Hacker News Reader

Comment by vibrunazo | Hacker News Reader

> It’s appalling that they will give control of your iCloud account to anyone who knows your name and address, which are very easy for anyone to find, and the last four digits of your credit card, which are usually considered safe to display on websites and receipts.

Not trying to defend anyone. But has this been reproduced enough to confidently say they'll give control to "anyone"? Or was it just an employee mistake not following the policies in place? It would be a mistake on their part either way, but I'm just trying to understand what the mistake was.

View on HN

If you read the Wired article by the fellow who was hacked (http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona... ), yes, Apple does this as a matter of policy, and even after Apple assured the author that this was not policy, Wired went and tested the method on two separate occasions and was able to gain access to other folks iCloud accounts.

Quote:

On Monday, Wired tried to verify the hackers’ access technique by performing it on a different account. We were successful. This means, ultimately, all you need in addition to someone’s e-mail address are those two easily acquired pieces of information: a billing address and the last four digits of a credit card on file. Here’s the story of how the hackers got them.

In the Wired article, they mention that they were able to reproduce it. It seems that is their policy, and in my opinion, that policy is the mistake. There should be no easy way to end-run user defined security like this - Mat could have the most secure account in the world, doing everything right, and this still would have gotten him hacked. That is a problem, and a big one.

> Or was it just an employee mistake not following the policies in place?

The employee should not be given the ability to not follow the policy.

Policy? There should be no policy of resetting passwords. Instead there should be procedure where you as customer support fill in the data, answer(s) to security question(s) and then you can press the button. And then temporary password is generated and set in place. If you have policies - do that, dont do that - you are already screwed. Like Apple is right now.

Reply on news.ycombinator.com