ways that have never happened before.

<comment><USER3> I think there is also a bit of backlash to government programs that tried to mandate equality and fairness, but many served to just be bureaucratic money sinks. Unfortunately in some peoples minds, the inefficiencies of these systems, and the outright deception by some politicians in support of these programs to further their own aims, get blamed on the recipients of these systems. It is not fair, but I think it is a natural product of people that don't analyze the situation fully.

Lets take immigration for example, there are politicians in the system that are in total support for the current situation, because it creates a market for less than minimum wage workers for companies, some of which contribute to and lobby political offices. As such, it creates a financial system that encourages bureaucracy that is intended to look like something is being done about it, when in fact the intent is to maintain the current status as long as possible. Unfortunately in this situation, people just looking to make a life for themselves and doing what anyone else would do in their situation, are left to bare the brunt of the outrage, a situation said politicians are more than please with. There is a lot of scapegoating going on in the US right now, which I fear could be leading to a dangerous situation.

</comment></comment></comment><comment><USER4> Don't take internet comments too seriously. People say stupid shit all the time, anonymous or not.

<comment><USER3> I will play the part of the alarmist and also be the first to invoke Goodwin's law by stating that unchecked rhetoric was the first psych-ops that the Nazi's used. Group acceptance of dehumanizing a different group is the first step down a horrible path. It should be checked at every advance. The seed in America seems to have happened with Muslims, as it was acceptable in good company to view them all as fundamentalist psychopaths, the government and media where all to willing to reinforce such group think as it strengthen their case for war, now that the seed has set it has grown to bear fruit. Vilifying or dehumanizing a group of people always leads down a path of darkness. I would not hastily blow it off as being stupid and crap said on the internet, it is a dangerous mindset, that is easily infection to those susceptible to group think and the sewers of it tend to be far too willing to act when they feel emboldened by numbers and the echo chamber.

<comment><USER4> Good point, maybe I've been jaded by spending so much time on the internet. Or maybe I have a separation in the magnitude between what people write online and what people actually do in public.

<comment><USER3> The real danger is that they would still think it, even if they did not have an online venue, and when they feel safe they offer sympathetic support to those that will act on their hatred. The more echo's heard in the echo chamber the more empowered those that will act feel, at some point they will feel that their actions will be accepted or at least not countered, and at some point they will be right. I am not arguing against free speech by any means. The hate is still there even if they cant say it, so limiting speech only serves to treat the symptoms and not the infection. As well limiting speech also has the nasty side affect of limiting the ideas of those that are not in power, even if they have the moral high-ground. Unfortunately the only solution to fixing this infectious thinking is good old fashion education which seems to be a harder and harder thing to do. Willful ignorance is a merit badge now days and we celebrate it as being the epicenter of our culture by idolizing individuals that so predominately display the characteristic.

</comment></comment></comment></comment><comment><USER5> America is a big place. There are 300,000,000 people in here. Some places are worse than others (NJ, for example).

</comment><comment><USER6> The racist/anti-Obama/anti-Democrat remarks are getting many more "likes" than those with opposing viewpoints. That does seem kind of odd for a site like NBC; I would expect the numbers to be more balanced, at the very least. I wonder if an influential right-wing site linked to the article, and this is what's driving all the traffic.

<comment><AUTHOR> Good point. I was curious about that too. Didn't consider the fact that there could be various in-bound links from various sites.

</comment></comment><comment><USER7> The comments in that thread aren't much different than what's said on talk radio or even certain mainstream TV news and opinion programs. It's probably not worth worrying about for your business aspirations but certainly is an unpleasant facet of living in the USA.

</comment><comment><AUTHOR> As an update, I thought I'd share this with everyone here:

[http://news.cnet.com/8301-17852_3-57372861-71/bbc- confronts-...](http://news.cnet.com/8301-17852_3-57372861-71/bbc-confronts- facebook-troll/)</comment>


Algorithm decodes rat squeaks and could revolutionize animal research [video] - <AUTHOR> https://www.youtube.com/watch?v=25LYVxTUZhM <comment><USER2> Accompanying article: [https://www.theverge.com/science/2019/2/19/18225564/animal-r...](https://www.theverge.com/science/2019/2/19/18225564/animal- research-rat-ai-science-software-automation-deepsqueak)

ScienceDaily article with link to original paper: [https://www.sciencedaily.com/releases/2019/01/190107142221.h...](https://www.sciencedaily.com/releases/2019/01/190107142221.htm)

And github repo: [https://github.com/DrCoffey/DeepSqueak/](https://github.com/DrCoffey/DeepSqueak/)</comment>


Can I read Amazon e-books in Apple's iBooks? - <AUTHOR>

If I buy an e-book from Amazon, is there a way for me to load it to Apple's iBooks?<p>Thanks in advance! <comment><USER2> There's not an official, supported way (though I wouldn't be surprised if someone has cooked up a hack for this). To be clear, you are aware of the Kindle app for the iPad, right?

<comment><AUTHOR> Yeah, I'm aware of the Kindle app. I just have all of my other books in iBooks and I'd like to avoid having two apps for the exact same purpose.</comment></comment>


Technology isn't intrinsically good or evil. It's how it's used. - <AUTHOR>

Technology isn't intrinsically good or evil. It's how it's used. Just like in society, we have pockets of evil, who abuse platforms & media. What are examples of the abuses? ie Spam bots, etc<p>Btw - the first line is from Futurama :) <comment> workhere-io > Technology isn't intrinsically good or evil

Many forms of weapons/bombs are evil. Some would argue that you can use the weapons to fight for good purposes, but history shows that, sooner or later, all arms technology falls into the hands of your enemies (that's what happened with machine guns, nuclear bombs, etc.).

If you invent a new technology and you estimate that only 10% of its users will use it for good, and the rest for bad, you should consider whether you're really doing the world a favor with your invention.

<comment><USER2> If it means those 10% will be able to use it to defend themselves from the other 90% - as opposed to being defenseless - that sounds like a small win.

<comment> workhere-io Sure. Then you wait a few years, and suddenly the 90% have access to your technology, and you're worse off than before.

</comment></comment></comment><comment><AUTHOR> Clarification - Digital Abuses please.

</comment><comment><USER3> Riot batons that have integrated stun guns. They were sold en-bloc to military units that have no crowd control roles in countries that have no human rights. By British companies.

Its evil that people tortured dissidents using stun guns with nice user- friendly grips.

Its more evil that people in a free country sold them, knowing what they were used for.

Other examples of technology used for evil:

* rope to hang pregnant women high from trees.

* Knives used to cut open their bellies and dangle the foetus in a double hanging.

Fuck Spam bots.

Edit:I am not in a good mood today for silly questions. Sorry.</comment>


CoreOS Introduces Clair: Open Source Vulnerability Analysis for Your Containers - <AUTHOR> https://coreos.com/blog/vulnerability-analysis-for-containers/ <comment><USER2> Does this use the OVAL data published by various companies? (eg. Red Hat's here: [https://www.redhat.com/security/data/oval/](https://www.redhat.com/security/data/oval/) )

<comment><USER3> Yes it does:

> For now, Clair uses three databases, one for each supported operating > system: Ubuntu CVE Tracker, Debian Security Bug Tracker, Red Hat Security > Data

[https://github.com/coreos/clair/blob/master/README.md#detect...](https://github.com/coreos/clair/blob/master/README.md#detectors --fetchers)

</comment></comment><comment><USER4> Hey CoreOS, quick question for my own curiosity. You have released/are releasing tons of cool stuff, I'm just wondering what you plans are to maintain them? How much to you expect the community to update them? Is your team growing as fast as you release software?

Thanks for all your great work!

<comment><USER5> Great question. Our projects are lead by a set of maintainers that may change overtime. We love to have folks from the wider community help there too and have had good success with that. Two examples of long term involvement: Ben Darnell from CockroachDB helping maintain the raft library or Simone Gotti helping build out rkt. So, community is one way to sustain and we welcome new folks to join.

We also continue to grow the team at a good pace for the stuff we are building too. We have a diverse set of challenging technology we are building to make everyone successful with distributed systems and containers. If you want to learn more see [https://coreos.com/careers](https://coreos.com/careers)

</comment></comment><comment><USER6> It's exciting to me that virtualization and containers raise some new security issues (cotenancy, memory dump, etc.), but also allow new security capabilities (reading memory from outside the protected system, separation kernels, etc.). It would be foolish to ignore them from a security perspective, on top of all the other management/usability improvements they bring.

</comment><comment><USER7> Cool project! Detecting installed packages and checking against known vulnerabilities is definitely useful. A similar feature is on the todo list for DockerSlim[1], so it'll be nice to reuse relevant bits and pieces.

[1]DockerSlim was a recent Docker Hack Day project. The goal is to make Docker containers lean and mean :) It analyzes existing images and then creates much smaller images throwing away stuff you don't need.

<comment><USER8> That's really cool. It sounds similar to Squashed Image support on Quay.io[0]. Is it open source?

[0]: [https://blog.quay.io/New-quay-features/](https://blog.quay.io/New-quay- features/)

<comment><USER7> Yes, it is open sourced. I think it's different though. It looks like the "squashed image" feature flattens an image. DockerSlim tries to extract only the artifacts the application needs, so it can turn a 431 MB image into a 14 MB image (just an example, not always possible with every application type). DockerSlim relies on runtime analysis to shrink images that much.

<comment><USER9> Neat.

Reminds me a little of this: [https://github.com/mafintosh/torrent- docker](https://github.com/mafintosh/torrent-docker)

</comment></comment></comment></comment><comment><USER10> Is this a pivot?

On a related note, what do you guys think the future holds for CoreOS now that Kelsey Hightower has quit and moved to $GOOG?

<comment><USER11> I'm not sure why you think this is a pivot.

CoreOS, the company's name, is a bit of misnomer now. Their original product, CoreOS, is their namesake and a good foundation for the rest of their platform.

As a company, they've been putting out a number of products, such as etcd, fleet, flannel, and more. It seems that Clair is another product under their umbrella.

So it's not a pivot, it's just another product as a part of their larger offering.

CoreOS's products are all open-source and openly developed, which is awesome. They make their money from their managed service offerings, such as Quay.io container registry (which Clair seems to bolster), CoreOS managed linux, and Tectonic (Kubernetes as a service).

So each product announcement you see is another facet of CoreOS's larger offering.

<comment><USER12> Quay.io has been outstanding for us so far. Much better overall than Docker Hub for our organization. Particularly in ergonomics and team/permissions granularity.

<comment><USER11> 100% agree. I just tried Docker Hub for a separate open-source project, and I'll probably just move it back to Quay.io instead.

<comment><USER13> Please don't use Quay for official open source images if you care about international users, or at least offer a Docker Hub option as well. Quay is super slow compared to Docker Hub. When I contacted support back in July, they were very polite and professional, but in the end "everything is being served from AWS's US East region". Peak time performance is intolerable. It was so bad that our systemd units were timing out even with a massive 5min TimeoutStartSec.

To worsen the issue, Quay still doesn't seem to support parallel layer downloads, and Docker 1.9 even complains that "this image was pulled from a legacy registry. Important: This registry version will not be supported in future versions of docker."

I just ran a quick test (way off peak time) and Quay was 2.5x slower than Docker Hub for an image built from the same Dockerfile.

I'm looking forward to more usable international service at some point, but right now it just isn't really worth it.

</comment></comment></comment></comment></comment><comment><USER14> This is pretty interesting. It would be great if there was a step-by-step guide to check my own Docker containers. Instead of looking like a piece to promote Quay.

<comment><USER15> You could use contrib/analyze-local-images - see discussion at [https://github.com/coreos/clair/issues/5](https://github.com/coreos/clair/issues/5)

</comment></comment><comment><USER16> Unfortunately using dpkg and yum to detect installed software means this isn't a secure audit. Anyone can add known bad binaries after the fact and pretend to provide a "secure" base image. I'd be skeptical of trusting anything quay.io says is secure based on this scan.

<comment><USER17> It's intended to identify known security vulnerabilities, not identify malicious actors. Someone could add known bad binaries after the fact, but they could also add unknown bad binaries.</comment></comment>


Linux Fu: The Linux Shuffle - <AUTHOR> https://hackaday.com/2020/02/03/linux-fu-the-linux-shuffle/ <comment><USER2> Generating random permutations uniformly is a nontrivial problem that I have solved in (probably) close but incorrect ways using RNGs directly. Knowing about `shuf` would have helped a lot!</comment>


Anti-AI AI: A device that notifies the wearer when a synthetic voice is detected - <AUTHOR> https://rnd.dt.com.au/anti-ai-ai-a-wearable-ai-device-244900e4d71c <comment><USER2> Science that looks suspiciously like an art performance that looks suspiciously like being commissioned to prime us for the theatrical release of Blade Runner 2049.

Science fiction did not prepare us for this future we are living in.

<comment><USER3> Actually, "Back to the Future" did a really good job. However, not sure how many of us took it seriously.

Since then, many of the things predicted have come, more or less, true. I wonder, which SF movie we should pay attention to.

Ex Machina or Blade Runner, or even Agents of SHIELD, show us what a rogue AI might do, means people do take this "menace" seriously or is just a ... film feature/ good plot?

It seems that someone is building a business based on this "fear" of AI. I find this interesting.

<comment><USER4> I'm more of a "Person of Interest" Samaritan kinda guy.

<comment><USER5> I would second this. The way the AI was pervasive and controlling, without ever being obvious / well-known.

Definitely an underrated show, and one I suspect that more or less nailed its predictions of how AI will eventually be used/abused to control and manipulate populations.

<comment><USER6> It also nailed Snowden leaks before they actually happened!

I also recommend watching Person of Interest. It's a really in-depth discussion of issues a superhuman AI could create within the level of technology we enjoy today, as well as ethical problems relating safe AI and people's right to determine their own fate.

</comment></comment></comment></comment></comment><comment><USER7> The problem with this is that it's exactly the setting for GANs, which means that if you get your hands on one it's trivial to train your models to defeat it.

<comment> david-gpu I wouldn't say trivial. First, in order to use GAN training you need access not only to the adversarial discriminator, but also to it's derivatives. Second, the derivatives need to be reasonably bounded and reasonably smooth, otherwise your voice generator won't be able to converge to a successful solution.

<comment><USER8> You don't really need access to the other model. By just using your own NN as a discriminator, it will train to be very good at fooling it. And so it should be just as good at fooling other NNs.

</comment></comment></comment><comment><USER9> Imagine an AI that asks you questions in order to identify you over the phone. What's to keep that same AI from pretending to be you with those same responses?

We really need to beef up authentication. We all should be using multi-step authentication, with the number of steps increasing with the importance of the identification.

Maybe 2-step is okay to get to your email TODAY. But maybe 4-step will be needed in 2027.

And to sell your house, maybe you need 5-step authentication, with some of those steps involving humans.

</comment><comment><USER10> Business model: company A markets the best possible discriminators, and colluding company B markets the best possible generators.

It's a GAN powered by capitalism!

<comment><USER11> You don't really need collusion for this to work :)

</comment></comment><comment><USER12> I work for a company that provides automated voice calls that use real voices. You'd be surprised how often people think it's a real person even though the voice is not responding to them or speaking conversationally.

I think that's the fundamental problem here. It doesn't matter if it's a real voice or not. It's about the content of what's being said.

</comment><comment><USER13> I doubt this is more accurate than humans are, or is that possible?

Wouldn't an AI that can be a judge in a Turing test be able to pass the Turing test?

Or is this just testing how "real" the voice sounds?

<comment><USER14> > Wouldn't an AI that can be a judge in a Turing test be able to pass the > Turing test?

I changed my mind. I don't want the Red Pill anymore. Ignorance is bliss.

<comment><USER15> This is how I feel too. This is getting out of control.

<comment><USER16> The best part is that we haven't yet seen a half of a percent of what AI's are capable of. Strap on your seat-belts because Kansas is going bye-bye.

</comment></comment></comment></comment><comment><USER17> If it works it would make an excellent tool for training models that generate synthetic voices.

</comment><comment><USER18> The key part of this is the software to detect synthetic voices. Seems a bit overeager to jump straight to a dedicated wearable device when it could just be implemented as an app.

</comment><comment><USER19> I like the concept and it sounds pretty neat! The method of notifying a person using temperature is something that I haven't seen in a wearable design. I hope that they opensource or release the Anti-AI app standalone (without the Bluetooth device I supposed you could have just a regular notification). I might build the notification system that they use since they have a PCB to experiment with it with wearable computers.

</comment><comment><USER20> So, would Stephen Hawking be considered a false positive?

<comment><USER21> His voice is synthetic, so no. This is not a Turing Test.

</comment></comment><comment><USER22> I think we can do this just fine by ourselves actually. Everything neural nets has produced so far is distinctively non human. From the generated images and speech to how they play Go oddly or navigate a 3d world poorly.

<comment><USER23> > to how they play Go oddly

I think you misspelled "better" there.

<comment><USER22> No if you watch the Go matches, AlphaGo did a lot of things that the professional commentator found odd, but they ended up working out. I expect if you saw similar odd tactics in the future you could guess you were playing an AI.

<comment><USER23> What does it mean that the commentator found odd? AlphaGo won, and the fact that the commentator didn't understand what it was doing doesn't mean there wasn't a purpose behind them.

You don't seem to be realizing that AlphaGo plays "oddly" like a chess grandmaster plays "oddly" against a new player. The "oddness" is that it's so good that we can barely understand its game.

<comment><USER24> You're creating a false dichotomy. AlphaGo plays both oddly (definition: "in a way that is different from what is usual or expected") and better.

The real point that I think hacker_9 missed is that AlphaGo was not trying to play like a human, it was trying to play better. If it tried to play like a human, it's quite likely that it would be indistinguishable.

<comment><USER25> In the latest matches, though, you'll find that some of the odd things that AlphaGo did ends up being adopted by the Go community. So are we now playing oddly, or did AlphaGo simply teach us?

</comment></comment></comment></comment></comment></comment><comment><USER26> I expect it would be much harder to judge whether text (instead of audio/speech) has been written by a machine

<comment><USER27> I think the opposite, WaveNet already sounds basically human to me but after more than a few sentences no computer generated text looks real.

</comment></comment><comment><USER9> If AI has patterns identifiable to AI, it can also avoid those same patterns.

</comment><comment><USER28> How does this do against a Vocaloid?

</comment><comment><USER14> Correct me if I'm wrong, but have humans just automated the Turing Test?

<comment><USER29> If you have computers on both sides of the turing test, how do you know which one you're testing?

<comment><USER30> One side will say whether the other side is human or not. The other side is being tested with a Turing test.</comment></comment></comment>


Pin Payments Signups are Open - <AUTHOR> https://pin.net.au/?

<comment><USER2> Stripe for au? :)

<comment><USER3> Similar beginning, different goals :)</comment></comment>


AnyYolk: An open source JS, CSS 3 and Parse game - <AUTHOR> http://blog.parse.com/2013/04/25/anyyolk-a-parse-powered-html5-game/

<comment><USER2> That was too easy...

        setInterval(function() {
          $(".egg_sprite_1, .egg_sprite_2, .egg_sprite_3, .egg_sprite_4, .egg_sprite_5").mousedown();
        }, 1)

<http://i.imgur.com/yd95uOV.png>

<comment><USER3> Serious question based on this: Are DOM-based video games viable to make since it's just so easy to simulate DOM events like that?

<comment><USER4> If cheating in a multiplayer or scoreboard scenario is of no concern does it matter?

</comment></comment></comment><comment><USER5> The game difficulty should not depend on your browser window width</comment>


Deploying TLS 1.3: the great, the good and the bad [video] - <AUTHOR> https://media.ccc.de/v/33c3-8348-deploying_tls_1_3_the_great_the_good_and_the_bad <comment><USER2> Hi, co-speaker here.

Please feel free to ask any questions you have here, or by emailing tls13 at cloudflare.

The slide deck is at [https://speakerdeck.com/filosottile/tls-1-dot-3-at-33c3](https://speakerdeck.com/filosottile/tls-1-dot-3-at-33c3) (but it's not really made for standalone consumption).

<comment><USER3> Do you know of 0-RTT implementation efforts on reverse proxies, say, nginx?

Let's say I run a static website and I'm 100% sure unauthenticated GET won't break anything, is there anything special I need to do or is it going to be "enable this flag"?

Another question: Can I set 0-RTT per vhost (sni) or do I need dedicated 0-RTT IPs?

<comment><USER2> There is no 0-RTT implementation in servers that I know of, except our internal one at Cloudflare, which currently waits for the Finished confirmation until we decide on a policy.

The following two questions are of course implementation-specific, but there is nothing in the protocol blocking a "just do 0-RTT" flag or vhost configs.

</comment></comment></comment><comment><USER4> I'm a bit late, but it was a great talk and TLS 1.3 is looking nice.

I'm not sure who was the first to propose 0-RTT like this, but it appears that both MinimaLT and QUIC did at about the same time.

TLS 1.3 does nothing to improve TCP deficiencies, but there are alternatives that does, including QUIC. What I can't quite tell is how the the two combine, if at all. Does a QUIC connection mean that TLS 1.3 doesn't apply/is redundant?</comment>


Kodiak PHP - iPad app with offline PHP code execution - <AUTHOR> http://www.becomekodiak.com/

<comment><USER2> This is a really good idea! I myself would love to be able to design websites on the go, although I'm not too fond of PHP.

You may want to try porting over the picoc C interpreter to make an ANSI C code executor - that would be pretty nice as well.

</comment><comment><USER3> Interesting concept. Can you create an app in PHP off of the iPad and then run it on the iPad? That would be useful too.

</comment><comment><USER4> very cool product. and thanks for open-sourcing some of your code libraries -- they will be useful for me!</comment>


Google Glass hack allows brainwave control - <AUTHOR> http://www.bbc.co.uk/news/technology-28237582

<comment><USER2> To clarify; it doesn't enable one to hack _your_ brainwaves. Rather, _control things_ with your brainwaves.

Not very reliable unless you are willing to risk unloading serious voltage through your subject's head.</comment>


Show HN: Tracking the FISA Court in real time with a bit of code - <AUTHOR> https://twitter.com/fisacourt <comment><AUTHOR> Background: the FISA Court made a public docket only just last month. It's at [http://www.uscourts.gov/uscourts/courts/fisc/index.html](http://www.uscourts.gov/uscourts/courts/fisc/index.html), and is a tiny flat page with links to scanned PDFs. They clearly update it by hand, whenever something becomes public.

I wrote a Ruby script to watch the page every 5 minutes. When there's a change, it texts me, emails me, and tweets as @FISACourt with a link to a diff of the changes.

When I get notified, I read the new documents and follow up the automatic tweet with a hand-written one that explains the update, usually within just a few minutes of the posting.

Simple, but it breaks news faster than the blogs and papers do. The code is here: [https://github.com/konklone/fisa](https://github.com/konklone/fisa)

And I have some further explanation on my blog: [http://konklone.com/post/following-the-fisa-court-the- advanc...](http://konklone.com/post/following-the-fisa-court-the-advanced- internet-way)

<comment><USER2> If you aren't archiving every newly linked document, I'd like to suggest you do so. You never know when a site like that is going to publish something that they later retract, maybe even within minutes. Its good to have a copy for cases like that.

<comment><AUTHOR> Good call. I'll do that.

</comment></comment></comment><comment><USER3> Excellent work. I'm slowly adding entries on PlainSite...

[http://www.plainsite.org/courts/index.html?id=223](http://www.plainsite.org/courts/index.html?id=223)

[http://www.plainsite.org/flashlight/case.html?id=2487124](http://www.plainsite.org/flashlight/case.html?id=2487124)

<comment><AUTHOR> Awesome! You might consider removing the years before 1978 on the FISA Court page though:

[http://www.plainsite.org/courts/index.html?id=223](http://www.plainsite.org/courts/index.html?id=223)

</comment></comment><comment><USER4> I guess we need to look for the buzzword "push" rather than "realtime" now-a- days. At least, that's closer to how I use "realtime", rather than 5 minutes mechanical polling.

"Sure, realtime-nazi, but what would you suggest?"

Personally I feel up to 30 seconds is acceptable, but I rely more on the underlying method of delivery (push/long poll for change vs. polling and comparing for change). In close comparison to the definition here: [https://en.wikipedia.org/wiki/Real- time_web](https://en.wikipedia.org/wiki/Real-time_web)

> _receive information as soon as it is published by its authors, rather than > requiring that they or their software check a source periodically_

For a consensus, see [http://stackoverflow.com/tags/real- time/info](http://stackoverflow.com/tags/real-time/info) and/or [http://stackoverflow.com/a/5286985](http://stackoverflow.com/a/5286985)

 _Or am I wrong?_ What is a better label for what wikipedia defines as realtime-web?

<comment><AUTHOR> This is why I put the crucial space between "real" and "time". I cannot hold up to intensive buzzword scrutiny. :)

It's every 5 minutes because I don't want them to ban me. And in practice, this is an acceptable delay.

<comment><USER4> To clearify, I wasn't critiquing your approach, just the phrasing.

What you're doing is how it should be done for sources you don't have direct access to.

I'd use 10 minutes though, as [http://www.uscourts.gov/robots.txt](http://www.uscourts.gov/robots.txt) points to a crawl delay of 10. Whether it's checked is the risk you take.

<comment><AUTHOR> Right, now I remember - just double-checked, and Crawl-delay refers to seconds, not minutes.

[http://en.wikipedia.org/wiki/Robots_exclusion_standard#Crawl...](http://en.wikipedia.org/wiki/Robots_exclusion_standard#Crawl- delay_directive)

<comment><USER4> Oh, my bad. Sorry. Thanks for correcting me.

</comment></comment></comment></comment></comment><comment><USER5> Great idea! Watching the watchers is a valuable public service. Cheers!

</comment><comment><USER6> This is a smart idea. All the power to you.</comment>


Dangerzone: Working with Suspicious Documents Without Getting Hacked - <AUTHOR> https://tech.firstlook.media/dangerzone-working-with-suspicious-documents-without-getting-hacked <comment><USER2> Why not just use a dedicated Linux burner computer booted on a flash drive? Then all files are fair game.

<comment><USER3> Qubes on a solid state usb is my go-to, but this brings the functionality of trustedpdf from qubes to anything that can run a docker container. It appeals to a much wider audience, as disposable Linux boot drives have a significant barrier of entry to the not-so-technical folk.

My only concern here is vm escape and Libre office are two VERY big targets for nation state actors. (libreoffice had an exploit exposed in the vault7 leaks) It's a tradeoff for being able to safely open "totallynotphishingexe.pdf" on windows or osx.</comment></comment>