Thousands of Hotmail users hacked(news.bbc.co.uk)
news.bbc.co.uk
Thousands of Hotmail users hacked
http://news.bbc.co.uk/1/hi/technology/8291268.stm
3 comments
While I dislike hotmail as much as the next person, emails being 'hacked' and people stupidly falling for a phishing attempt are two different things.
I cannot emphasize this enough. While phishing is definitely a threat, calling it "hacking" creates a massive problem. Imagine, for example, if grand theft auto was referred to as identity theft. If they become synonymous in the public mind, many people will begin to think "Well, I have a safe that I keep all my information in, so no one can take anything from me."
The problem is the method for protecting yourself from anything, from car theft to identity theft to having your email account hacked, all have different methodologies. The best way to protect users from phishing. In fact, that's about the only way to do it. Calling it hacking means that people start to think "Oh, I have a firewall, so I'm safe." I've heard that from far too many users, frequently after they've fallen for a phishing scam "What? The firewall doesn't stop that?"
The problem is the method for protecting yourself from anything, from car theft to identity theft to having your email account hacked, all have different methodologies. The best way to protect users from phishing. In fact, that's about the only way to do it. Calling it hacking means that people start to think "Oh, I have a firewall, so I'm safe." I've heard that from far too many users, frequently after they've fallen for a phishing scam "What? The firewall doesn't stop that?"
I can too agree we must tell people that its not hacking but phisihing so they can be better aware of threats like these.
Hey, it's still not as bad as most livejournal/myspace/etc. 'hacks', which usually boil down to:
* "Someone guessed my password"
* "I intentionally told someone my password and they locked me out"
* "I want to pretend it wasn't me that just epically flamed out"From the reports I've read it certainly isn't clear all the cases are phishing, I know a couple of people who had their accounts compromised and I cannot see them entering their passwords stupidly.
Perhaps there are dictionary attacks. Passport, the precursor "live id" was known to be flawed. It does make me wonder whether microsoft has added new features that need "hotfixing" to make their design secure.
True, but hotmail could try to "go google" and offer more help against phising.
I had my hotmail hacked with a plain old dictionary attack (it was an extremely rare word, but still). While I hadn't used it in years, at some point I seem to have synced it with Plaxo, so it had all of my contacts, who were all now the recipients of various kinds of spam. Sucky.
If you want to do some password research, you can still find the list on google cache.