Amazon and Apple security

[PhilT]

I saw this article today : http://www.guardian.co.uk/technology...patch-security

It was interesting as it gave links to the original blog describing how hackers obtained information from Apple and Amazon accounts.
I also has a link to Google to allow you to increase security on Google apps such as gmail using two-step verification.

I thought I would take a look at my gmail account settings and it is very easy to set up the extra security (there are on-screen videos and help). It utilises a second level of verification through a unique code sent to your phone. It also allows you to set up a second phone number to use if your mobile is stolen.

I think it's a good extra level of security; I'd recommend it

[SteveRiley]

This saga is important for everyone to digest and understand. A couple days ago, Mat Honan detailed the attack very well in an article at Wired:
http://www.wired.com/gadgetlab/2012/...n-hacking/all/

The crux of the problem:

But what happened to me exposes vital security flaws in several customer service systems, most notably Apple’s and Amazon’s. Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification. The disconnect exposes flaws in data management policies endemic to the entire technology industry, and points to a looming nightmare as we enter the era of cloud computing and connected devices.

I strongly encourage everyone to read the full article. Take a moment and consider what improvements you might make to your ID/password/PIN behaviors.

One important aspect to understand is the difference between an identifier and an authenticator. Many security breaches -- especially those involving some kind of social engineering -- occur because policies often fail to understand that authenticators must be secrets, and that relying on public bits of information such as credit card numbers or socual security numbers cannot be used as trusted authenticators. I would encourage you to read an article I wrote about this distinction a few years ago.

It's me, and here's my proof: Why identity and authentication must remain distinct
http://technet.microsoft.com/en-us/library/cc512578

[PhilT]

Thanks for that article link, Steve, very succinct and helpful.