The State of Hacked Accounts 69
Orome1 writes "Most users get hacked at high rates even when they do not think they are engaging in risky behavior, with 62% unaware of how their accounts had been compromised, The results of a Commtouch survey presenting statistics on the theft, abuse and eventual recovery of Gmail, Yahoo, Hotmail and Facebook accounts, shows that less than one-third of users noticed their accounts had been compromised, with over 50% relying on friends to point out their stolen accounts. Also, more than two-thirds of all compromised accounts are used to send spam and scams, which is not surprising, as cybercriminals can improve their email delivery rates by sending from trusted domains such as Gmail, Yahoo, and Hotmail, and enhance their open and click-through rates by sending from familiar senders."
Duh. The sites themselves have no security. (Score:5, Interesting)
When you have websites like Facebook that, by default, use unencrypted HTTP and a trivially sniffable session cookie for their authentication, there's really nothing a user can do to protect themselves. (Okay, now they offer HTTPS, but that wasn't always the case.)
The problem with HTTPS, of course, is that it is seriously heavyweight. Most content doesn't need encryption; it just needs authentication. For those sites, SSL is serious overkill.
What this really points out is the desperate need for a standard mechanism of authentication that is not based on cookies, but rather nonce-based, similar to the way digest authentication works, but integrated with web pages so it doesn't feel ugly and bolted on. Until we get that, there's really no point in users bothering to secure their accounts. Why choose a strong password when you're basically sending it back and forth on the Internet equivalent of a postcard?
Re:This will never end (Score:5, Interesting)
I use a different random 20 character Password for EVERY website and service I use (thank you lastpass!).
Last week, google told me my account needed to be verified, after a mobile phone in korea logged into my account. (I also use Firefox or chrome on linux). Only thing I can think of was that there was some sort of XSS (since I keep myself logged into gmail) on either a website my linux box visited, or my android phone. I'm leaning towards the phone, since I use gmail over https on linux.