How Apple and Amazon Security Flaws Led to My Epic Hacking

Re:How Apple and Amazon Security Flaws Led to My Epic Hacking by bigiain on Tuesday August 07, 2012 @10:48PM (#4353613)

I think we're vigorously in agreement here - the last 4 CC digits are certainly not identifying, and I'm perhaps a little less forgiving that you in letting Apple off for thinking so. I'm also not happy with Amazon's assumption that they should be displaying them quite so easily (although at least they don't display them until you're far enough "in" to an account - and it's not easy to work out an alternative way to distinguish between several different CC's when you can have more than one linked to your account).

(And, there are many alternative and easier ways to acquire most people's cellphone number - no need to meet someone or get them to give you a business card… But your point still stands…)

[ Parent | on HN ]

Re:How Apple and Amazon Security Flaws Led to My Epic Hacking by mirkules on Wednesday August 08, 2012 @12:27PM (#4356449)

My apologies, I somehow glossed over the Apple part of your post. I agree with everything you said, perhaps even about being forgiving of Apple using the last 4 digits as a verification mechanism.

It's true about a cellphone number -- from what I heard about his attack outside of this article, this a very targeted attack, and the attacker knew exactly what kind of data to expect in the GMail account, which is what led me to conclude that the attacker probably knew or met the victim, but likewise, good point about obtaining the cell in other ways.

[ Parent | on HN ]