Hacker News Reader

Comment by brown9-2 | Hacker News Reader

It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account.

This is scary.

View on HN

I have actual work to do, work that I have been putting off too long, so let's try crowdsourcing this question on HN:

What should one try to do to protect against this?

Hypothetical actions to take:

Make sure that an email address that's doing double-duty as a login identifier for a given service is unique to the service and appears nowhere on the web or in outgoing mail.

Take particular care to have a "recovery" email address that is used for nothing else. Don't forward it to your regular mail, naturally.

Enable two-factor auth for email if you possibly can.

Have a credit card that is only used for online stuff.

Can one get a second address that is used only as a billing address? How would one do that? (A P.O. box? Expensive! A friend's house? I fear that credit card companies will leak this address like a sieve no matter what I do.)

EDIT: Startup wizards, here's a Minimum Viable Product: a credit card that can only be used for online accounts - which you must whitelist as you add them, via two-factor auth with your phone - and that features two billing addresses: The real one where the bills go and a dummy one that still validates. (Is that even legal under the CC rules? Sigh.)

The other suggestions in the article: Disable Find my Mac, reduce coupling between your accounts… was there something else?

Alas, nobody who isn't crazy paranoid is going to bother jumping through all these hoops. (I have tried to fight that paranoia but I think I'm losing that battle.)

The most surprising thing I see out of this isn't the need for more robust authentication but for services that aren't so damn quick to do whatever you want.

Website: "Hey Bill, glad to see you today, what do you want to do"

Bill: "Delete _everything_ I've ever done on every system I have"

Website: "Of course! Let's get this started... beep boop bip and done!"

What about this:

1 - Kill request sent

2 - 48 hours is set on the clock so you can choose to cancel

3 - You can choose to pay $50 via credit card to have it happen immediately

4 - You are reimbursed $45 after a couple weeks

That might make it a little harder to have such hacks like this happen in the future.

I can just imagine the HN article when someone tries to delete his Facebook account because he disagrees with some new feature, and they won't do it for 48 hours. I've been on the receiving end of "DELETE MY ACCOUNT!!!1!!1" requests, and I know those people wouldn't respond well to "wait two days or pay up."

Can you delete your Facebook account instantly? When I deleted mine, it went into limbo for like two weeks before being permanently deleted. (I don't remember if there was no option for instant-delete, or if I just didn't care to.)

Facebook doesn't even allow you to delete your account. If a site were to remove the account from the public view, but delay the actual deleting by a few days (I'd prefer a week or more actually), you wouldn't notice the difference unless you were malicious. But I don't understand what the money is for actually.

> I don't understand what the money is for actually.

I was thinking about remote storage and devices. For example, a backpack is stolen with your phone/tablet/laptop and you need to issue a wipe to it NOW before they are compromised.

Requiring a credit card at least leaves a paper trail of some sort.

Once I moved and realized I forgot to cancel my phone and DSL. On the road, I used my cell to call the phone company to cancel. They did it for me immediately.

I was relieved it was so easy, but unnerved at how easy it was.

Maybe they had the cell associated with my land line, but I doubt it, since I got the line before I ever had a cell.

Standard procedure when setting up MDM for a company is to disable iCloud. All remote wipe/etc. done by your own servers, not by Apple.

Apple is really bad at running online services. It's a shame that they short-sightedly decided to go to war with Facebook and Google (who are good at services and bad at hardware) rather than playing more nicely together.

More importantly, standard procedure is also to keep multiple backup copies of important data. Because no matter who manages the infrastructure, the only reason the kill switch exists in a corporate environment is because there are scenarios where you plan to use it. Not to mention the very finite lifespan of all forms of modern mass storage, the relative ease of accidental deletion in most file systems, and so on.

For every person who loses "irreplaceable" data to malice, many more lose it out of simple incompetence.

Oh, sure, but I still thnk striking down with great vengeance and furious anger upon those who remote-wiped your devices would be justified, even with backups. If nothing else, it costs time to restore from backup, but if you were on a trip or something and had no convenient high-speed access to backups, it would be quite unpleasant. Especially if you had, say, iPad iPhone MBA, and assumed at least one of them would be likely to survive the trip, and thus had no other local backups with you.

But yes, backups -- and not just online backups, but also offline backups.

Have a billing phone number. If a stranger tries to get access, call that phone number before you can get access.

This massively raises the bar for social engineering.

An obvious thing to improve is for Amazon to stop handing out customers' accounts to identity thieves who apparently just need to call with name, billing address and e-mail to add a new credit card number, then call again with name, billing address and the new credit card number to gain access to the account. I'm sorry Amazon, but name, billing address and e-mail shouldn't be sufficient to hand over my account to a stranger.

Not a solution, but I have a feeling Apple is going to be tightening their policy very soon. This story has gotten a lot of attention.

Honestly, the credit cards are the easiest part. I'd much rather someone get my credit card number than my email account.

I agree with you but I think the idea of having a credit card just for online stuff is to limit the ways in which someone can get access to any information about your credit card, like the last 4 digits. For example, someone who finds your credit card receipt at a restaurant would get the digits of a different card and couldn't get access to your AppleID.

It's actually a good idea. I'll think about doing that…

I wouldn't do anything too crazy. If you're the 1 in a billion (7 billion, actually) who gets targeted like this, they'll probably still get in so you're just wasting oodles of time and adding a good dose of constant aggravation for essentially nothing.

There's many good reasons to make backups however, not just the chance that an advanced hack like this can occur. Definitely not wasted time.

Give your parent's email as your recovery email address. If you need to reset, you can call them and talk them through clicking the link and resetting the password.

The bad guys then have to crack your parents email account too, and being older they will be less likely to have daisy-chained Google, Apple and Amazon accounts.

They will also more likely have picked a password that's easy to brute force.

run your own server.

...until the hacker calls up your registrar and convinces them to reset your domain management password.

...in your closet

A lot of receipts contain the last 4 of the card used, it looks like most iCloud users are one garbage bag away from being compromised.

Especially given that that information is available to anyone you've ever used that credit card with.

"Pay with your iCloud password" just doesn't have the same fuzzy feel, does it?

Reply on news.ycombinator.com