Sarah Palin’s email account was “hacked” when some kid reset her password. \u00a0 All it took was correctly answering a challenge question, one that a trivial amount of research turned up.<\/p>\n
Challenge questions are not there to make your account more secure – they are there to save the email provider from employing humans to reset passwords.<\/p>\n
Apple has just released a new free Podcast app I want to install. \u00a0 It now refuses to install the app until I set up password reset challenge questions.<\/p>\n
Ok fine. \u00a0But like the stupid things many banks do, they don’t just suggest questions – they force you to answer their list of questions – not only weakening the security of other accounts that might work from similar questions.<\/p>\n
The purpose of an iTune account is it is where you buy songs and apps. \u00a0It’s connected to your bank account so that your children playing innocent looking games can loot your bank account buying clothes and pink unicorns in some make believe world.<\/p>\n
Here is the list of questions Apple forces you to answer. \u00a0How many of these could your parents, siblings or children answer?<\/p>\n
There is no provision for making up your own question like “Do you think Steve Jobs was gay?”<\/p>\n
If you provide an email account, they’ll even send that email account the answers to these questions.<\/p>\n
Today, to “break into” my iTunes account (for what purpose?), you would have to know the email account I used, break that password, then break my current iTunes password.\u00a0\u00a0 If you already have control of my email account, the password recovery will quickly hand over what you need to take over my iTunes account.\u00a0\u00a0 My iTunes account is secure today specifically because I do NOT allow my password to be reset.\u00a0\u00a0 If I have a stroke and become a vegetable and can’t remember how to find my password for this account, well, updating my iPhone apps is the least of my worries.<\/p>\n
I wouldn’t be writing about this except that now it is FORCING me to set this up to “ensure the security of my Apple ID” which I have refused to do.<\/p>\n
The subtext of all of this is probably – an increasing problem being faced is that when a person dies, their relatives are unable to get access to their email account archives (thank God!) and have trouble unwinding things like online subscriptions.\u00a0\u00a0\u00a0 An ISP won’t turn over control unless the relative provides a death certificate and proof they are acting as the executor of the estate.\u00a0\u00a0\u00a0 It’s so much easier if your sister just happens to know where your parents met, and they’re “in”.\u00a0 No paperwork.<\/p>\n","protected":false},"excerpt":{"rendered":"
Sarah Palin’s email account was “hacked” when some kid reset her password. \u00a0 All it took was correctly answering a challenge question, one that a trivial amount of research turned up. Challenge questions are not there to make your account … Continue reading