Dieser ganze MIst mit hunderttausend am Besten auch verschiedenen Passwörtern, Sicherheitsfragen etc. ist nur noch nervig. Hoffentlich gibt es bald sichere und universelle biometrische Methoden, den mein Auge oder meinen Finger vergesse ich mal nicht so schnell...

Ganz abgesehen davon ist kein Support gegen geschicktes Social Engineering immun. Da empfehle ich das Buch "Die Kunst der Täuschung" von Kevin Mitnick.

... mithilfe des Apple-Support ...

[...] wobei Apple die Daten des MacBook bislang nicht wiederherstellen konnte

...durch geschicktes Herausfinden der Antworten zu den Sicherheitsfragen das Kennwort für die Apple-ID zurücksetzen.

Welchen Sinn haben verschiedene Passwörter für verschiedene Anwendungen, wenn man mit Kenntnis von einem einzigen Passwort, alle anderen lesen kann?

Wir alle werden uns sicher das eine oder andere Passwort mal aufschreiben, aber dann doch bitte nicht an einem Ort, der quasi frei zugänglich ist, wenn man die notwenige kriminelle Energie aufbringt.

Dann kann ich auch gleich überall immer dasselbe Passwort verwenden, dass ich mir dann auch nicht mehr notieren muss.

Wenn man verschiedene Paßwörter nutzt, die gemeinsam gespeichert und mit einem Master-Paßwort geschützt sind, muß immerhin schon einmal genau dieses eine Paßwort geknackt werden

Ich habe einen kleinen Karteikasten mit all meinen Passwörtern neben meinem iMac stehen. Und da kann ein Hacker so viel hacken wie er will, auf den nicht verschlüsselten Karteikasten bekommt er keinen Zugriff.

[..]
Update:
Someone claiming to be my hacker has been in touch. I can’t be at all certain of his authenticity, but he says he “didnt guess ur password or use bruteforce. i have my own guide on how to secure emails.”

As for 2 factor authentication preventing this, it would have kept my google account from being deleted, and probably kept them off of my Twitter feed, but it wouldn’t have prevented my Macbook from being wiped. That, which is the worst effect of all this so far, was possible as soon as they were able to log into iCloud. Nonetheless, I’m setting it up on my Google account once I have access to it again.

The big steps now are regaining access to my Macbook and Google. I’ve got a genius bar appointment today for the former. I’ve put in a request to un-delete the Google account. I could not, however, use my phone number to restore it. My phone is linked to my Google voice account—which was deleted along with the rest of my Google accounts—I’m not sure if that’s the reason, but I can’t send or receive text messages or phone calls now. I answered a bunch of questions about my Google account to have it restored, now I have to wait 3 to 5 days to see if that request goes through.

Do you know somebody (or are you somebody) at Google who can help me get my account back? I’d love to get in touch. On my long list of things to do today is get in touch with Sprint to see if it can help me get my phone service restored.

Finally about the comments. I’ve seen people express outrage both below and on Twitter about some of the comments this post has generated. I don’t know. Maybe I’m jaded. But after years of writing for the Web, I guess I’ve come to expect comments to be less than constructive.

Update Two:
I’ve gotten phone service restored and regained access to my Google account. Twitter should be back soon too, but that may take until Monday. The last major piece of this is my Macbook. I have a genius bar appointment today. I guess I’ll know what the damage is once I’m there.

Update Three:
I know how it was done now. Confirmed with both the hacker and Apple. It wasn’t password related. They got in via Apple tech support and some clever social engineering that let them bypass security questions. Apple has my Macbook and is trying to recover the data. I’m back in all my accounts that I know I was locked out of. Still trying to figure out where else they were.

Update Four:
I’ll be discussing this on TWiT with Leo Laporte, Ed Bott and others today live at 3 PM Pacific . I now know how it happened, basically start to finish, which I’ll explain in a story on Wired tomorrow (Monday, August 6). Apple tech support is working on recovering my data (thanks guys!) from my Macbook, but I won’t know how successful that was until Monday. According to what the told me last night, the wipe stopped (by powering down) before it got far enough along to start over-writing, so I am hopeful. Via AppleCare, I was able to confirm the hacker’s account of how he got access to my account. I have an email in to Tim Cook and Apple PR, and want to give them a chance to respond (and make changes). I want to give the company a little more time to look at its internal processes, but should be as simple as a policy change. So far, I haven’t received any acknowledgement from Apple corporate. I did, however, get an urgent call from AppleCare ten minutes after emailing Mr. Cook, informing me that my situation had been escalated and there is now only one person at Apple who can make changes to my account. So I gather corporate is aware of what happened and looking into how to most effectively respond to make sure this doesn’t happen again.

[..]
“Social engineering” is a fancy word for tricking the person on the other end to do what you want by making them believe that they are you.

Nothing can protect you from this kind of targeted attack. You ca have the best password possible, and awesome security questions, but if the hacker can convince the tech support person that they are you, they can walk past all that security.

Scary thought!

People can be tricked, but given the power that access to an iCloud gives someone — access to documents, photos, not to mention the ability to delete devices — I would expect Apple to have tighter controls over how people are allowed to bypass security questions. People do forget their passwords, and they do forget their security questions, but before allowing someone to bypass these safeguards Apple should err on the side of caution, perhaps making the person making the request jump through a number of hoops before giving them access to the account.

This high-profile hack of an iCloud account has highlighted that Apple has a weakness here, and the company needs to tighten up security and come clean about what went wrong here.

@ Peter Eckel: Warum würdest du es nicht im wörtlichen Sinne aufschreiben? Ich habe einen kleinen Karteikasten mit all meinen Passwörtern neben meinem iMac stehen. Und da kann ein Hacker so viel hacken wie er will, auf den nicht verschlüsselten Karteikasten bekommt er keinen Zugriff. Und alle, die ich in die Nähe lasse, denen Vertraue ich soweit, dass sie mir nicht alle Accounts hacken.

Ich habe einen kleinen Karteikasten mit all meinen Passwörtern neben meinem iMac stehen.

Was spricht denn eigentlich dagegen, alternativ zu 1Password, Wallet oder LittleSecrets einfach den "Schlüsselbund" in OS X zu nutzen. Bis auf den Sync und den iOS-Ablegern erfüllt es doch eine ähnliche Funktion Masterpasswort und darin alle anderen Passwörter gesichert.

[...]Synchronisieren kann man die Schlüsselbunde auch, ich weiß nur nicht, ob es ratsam ist, das im laufenden Betrieb zu machen - mit dem Verzeichnis von 1Password geht das jedenfalls problemlos per Unison.

Was spricht denn eigentlich dagegen, alternativ zu 1Password, Wallet oder LittleSecrets einfach den "Schlüsselbund" in OS X zu nutzen?

Danke. Was meinst du denn genau mit "im laufenden Betrieb"? Wo siehst du da ein Problem?

Schlüsselbund verwaltet keine SNs und Lizenzen,