Maybe this is a great reason to stick with Google's cloud services.
Apple will double down in security now, especially regarding iCloud, but even doing so there is a chance that this will happen again. Same for Microsoft, Sony and, yes, Google.
There's no magic solution other than being careful. And even with that security is always an illusion. Your door lock is easily opened, no matter how much money you put in it, the only thing preventing you from being robbed is that are more houses in your neighbourhood and that some of those could seem like an easier target.
But back to my point social engineering doesn't require voice. you can do it via email just as easily.
(I am a Google Apps for Business user and have had to contact Google Apps support a few times … the process has never been really pleasant.)
One thing I do know, though, is that like you said, security is likely going to get tightened across the board, and that means that it's going to get a lot more inconvenient for all of us. I guess that's a good thing, but it will definitely impact the usability of these services.
If it means that all vendors will tie their services to a two-factor authentication scheme linked to our phone, well that might just stop me from using the services altogether.
None of these will be 100% effective, but it will make things more difficult for attackers and not too uncomfortable for users.
It requires the existence of a customer service in the first place. Good luck trying to call Google.
There is no "magic" solution, there are just solutions. But to suggests its all the same... Thats just lazy.
Apple is more vulnerable, because they do do customer support. Sony was more vulnerable, because they just dint give a shit, and didnt bother anything to secure it.
Microsoft and Google still have a zero incident record. After all this time. They even went beyond their own responsibility many times, getting police involved because they suspected targetted (political) malware.
And no, in the world of formal discrete systems (computers) there are provable correct, and provably incorrect solutions. For example: DRM can always be hacked, but we can secure ourselves from the middlemen.
Any analog with a "door" deserves only ridicule.
The backup email address on my Gmail account is that same .mac email address. At 4:52 PM, they sent a Gmail password recovery email to the .mac account.
Here Gmail was only as strong as the weakest password recovery email service it was linked to. I consider this a failure on Google's part.
The imap/pop thing is still a legitimate concern. App-specific passwords let those continue working, but they have security issues of their own.
Im not suggesting that doing nothing is the same of doing something. Im just saying that not matter how secure and prepared Apple had been, this could have happened anyway.
Zero incident record, in any case, seems very unrealistic. I don't know any particular case first hand but then again i'm sure this is not the first time this happens with an iCloud account either. Mat is a public person and has commented his case publicly and thats why we are openly talking about it here.
When i claimed certain high target technological companies have a zero incident grade, im talking about the fact the companies were never themselves the weak link.
If this guys account was hacked because he tattoos his password on his forehead, Apple too would be in the clear. But here, not the user, but the company screwed up.
There are many, many companies which do not have incidents, or take full responsibility when they do. The type of incidents we complain about, often indicate just gross negliance. (and this is gross negliance by Apple)
You are repeating the claim that there is no watertight security. This claim is wrong. Software can be provably secure. Authentification can be provably secure, just like any type of Content protection is provably unsecure.
Now, you are also making the claim, that we are talking about this, because of the affected users popularity.
Maybe thats why you are talking about it. But most of us are actually surprised because of the gross negliance. ICloud has no authentification, one can just call up, and take over the account. As we now know.
And if this was any other company, i doubt anyone would argue against this obvious and pretty much indisputable fact. But this isnt Sony, this is Apple, and they can never do anything wrong right? Eventhough, statistically, just like any other company, they might could not excel in every way. Maybe this is just one area, where they just screwed up?
Theyll learn from it, hopefully. But lets not pretend it didnt happen, or that it isnt as big as a fuckup as it actually is, back here in reality.
In the last case, the top links are to Microsoft's FAQ pages.
Not having any customer support worth a damn is a different kind of policy failure. (For example.)
Most people who get hacked hardly ever report it, they just want their account(s) back.