Skip to content

They Hacked Me

2019-10-18 · letter vlog · Hank · 3:46 · watch on YouTube

Topic: Internet & YouTube (also: Personal life) · mode: Advice & reviews · tags: civic or action cta

After hackers got into a couple of his accounts using an old reused password, Hank argues hacking is inevitable, urges viewers to check haveibeenpwned.com, use a password manager and turn on two-factor authentication, and demands that internet companies, or politicians, provide better security tools.

What is said

The parts of the video and what is said in each (★ — how much it matters to the video).

00:00:00 — Hank's hack: a reply to an email he never sent, and an old compromised password tried across his accounts

  • ★★★ On Sunday, putting Orin to bed, Hank got a reply to an email he hadn't sent; he handed Orin to Katherine and found no unknown devices logged into his Google account. — 00:00:00 · Orin Green, Katherine Green, Google
  • ★★ The email had been sent from inside the help desk of an app Hank hadn't logged into for years. — 00:00:00
  • ★★★ Hackers tried dozens of Hank's accounts with an old compromised password still used on some platforms, and got into a couple of places. — 00:00:29
  • ★★ Hank says they got in not through sophisticated programs but because he was lax: they tried his old passwords with his email addresses elsewhere, and it worked. — 00:00:29

00:00:58 — Hacking is inevitable: dark breaches like Yahoo's, and why password managers matter

  • ★★ The hackers didn't seem to get into anything very important, but it is hard to tell. (hedged) — 00:00:58

  • ★★ When Hank said he had dodged a bullet, a friend who is a security consultant told him he had been grazed and more are coming. — 00:00:58

    “you didn't dodge it, you got grazed, and there are more coming.”

  • ★★★ Hank says hacking is inevitable. — 00:00:58

  • ★★ Hank asked on Twitter: 30-something percent said they had never been hacked, so most people have been. — 00:00:58 · Twitter
  • ★★ Hank says most of those who think they were never hacked probably have been without knowing it. (hedged) — 00:00:58
  • ★★ Hank says there are dark breaches: Yahoo had billions of accounts leaked and didn't notice for years. — 00:01:27
  • ★★ Hank says other platforms might have been hacked without anyone knowing, and those passwords are on sale. (hedged) — 00:01:27
  • ★★★ Hank says using a password manager is very important; he uses LastPass, and all are better than none, mainly because they allow a unique password for every account. — 00:01:27
  • ★★ The hack was very stressful mostly because Hank long didn't know, and still doesn't, how much the hackers accessed; checking all his passwords took days. — 00:01:57
  • ★★ Hank hopes his experience can be a wake-up call and a call for change, not for the individual but for society. (hedged) — 00:01:57

00:02:26 — What viewers should do: haveibeenpwned.com and a password manager

  • ★★★ Hank tells viewers to go to haveibeenpwned.com. — 00:02:26
  • ★★ Hank says his admittedly old email address has been involved in over 30 data breaches. — 00:02:26
  • ★★★ Hank tells viewers they must use a password manager, or they will have duplicate and weak passwords; moving all accounts in will probably take hours. — 00:02:26

00:02:50 — Two-factor authentication, and what companies must be forced to provide

  • ★★★ Hank tells viewers to turn on two-factor authentication, less convenient as it is, for every account with important data or financial information. — 00:02:50
  • ★★★ Hank says companies must be forced to offer two-factor authentication not based on unencrypted text messages. — 00:02:50
  • ★★★ Hank says companies must give convenient tools showing where we are logged in from at all times, and keep records; this is very possible but mostly not done. — 00:02:50
  • ★★★ Hank says companies must give tools showing what was done on our accounts, because knowing you were hacked is not knowing what the hackers did. — 00:03:19
  • ★★★ Hank calls on giant, wealthy internet companies to make security easier, or else on politicians to make them. — 00:03:19

In the description and comments

  • ★★ The description says not being a public person does not protect you: most hacks seek a quick buck and may wait in your email until a big financial decision, then strike. — video description
  • ★ The description thanks Sherri Davidoff of LMG Security for helping with the video and with Hank's recovery from the hack. — video description

Threads in this video

Mentioned

Central: cybercrime · multi-factor authentication · password manager

Also: People: Katherine Green · Orin Green

Organizations: Google · Have I Been Pwned · Twitter · Yahoo!

Concepts: credential stuffing · data breach

Products: LastPass

Only in the description or credits: LMG Security · Sherri Davidoff

Also centred on cybercrime: Hackers, Cyber crime, and a New Kind of War.

← Previous: I'm Having a Lot of Feelings · Next → Why We're Donating $6,500,000