For a long time I've had the AIM screenname blizzard.
Pretty cool. No numbers after it, no strange combinations of
words, just a simple noun. Recently someone managed to change my
password. Then they tried to change the email address associated
with the account. For the record, the email that you get that
from AOL saying that someone is trying to change the email address
on an account is quite possibly one of the worst I've seen. All
you get is this:
From: Netscape Registration To: blizzard@mozilla.org Subject: Email address change request Dear User, blizzard has asked to change the email address from blizzard@mozilla.org to bliz@daveklear.cjb.net for the following screenname: blizzard If you DO NOT wish to make this change, please reply to this email and type 'OK'. You have 72 hours in which to reply. Thank you, Netscape Registration http://home.netscape.com/
Note the paragraph here: “If you DO NOT wish to make this
change, please reply to this email and type 'OK'. You have 72
hours in which to reply.”
- You reply to this email to reject an action with a positive
assertion. “If you do not want me to do it, say 'yes'.” - If you don't check your email every three days someone can
change the email address on your account. The lesson learned:
don't go on vacation!
So I rejected the email address change and changed the email
address to my personal address. I was able to change the password
for the account to something else but eventually that password
stopped working without explaination. Trying to change it online
using the web form results in this very strange javascript alert
that just says
The service you are trying to reach is temporarily unavailable
– please try your request again.
And now, no one can find me. Thanks, AOL! Easy to use, indeed!
-
AIM runs in cleartext. If you ever logged in on the wireless at a hotel or public event, other people on the wireless can sniff your password quite easily. That’s one of the reasons I like the Jabber protocol; it supports SSL.
Comments are now closed.


2 comments