Protect you Apple ID, I mean it!

Buchanan0204 · 29 Mar 2011 at 14:18

fez said:
They wouldn't and neither would they need to. You can buy databases full of passwords and email addresses from sites that have not secured themselves properly. Seeing as most people reuse the same password, chances are, some of those people will be on itunes.

People who do this follow the path of least resistance. They know that a lot of people have googlemail accounts, once they have that, they can see what other sites you use, go to that site and reset your password and watch as the reset comes into your inbox ready for them to change.

They don't target individuals, they will just find the least secure people and target them. Its not that hard to do.

I thought Google Mail would have been secure? No?

lamboman · 29 Mar 2011 at 14:43

The Apple Store, last time I checked at least, works on generated and completely unsecure session IDs. Meaning, if you link someone to the log in page, and they log in with that link, you are then in their account. Ridiculous. I don't know if it works the other way (they log in then link you to a page that uses the ID on the site).

So make sure you don't do these...and make sure you haven't been linked.

jas72 · 29 Mar 2011 at 16:11

my account got hacked as well I'm sure the app store isn't really secure.

fez · 29 Mar 2011 at 23:31

Buchanan0204 said:
I thought Google Mail would have been secure? No?

The problem is buddy, when if you log into your account then so can someone else theoretically.

Say I run a small blog for tech news and you signup with it. I take your email address and a password and don't store it very securely. A few weeks later someone steals that database and unlocks all the passwords in it.

They would have your email account (perhaps a gmail) and a password. If that is the same password as the one you have used for your gmail then I could just log in as you, see which other websites you have signed up with and reset all the password and wait on your gmail for those password reset emails to roll in.

Literally every password system on the web relies on a simple idea of only you knowing your password. It could be completely secure from googles security view point but a correct password is a correct password and I would be allowed in.

Using a separate password for all your logins is the safest way to go as you won't find anyone hacking your valuable accounts as all those websites will have good security (at least you would hope so).

reefoid · 30 Mar 2011 at 11:39

MikeHunt79 said:
I use a handy free little program called KeePass, no way could I remember a password like that in my head.

EDIT: There's a mac version also, look up 'KeepassX'

+1, also use KeePass to generate and store all of my passwords. Windows, Mac, iOS and Android versions available. Keep the password file on Dropbox and you have access everywhere.

4T5 · 30 Mar 2011 at 11:44

I've found it easy over the years to create passwords as i add to original ones creating long ones that are stuck in my brain. Years ago I started with numbers & a word but over the years more & more words are added creating one big **** of a password that i remember, Works for me. :cool:

cravin penut · 30 Mar 2011 at 11:44

i removed my credit card from the account a long time ago, if i ever want to buy anything i just buy a voucher from tescos and load it up, they can only nick £15 then not thousands!

zYx · 30 Mar 2011 at 13:05

Currently my password contains 16 characters, combination of letters with lower and upper case, some special characters and some numbers.

dubcat · 3 Apr 2011 at 08:23

4 people at work had iTunes account purchases made by hackers so far. Definitely a focussed effort by hackers. Thanks for the keepass tip. I will try that.

dubcat · 3 Apr 2011 at 08:31

I can not find keepass for iOS

KIA · 3 Apr 2011 at 12:25

zYx said:
Currently my password contains 16 characters, combination of letters with lower and upper case, some special characters and some numbers.

Not going to help you if you're phished/key logged again.

MikeHunt79 · 3 Apr 2011 at 15:52

dubcat said:
I can not find keepass for iOS

http://itunes.apple.com/us/app/ikeepass/id299697688?mt=8

roachyuk · 14 Jun 2011 at 18:13

Ive just had the same problem and ive come to the conclusion apple are keeping quiet about this ...at least sony came out and said something.

e36Adz · 14 Jun 2011 at 21:33

I just remove my card details from my account instead. If someone does hack into my account they can't really buy anything anyway since no card details are held on there. Secondly and most importantly, it stops me buying random silly apps! If I do find a particular app I want to buy, I just put my card details in, buy it, then remove them again.

Rameses · 15 Jun 2011 at 00:46

EVH said:
I use 1Password for every site. I already know my Dropbox now though, curse you photographic memory!

16 characters, 2 symbols and random capitals for all sites that support them.

I use this too, couldn't cope without it, mainly cos' I can't recall the 16 characters it gives me.

BusError · 15 Jun 2011 at 07:40

For years I use a program that generate random, but pronuncable passwords; that way you eventually "learn" them as you use them, and I end up remembering quite a few now for websites/accounts I use often.
I put them all into a "vault" application I wrote many years ago that uses 4096 bits encryption, because, well, I don't necessarily trust a third party developer to keep all my password either ;-)

Example password I generate (with the phonetics) AgadFequean9 (Ag-ad-Fe-quean-NINE)

Marky · 15 Jun 2011 at 09:17

I've been using 1Password on a trial for a few days now and love it

I'd love to change all my passwords to a 16 character generated password BUT...

What happens when you're using someone elses computer and you need to login? Obviously - there is no way I'm going to remember 16 characters... What do you guys do?

Macro · 17 Jun 2011 at 23:18

KeePass downloads (for iOS/OSX amongst others) here http://keepass.info/download.html

Brian8bit · 17 Jun 2011 at 23:42

Marky said:
I've been using 1Password on a trial for a few days now and love it I'd love to change all my passwords to a 16 character generated password BUT...

What happens when you're using someone elses computer and you need to login? Obviously - there is no way I'm going to remember 16 characters... What do you guys do?

Use memorable passwords and then variations of them.

So for example, maybe you want a secure 16 digit password for your online shops. Use the lyrics for a song, a date, the name of a pet, punctuation and case sensitivity.

Song lyrics: There is a house in New Orleans (house of the rising sun).
Date: 1066
Pet: Doug
Punctuation: !#)
Case sensitivity

and you get = TiaHiNO66!#)dOug

For other online stores use variations of the above. Example: dOug)#!66TiaHiNO and so on so forth. Keep the password the same, just mix and mash the order. The password is always the same so it's drilled into your head. Only the order changes.

For less important passwords, use a shorter string with a similar scheme and mix and mash. Use them enough and you'll retain them like phone numbers.

At least that's what I do. I have a 12 string password for my online shops (which is about 8 - 10 stores) and use variations of the same string. For less important logins, like this forum, a junk email account and twitter stuff, I use a longer string, but it's simpler and doesn't use case sensitivity.

Feek · 17 Jun 2011 at 23:54

Marky said:
I've been using 1Password on a trial for a few days now and love it I'd love to change all my passwords to a 16 character generated password BUT...

What happens when you're using someone elses computer and you need to login? Obviously - there is no way I'm going to remember 16 characters... What do you guys do?

I carry my iPhone which has the 1password app so I can look up the passwords there or I log onto my dropbox using the web interface and there's a 1password front end there as well.