Explain this Ashley Madison thing.. Are people really that dumb?

[Red Squirrel]

This gets better: http://gizmodo.com/john-mcafee-ashley-madison-was-an-inside-job-1726111959

It may actually be an inside job.

 

[TheVrolok]

Dude, people are dumb. You know this. /thread.

 

[mmntech]

It may actually be an inside job.

It wouldn't surprise me. All it would take is one disgruntled employee in the IT department. Either they dump the server data themselves, or sell off admin level access to some ne'er-do-wells. They can then poke around the server all they want, completely unnoticed. No hacks necessary.

I believe that's pretty much what happened to Sony. Though they never did find the perps AFAIK.

 

[SMOGZINN]

I'm not saying don't take simple common sense precautions to protect yourself when using the internet, but a lot of the posters above seem to be claiming that anything short of doublebagging and wearing a full hazmat suit everytime you go on the internet means that you are a fool. If that is in fact the case, commerce on the internet will fold up and disappear.

This is the new reality that even non-techie people need to realize: Your data is not safe.
You talk about expecting the same sort of security your bank or the .gov uses, but the last few years have been rife with big government data losses. We recently found out that hackers got the entire OPM database from the government including lots of classified information. It is just a matter of time before a bank is hacked.

But this is nothing new, banks were robbed in the past and stores have been stolen from. Somehow they survived. Internet commerce will too.

 

[edro]

Wow, it all makes sense now.

Make a cheating website to make millions off of sex deprived men, through in some fake women accounts to keep the attention high, release emails of all cheaters, run away with your millions.

Win-Win-Win

 

[Red Squirrel]

This is the new reality that even non-techie people need to realize: Your data is not safe.
You talk about expecting the same sort of security your bank or the .gov uses, but the last few years have been rife with big government data losses. We recently found out that hackers got the entire OPM database from the government including lots of classified information. It is just a matter of time before a bank is hacked.

But this is nothing new, banks were robbed in the past and stores have been stolen from. Somehow they survived. Internet commerce will too.

Yep, this is why I hate the idea of companies taking so much of my info. They cannot be trusted to keep it safe. They have no motive to do so, since they have insurance to protect themselves. Cheaper to put up with the fallout of a hack than hire competent people to secure their systems. Heck most companies outsource IT to India now days. Our data is literally in the hands of the same people calling us from "windows computer" about a virus that got detected on our machine wanting 200 bucks to remove it. Would not be surprised if some of those people actually work both jobs. Scam business on the side and contract with legit companies on the other.

The companies that have data that belongs to big wig 1%ers are the ones that do end up getting in trouble when they get hacked but if no big wigs are victims then not much happens.

 

[Imp]

Lulz.... Posted earlier, but here it is again:
http://www.cbc.ca/news/technology/ashley-madison-s-members-by-the-numbers-1.3208152

So, estimate is around 10 thousand women and millions of men. Many of those women may have been run by the company. Sounds like the service was more like a phone sex line than an actual affair website.

 

[mmntech]

I still stand by my previous statement that it was a dick move releasing these peoples' personal info to the web, since it's not just the cheaters who will get hurt.

However, this whole story just gets funnier and funnier. Seems like Ashley Madison was nothing more than a elaborate, and brilliant, scam. Sex sells baby.

This is the new reality that even non-techie people need to realize: Your data is not safe.
You talk about expecting the same sort of security your bank or the .gov uses, but the last few years have been rife with big government data losses. We recently found out that hackers got the entire OPM database from the government including lots of classified information. It is just a matter of time before a bank is hacked.

Especially since a lot of these hackers are now either sponsored by state security agencies or organized crime. Which has given them unprecedented access to resources. That has given rise to folks like Hacking Team. Cyber-warfare mercenaries, for lack of a better term. Wasn't too long ago that this stuff was the realm of bad science fiction.

The big software vendors can barely keep up. I certainly don't trust your average corporate IT department to be that on the ball.

 

[Imp]

That reminds me... Why the hell don't banks use two-step verification like Google, Yahoo, and Hotmail? Need a password but also need a disposable one-time code to log-in -- either to phone or a second email.

I think I remember one person being scammed repeatedly because he/she had a scammer phone in, pretend to be the person, and only have to do very basic verification.

 

[ImpulsE69]

That reminds me... Why the hell don't banks use two-step verification like Google, Yahoo, and Hotmail? Need a password but also need a disposable one-time code to log-in -- either to phone or a second email.

I think I remember one person being scammed repeatedly because he/she had a scammer phone in, pretend to be the person, and only have to do very basic verification.

Because the real hacks bypass all that nonsense and go straight for the data. Trying to find l/p's is small time compared to the real dangers out there. They look for weaknesses in the overall infrastructure to get directly to what they want or get help from the inside. Strong passwords and RSA keys aren't going to fix that.

Public facing data is never going to be safe in the long run and it is best to use the internet with that always in the back of your mind.

 

[MongGrel]

Yep, apparently the site was one big sausage fest and the vast majority of female accounts were bots. Active female users numbered under 10,000, versus 20 million for males. Of course Yahoo cites Gizmodo in the article. Anything from the Gawker Network should be treated with a grain of salt. Still wouldn't shock me though.
http://finance.yahoo.com/news/ashley-madison-bunch-dudes-talking-233158251.html

Not really a big surprise there.

 

[Imp]

Because the real hacks bypass all that nonsense and go straight for the data. Trying to find l/p's is small time compared to the real dangers out there. They look for weaknesses in the overall infrastructure to get directly to what they want or get help from the inside. Strong passwords and RSA keys aren't going to fix that.

Public facing data is never going to be safe in the long run and it is best to use the internet with that always in the back of your mind.

That's usually what they do to steal identities and credit card numbers. I haven't heard of hackers going straight to data and editing account number totals yet -- or as often. Two-step verification should at least slow down someone who's key-logged or phished your banking info and password, then tries to transfer money... Come to think of it, I haven't heard of people logging into peoples' bank accounts and transferring money out before either -- usually an insider (family) job.

 

[mmntech]

That reminds me... Why the hell don't banks use two-step verification like Google, Yahoo, and Hotmail? Need a password but also need a disposable one-time code to log-in -- either to phone or a second email.

I think I remember one person being scammed repeatedly because he/she had a scammer phone in, pretend to be the person, and only have to do very basic verification.

Banks are still using the old "personal question" technique, despite that imformation being relatively easy to find. Best you can do is use long random passwords and hope the bank doesn't store that information in an easily crackable format.

A lot of places still don't have two factor at all. Sony is one that really irks me because they of all people should know better. PSN's security is horrendously outdated and a lot of people have been nailed because of it. I've seen at least one case on this forum. More on Reddit. Some scrip kid hacks their account, deactivates their console, then uses their credit card to buy hundreds of dollars worth of games. Then when the victim complains, Sony's like "what do you want us to do?" Uh, fix your crappy security. Maybe don't let people just activate or deactivate systems willy nilly if they're signing in from a new IP.