Enough about that. Now to my case. First understand my profile. I manage a large number of online identies through my yahoo account. Some of them public some of them private. This is the first security issue. Should I have a centralised account for all of them or should I have kept them sealed off from each other. No that would be too complicated. After all I was doing NOTHING illegal. Oh that is if you do not take into account cyberlaws that say it is illegal to assume a false identity. So what if my "fat_ugly_middle_aged" id on yahoo is not a perfect description of me. We all know I am in reality handsome, well proportioned and young... but it certainly is not unethical.
So imagine my shock when i found I couldnt log into my yahoo account. The social engineering approach is probably the most used approach to crack a web account. I did a search on google to see what to do. Most people said its not worth following up with yahoo to get it back. But I owed it to people who were using my yahoogroups!
So write, I did.
And YAHOO responded!!! When I explained my case, they wrote back to say that they had reset the password. It took a while. Which is good...it means any potential hacker will also take a while. But what I had not realized is that our wily friend (??) had added some email ids to the ones I had. So when the password was changed the notice went to all ids including the fake ones he had created. He was prompt in changing it back. But all it took was dogged persuasion. It took me about 10 days to get my account back. But I guess it could have been done in a week.
In the meantime I sent an email to my own mail id. I first sent a hi...and got a response also saying hi...then I wrote the mail reproduced below. I didn't get a response, but once I got my mail account back, I saw it was read. I guess it rattled the fellow and I knew he wouldnt fight too hard to retain control.
Dear Mathai,
I am glad I finally get to talk to you directly. I don't know if you know about it, but you have crossed over from being a harmless prankster to being a criminal. Identity theft is a crime, and if you are caught you could lose your job, as well as spend time in jail. It doesn't matter whether you have caused financial losses or not. Are you sure you want to be in this position? Let me know what you feel either way :)
The Other Mathai
Finally yahoo sent a link to reset the password directly to my secondary account (which was not registered at the time).
So what can you do to prevent social engineering?
1. Never Speak The Truth:
If your security question is to write your mother's maiden name. DO NOT write the truth. Remember this is not a passport verification. Write something else. At least MIS-SPELL the name. But then the catch is you must remember this. Remember if you are on line, there is a lot of data about you floating around.
2. Give a secondary email address
Though often not mandatory, when the hack happens you will wish you had done it. So might as well do it now.
3. When it happens, respond swiftly.
When your account is hacked, it will take some time to get it back. Put in the time. Or put someone on it...someone who you trust. Don't delay
There is a greater issue of whether we should have one centralized id or use multiple. Thats a choice you will have to make. I dont believe a company like GOOGLE / GMAIL or MICROSOFT will use my personal data to somehow blackmail me individually. Hence I have no problems with trusting them with personal information. But then again I know people who spend their lifetime trying to keep some small petty thing a secret.
RETRIBUTION:
So what attempt did I make to catch the culprit? Virtually none. I know he will read this article as soon as it goes up. That is retribution enough for me. Once there was an email that went around foul mouthing certain faculty at XLRI. I traced it back to one of five accounts. I then sent an email to all five saying.. I DON'T WANT TO... follow this up. But whoever does these things, should know that you are far from invisible on the internet....as the recent terrorists found out.
