How Paris Hilton Got Hacked? Bad Password Protection
from the tinkerbell dept
This morning, in Good Morning Silicon Valley, John Paczkowski joked (I think) that he'd bet "$5 and a Swarovski-encrusted dunce cap says her password was Tinkerbell." He might be right. While T-Mobile still says they're trying to figure out how Paris Hilton's T-Mobile account got hacked, Brian McWilliams has it all figured out. Her password might not have been Tinkerbell (the well known name of her dog), but the secret question to get her password reset was: "What is your favorite pet's name?" Yup. It wasn't necessarily social engineering or a security hole or even real hacking (though, in some sense, it was a combination of all three). It was good, old fashioned, stupidity -- leaving the keys under the front door matt with a big sign that says "keys under the matt" next to it.
Reader Comments (rss)
(Flattened / Threaded)
the joke may be on Hilton by nonuser on Feb 22nd, 2005 @ 8:51pm
but the real culprit are service providers who rely on such an insecure backdoor that gets hacked when customers use it the way they suggest.
(reply to this comment) (link to this comment)
Bruce Schneier wrote just recently about this secu by Precision Blogger on Feb 23rd, 2005 @ 6:59am
Bingo! Bruce Schneier wrote just recently about how the backup question weakens password protection. He says when forced to supply a Q&A, he hitsrandom keys that he won't remember for the answer. See:
http://www.schneier.com/blog/archives/2005/02/the_curse_of_th.html
- The Precision Blogger
http://precision-blogging.blogspot.com
(reply to this comment) (link to this comment)
Use " other " ? & make one up by Anonymous Coward on Feb 23rd, 2005 @ 7:38am
Use the " oter " question catagory.
Ask yourself a question that NOONE would understand BUT you.
Works for me & even if the system were hacked, my question wouldn't even make sense to the hacker.
Problem solved.
(reply to this comment) (link to this comment)
Re: Bruce Schneier wrote just recently about this by Tim on Feb 23rd, 2005 @ 8:16am
Do it jeopardy-style:
secret reminder question: meow
reminder answer: What do dogs say?
That's one heck of a long passphrase for no extra work ;)
(reply to this comment) (link to this comment)
Re: Use by seth on Feb 23rd, 2005 @ 8:31am
I always just enter a lot of gibberish whenever I am required to have a reminder question. Then I just don't forget my password or I have it emailed to me if I do forget. I always distrusted the back-up password.
(reply to this comment) (link to this comment)
Re: Use by Ranger on Feb 24th, 2005 @ 10:26am
Am I the only one suspicious of her getting hacked in the first place? I mean, isn't she due for some scandalous web-activity about now?
I mean, who keeps perfect naked pictures of themselves on their mobile camera? For what possible reason? "Hey, I want to see if I've gained any extra weight from eating that ice cream sundae?"
(reply to this comment) (link to this comment)
T-Mobile Password Hacking by Nick on Feb 25th, 2005 @ 8:19am
... another likely theory was given in this post over at Kevin Rose's site.
(reply to this comment) (link to this comment)
Paris Hilton by Katie on Oct 30th, 2006 @ 6:50am
Finally her stupidity is realized!!!
(reply to this comment) (link to this comment)
Add Your Comment