Talk Talk

[Smokin Joe]

I switched to PlusNet 12 months ago, thank God -

http://www.telegraph.co.uk/news/ukn...-network-hit-by-significant-cyber-attack.html

 

[Paulus]

I switched to BT last december fortunately. Would various details still be held by Talk Talk though?

 

[martint235]

I switched to PlusNet 12 months ago, thank God -

http://www.telegraph.co.uk/news/ukn...-network-hit-by-significant-cyber-attack.html

I switched to BT last december fortunately. Would various details still be held by Talk Talk though?

I would have thought all your details are still in their customer database unless you've asked for them to be removed. When you leave, they will probably just update a flag so as not to bill you but the details will be retained for marketing and in case you decide to go back to them

 

[Inertia]

Aye, I would assume whatever details you had with them are still compromised. I know someone who at least a year after they left, was still able to log into their taltalk account.

 

[Fubar]

Listening to the radio I did find it a tad ironic that a company called Talk Talk were emailing all their customers to inform them of the breach...

 

[Tin Pot]

It's not verified as to what has been breached, if you look at the language being used they are basically not ruling anything out.

 

[Tin Pot]

Listening to the radio I did find it a tad ironic that a company called Talk Talk were emailing all their customers to inform them of the breach...

Indeed - companies using email to contact you are encouraging phishing attacks, because they are normalising this kind of contact.

You will likely see a follow up attack where everyone receives emails apparently from Talk Talk telling them about the breach and suggesting they change their log in details "by clicking this link"....

 

[Inertia]

Indeed - companies using email to contact you are encouraging phishing attacks, because they are normalising this kind of contact.

To be fair there is no way to contact you which fraudsters don't use also. What they shouldn't do is include links to click on in their emails because normalising that is a real problem. They should direct you to their website and channel you from there to the correct area.

 

[Rooster1]

I was going to switch, but didn't. Who is to say the hack does not contain past customer info ?
What has annoyed me the most is the instruction to change your account password, followed by the fact the account section is offline!

 

[mjr]

To be fair there is no way to contact you which fraudsters don't use also. What they shouldn't do is include links to click on in their emails because normalising that is a real problem. They should direct you to their website and channel you from there to the correct area.

Which will encourage loads more typosquatters and DNS hijack attempts and so on.

The silly fools should send you emails signed with a certificate with massive peer-to-peer verification but very few organisations do that yet. Even the certificates used for Transport Layer Security (secure web sites, email transfer and so on) are mostly reliant on an oligopoly of choke/attack points, some of which have failed in the past and issued or trusted certificates that were fraudulent.

 

[vernon]

My thoughts exactly.

While demonstrating technical savvy it fails to communicate it in a manner understood by pie eaters.

 

[Inertia]

Which will encourage loads more typosquatters and DNS hijack attempts and so on.

Well that happens anyway but most people use Google instead of using the address bar to enter addresses.

Google mail is pretty good about spotting these kinds of mails and alerting you to the fact or dumping them in spam automatically.

 

[Inertia]

Yes, we need a helping hand occasionally

Best advice is to not trust unsolicited emails, phone calls or letters and assume they are all fraudsters.
If you are unsure contact your bank by phone yourself.

 

[mjr]

While demonstrating technical savvy it fails to communicate it in a manner understood by pie eaters.

How about a short summary of: emails should be signed like this:

View: https://www.youtube.com/watch?v=UcVECaJgN-A

And we should all be able to choose which public keys we trust, but at the moment, the most common system has a limited number of keycutters (Certificate Authorities), some of whom have been caught cutting keys for the bad people, whereas alternative systems (web of trust and so on) have been slow to catch on because the top keycutters probably wouldn't make as much money and few tech-savvy people are explaining how the system works at all (not only to pie eaters) or making it easier to use.

The oligarchies that affect security are some of the internet's most shameful things.

 

[mjr]

Google mail is pretty good about spotting these kinds of mails and alerting you to the fact or dumping them in spam automatically.

Google's algorithm fails both ways, both by failing to spot new frauds and by labelling some genuine messages as fraudulent. It is nowhere near as good as signed emails.