P16: Practical Progress

How Sarah Palin's Yahoo Mail account was hacked

You may have heard by now that Sarah Palin's Yahoo Mail account got hacked. It was her personal account, but allegedly she was using it for state business or somesuch.

More interesting to me is the story of how it was hacked.

Veracode Blog - Learning From Sarah Palin’s Yahoo Mail Compromise

Shockingly easy: they just used "password reset" and guessed some supposedly-private "secret questions". The article also points out why Gmail's password reset function is more secure.

Lesson: don't use "secret questions" that someone can easily guess about you -- or look up on Wikipedia!

Website security audits -- how to get on the right track, for web startups

Someone asked me a rather interesting question today, and I'd like to share it (and my reply) with you.

Imagine you're in charge of a internet startup. You haven't launched yet, but the product is coming together and you'll be launching and promoting it soon. Everyone on your small team is working flat-out and doesn't have a second to spare for anything. At. All.

In one of those seconds you didn't have to spare, you think, "How do I ensure our website is secure?" So you don't have a big, gaping security breach on your shiny-new webapp the moment it gets some positive press?

Usually the answer is "Ack! I don't have time for this!" and you move on. Maybe you cross your fingers the next time the thought crosses your mind.

If you happened to be product manager within Yahoo!, instead of a startup, you'd have access to a wonderful resource: the "Paranoids". They're a highly experienced security assessment team who can quickly and clearly spell out best practices, find the booby-traps in your code, and smack your developers' wrists when necessary.

Alas, Yahoo still hasn't bought your startup yet. What now?