Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Identity and Authentication Services

The Palin Email Hack

Created: 19 Sep 2008 • Updated: 08 Aug 2012 • 1 comment
vipmobile's picture
0 0 Votes
Login to vote

The recent news about how Vice Presidential candidate Sarah Palin's Yahoo email account was hacked makes it clear as day that we need better security for web based email, and we need to close the giant loophole of "password reset". Web email often gets lumped into the bucket of "low value" accounts, so system designers pay little attention to the security of its authentication systems, but it often contains our most personal details. How many more high-profile account takeovers are we going to see before people take account security seriously? Come on folks, usernames and passwords just don't cut it anymore, and the problem isn't just limited to financial sites.

This incident also makes it abundantly clear that system designers need to take a holistic, layered approach to security. Palin's Yahoo account was compromised not because the hacker guessed her password, but because the "password reset" function was easy to get through. There's no sense in locking down the front door tight if you're going to leave the side door open, and that's what you get when you use simplistic "secret questions" as a password reset mechanism. So-called "secret" questions are never secret -- and even if you're not a national public figure, it's pretty likely that more than a few people know your dog's name, your birthday, or where you went to high school.

If you're a user stuck with a site that uses one of these bad "secret" question schemes, Veracode and Lifehacker have some good tips on what to do (besides threatening to take your business elsewhere if the site doesn't implement real security). If you're a system designer, you should use true two-factor authentication for the front door, and an out-of-band scheme for credential recovery.

Comments 1 CommentJump to latest comment

wood furniture's picture

I am not really sure what to make of Palin, not sure if she really wants to be in politics or just the limelite.. I really like your article and look forward to your next story. Thanks great keep up the wonderful writing. - I look forward to returning your blog again. -

-2
Login to vote