@jfmezeispamnot: "Apple has released a statement about the release of celebrity nudie
pictures from iCloud:
<url>
Update to Celebrity Photo Investigation
We wanted to provide an update to our investigation into the theft of
photos of certain celebrities. When we learned of the theft, we were
outraged and immediately mobilized Apple�s engineers to discover the
source. Our customers� privacy and security are of utmost importance to
us. After more than 40 hours of investigation, we have discovered that
certain celebrity accounts were compromised by a very targeted attack on
user names, passwords and security questions, a practice that has become
all too common on the Internet. None of the cases we have investigated
has resulted from any breach in any of Apple�s systems including iCloud�
or Find my iPhone. We are continuing to work with law enforcement to
help identify the criminals involved.
To protect against this type of attack, we advise all users to always
use a strong password and enable two-step verification. Both of these
are addressed on our website at <url>"
    @YourName: "<quote>
<snip>
Anyone stupid enough to take such photos or videos (either of
themselves or allowing someone else to take them) is simply asking for
problems.   :-\"
    @kurtullman: "<quote>
In the early 80s I was a photographer working for a new
�Statistics are like bikinis. What they reveal is suggestive,
     but what they conceal is vital.�
                       � Aaron Levenstein"
    @kurtullman: "<quote>
Thought I discarded that... Oopsie. But since you asked, I was working 
for a newspaper and kept getting pestered by buddies to run their film 
through the paper's professional account (usually after the local lab at 
the time refused to print nudies for "regular" accounts but would for 
pros).  So (1) taking nude pictures of your girl/boyfriend isn't new and 
(2) neither is the likelihood that they would fall into the wrong hands.
"Statistics are like bikinis. What they reveal is suggestive,
     but what they conceal is vital."
                       — Aaron Levenstein"
    @jfmezeispamnot: "<quote>
I suspect Apple is working fevereshly right now to add "private
pictures" function on the phone , with those pictures never going to
iCloud and requiring a synch on your own Mac.
What is not clear is what sort of harm to Apple's image this even will
cause. It is a bad stain on Apple's image of whether it can be trusted
to keep your things private. And a high profile one because it involves
many hollywood stars."
    @nospam: "<quote>
what's to add? 
turn off syncing photos to icloud. 
considering that it was due to bad passwords, not much."
    @YourName: "<quote>
Yep, it's definitely not new. No doubt it goes back way before the
camera as well with paintings. The camera and now digital cameras and
camera-phones just make it easier for the morons. Not to mention the
ever-shrinking amount of common sense that more recent generations seem
to have.  :-\"
    @YourName: "<quote>
No harm at all since it now appears to have been the idiots' own fault
by having easily cracked passwords, rather than any actual problem with
Apple's iCloud system.  :-\"
    @jfmezeispamnot: "<quote>
It was due to "find my iPhone" not having lockout after x bad passwords,
allowing brite force attempts, which were used apparently.
Apple has apparently fixed this by now."
    @jfmezeispamnot: "<quote>
High profile case where one's personal pictures become public ?
Yeah, sure, nobody will take that seriously. Nobody will doubt iCloud's
ability to keep your private information secure.
And no media will repeat the news that iCloud didn't protect the
hollywood,s private pictures from hackers.
Of course, the media who want invites to Apple events need to keep quiet
about this, but all other media will have a field day."
    @YourName: "<quote>
And, as usual, it will be completely misreported and over-hyped by all
the anti-Apple nutters."
    @kurtullman: "<quote>
Oh yeah... another benefit of making nice nice with the guys in the 
labs....
�Statistics are like bikinis. What they reveal is suggestive,
     but what they conceal is vital.�
                       � Aaron Levenstein"
    @kurtullman: "<quote>
 Have a friend who once wondered aloud about how many of the cave 
drawings were really just neanderthal nudies...
�Statistics are like bikinis. What they reveal is suggestive,
     but what they conceal is vital.�
                       � Aaron Levenstein"
    @arvimide: "<quote>
Of course the user is responsible for the strength of their password, 
not Apple. But Apple oversold the security of iCloud. Mac OSX and iOS 
are quite secure from malware, compared to the well known susceptibility 
of Windows, but iCloud is not secure in the same way. A weak individual 
password doesn't affect the security of MacOSX or iOS against malware. 
The individual should be aware of this, but Apple can be faulted for not 
being more insistent in warnings about password strength in iCloud. And 
Apple didn't protect against multiple attempts to keep trying false 
passwords.
The bottom line is that Apple's reputation for overall ironclad security 
has suffered, and iCloud is demonstrably insecure for users without the 
inclination to make a study of password strength.
++====+=====+=====+=====+=====+====+====+=====+=====+=====+=====+====++
||Arnold VICTOR, New York City, i. e., <email_address>    ||
||Arnoldo VIKTORO, Nov-jorkurbo, t. e., <email_address>   ||
||Remove capital letters from e-mail address for correct address/    ||
||    Forigu majusklajn literojn el e-poŝta adreso por ĝusta adreso  ||
++====+=====+=====+=====+=====+====+====+=====+=====+=====+=====+====++"
    @jfmezeispamnot: "<quote>
iCloud had a lockout mechanism after a number of invalid attempts. "find
my iPhone" didn't.
So the hackers die the brute force attempts on "find my iPhone" which
was not controlled and once they got the password, they could then use
the icloud service to obtain the photos."
    @nospam: "<quote>
that was the initial theory, which turned out to be wrong.
that issue did exist and was fixed but was not what happened in this
case."
    @nospam: "<quote>
although that was an issue (it's been fixed), that wasn't what happened
in this case.
google is also being targeted."
    @jfmezeispamnot: "<quote>
Apart for the apparent lack of automated lockout after x failed
passwords for "find my iphone", I suspect Apple's cloud service is no
different from competitors' .
Because of all the buzz around "cloud" and "big data", Apple had no
choice but to jump into that business otherwise others would have filled
the gap (and were starting to).
No matter how the images were actually acquired, the image in the media
is that this was all the fault of iCloud.
How Apple's PR team reacts to this and whether there are last minute
additions to next weeks's keynote will be most interesting.
I have to wonder if Apple has had to buy Red Bull in large quantities
for its programmers for last minute additions to IOS8 to add a " private
image" feature. Or perhaps Tim Cook might announce this will come in 8.1
a month after 8.0 is released.
Or Apple may ignore this totally at the keynote.
It is ironic that Apple, a very conservative company when it comes to
nudity/porn, was involved in very naughty pictures :-)"
    @jpmcw: "<quote>
So true! The first recorded (by voice and song) such misappropriation 
happened in 890 BC, where a man paid an artist to draw an erotic 
depiction of his woman in a secret cave. The artist later conducted 
private showings to others, and the secret cave was secret no longer."
    @jfmezeispamnot: "<quote>
I don't think the brute force on "find my iPhone" was proven wrong. What
has emerged is that the nudies were obtained from many different ways
over a long period. This does not prove that brute force on "find my
iphone" was NOT used one or more times.
The Apple statement did confirm access via iCloud and that it was
working with law enforcement to find the thieves. (aka: apple checked it
logs, saw obvious break in attempts followed by legitimate access to the
backup and would have then sent the IP addree and time stamps to law
enforcement who then pursue this with the ISPs to whom those IPs are
assigned."
    @rodspeedaaa: "Kurt Ullman <email_address> wrote 
<quote>
Most of them appear to have been done by those into bestiality.  "
    @rodspeedaaa: "Ninghong <email_address> wrote
<quote>
It's a system that allows you to see where
your phone is if it gets stolen or lost.
It allows you to log into the system using some other
device so you can see what the system knows about
where your phone is, and that involves icloud, which
is where those compromising photos are backed up
if you have chosen to back them up to icloud. "
    @rodspeedaaa: ""Patty Winter" <email_address> wrote in message 
news:54072d1c$0$36588$<email_address>
<quote>
You have to log on to apple's system to use Find My iPhone.
But logging on to apple's system that way
does if the  photos are in its iCloud backups.
Unsurprisingly, Apple's system allows you to
use the iCloud backups if your phone has been
lost and can not be found using Find My iPhone. "
    @rodspeedaaa: "DarrinDocO'Leary <email_address> wrote
<quote>
Makes a lot more sense to still do it and do it better so there
is no breach by forcing people to use better passwords.
But hardly anyone would have bothered with that approach.
No they did not. You are free to not use it if you want to.
Bullshit.
Even sillier than you usually manage.
I doubt it.
That's their problem if they are stupid enough to use weak passwords and 
icloud. "
    @jfmezeispamnot: "Dated yesterday but still worth a read:
Tim Cook Says Apple to Add Security Alerts for iCloud Users
Apple CEO Denies a Lax Attitude Toward Security Allowed Hackers to Post
Nude Photos of Celebrities
<quote>
Question: if in the past, changing password already resulted in an email
notification of changed password, then how would one explain the hackers
using the "i forgot my password" and entering publicly available
information about a star (birth date etc) ? Wouldn't that reset password
and have caused a notification to be sent ?
And once password was changed, would the real star's devices cease to
function since they would try to use the old password ? Even a dumb
blonde star would notice that, right ?
In the above cases, it would seem to me that brute force to find the
curerent password would have been the only way to access the data
without the star knowing it."
    @alanbrowne: "<quote>
to
n
e
ud=AE
A simple deterrent against such attacks would be exponential timeout on=20
failed login attempts:
first fail.  0 delay
second fail.  1 s delay
third fail.   2 s delay
fourth fail   4 s delay - and text/e-mail warning to account owner.
10th fail - 256 s delay (4 and quarter minutes) and e-mail/text to the=20
account owner.
11th fail - 24 hour lockout.
=20
I was born a 1%er - I'm just more equal than the rest."
    @bknight: "On Sat, 06 Sep 2014 18:41:27 -0400, JF Mezei
<quote>
First, the hacker would try to log in and say he lost his password or
user id.
 Then an email would be sent with a link for either to be changed. The
hacker would have to have access to the person's email to effect that
change.  
Depending on when he/she tried to access the account.
Brute force against whom?  Surely the star would feel that.  :-)"
    @jfmezeispamnot: "<quote>
Does not give him the existing password. The option generally is to have
the system change the password and email the new password to the email
address to whom the account belong. The hollywood star would get the
email and know the password was changed.
If the hacker has already hacked into her email account, he would have
access to email and likely delete it to erase traces of it. However, the
hollywood star would notice he iphone no longer works at which poimt
apple support would tell her she changed her password, which she would deny.
When does a 20 something millenial NOT access an account ? They are
constantly on their iPhones for everything.
Brite force: you send a million login requests with variations on
passwords until one works."
    @bknight: "On Sat, 06 Sep 2014 21:03:35 -0400, JF Mezei
<quote>
Read what I said.  I would send an email to the star, and the hacker
would only get it if he knew the user id.  You missed my point
completely.
The option generally is to have
Your ESP is wonderful, but you have no idea what a specific person
does on their computer, when or how long.  The "star" may not even be
on his computer for several hours or even days.  The hacker is going
to work as fast as possible.
I'm sure you know an app that does that."
    @savageduck1: "<quote>
Question: 
I suspect the issues surrounding the security of the *Dumb Blonde 
Star's* iCloud account comes down to them having nothing to do with 
acquiring their iPhone/iPad, setting up their Apple ID, and passwords. 
These people have personal assistants.
When they want a new iPhone, the PA will get it, & set it up with the 
most transparent security the *Dumb Blonde Star* can handle. The PA 
will load it with all the *Dumb Blonde Star* wants/demands, and hands 
it to the eager Twittering, selfie snapper. Probably with no screen 
lock password set, and the simplest of passwords for Apple Store/iCloud 
Perhaps thinking along these lines: "you got your Oscar for "Silver 
Linings PlayBook" in 2013, so your password is "Slpb-2013"."  That 
would be simple enough for *Dumb Blonde Star* to remember and strong 
enough for Apple and its at least 8 characters, at least one upper case 
& one lower case letter, & at least one number recommendation. the 
additional "-" is a bonus.
Unfortunately that sort of thing is probably on any password cracker's 
list of probabilities, and brute force would get to it sooner or later.
Make things more secure, and you will get a different set of complaints 
from the *Dumb Blonde Star* contingent, and the Personal Assistants out 
there will really have to start earning their money.
Regards,
Savageduck"
{'source': 'USENET', 'other_information': '{"reply_count": 29, "forum_name": "misc.phone.mobile.iphone.20141022.mbox"}', 'file': 'data/output/usenet-misc.phone.parquet'}