« New Online Chat! | Main | Inaugural Conference on Classroom Response Systems (clickers) »

A message about e-mail security from Campus Technology Magazine

What Was Your First Pet's Name? Lessons Learned About E-Mail Security

10/10/2008

By Doug Gale

Last month a hacker gained access to Vice Presidential candidate Sarah Palin's personal e-mail account, gov.palin@yahoo.com. (Earlier Palin had refused to release the e-mail under a public records request.) Initial reports credited the attack to an anti-Scientology group, but, as the story evolved, that was debunked, and things now point to an individual acting alone. A detailed description of the complex claims and counter-claims can be found in Michelle Malkin's blog.

The FBI and Secret Service were quick to take action, seeking copies of the documents from the Associated Press (which refused) rather than Googling for the multiple sites that had them online. (I downloaded my copies from Wikileaks.) A Federal grand jury has indicted a Tennessee student for "intentionally accessing without authorization" Governor Palin's e-mail account.

The person claiming to be the hacker didn't use sophisticated techniques; he just made use of the password reset feature. Something any regular e-mail user could do. He claims he went to Palin's account, said that he had forgotten the password, and invoked the password reset feature. The only information he needed was her birthdate, zip code, and answer to the security question, where she met her spouse--which she had answered in front of several million people at the Republican convention.

That's how easy it was. No rocket science here. I remember being asked in the 1980s, when e-mail was just becoming widespread, "How do you know someone else isn't reading my mail." My answer was, "You don't." My advice then was simple: "Don't put anything in e-mail that you wouldn't want to be made public." Read the rest of the story

Be sure to read the information from OIT here at the U on Identity theft and email security as well as information on Safe Computing

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)