IM account hijacking
sigh I think somebody just hijacked by ICQ account :( That or there is something very rotten in the icq servers.
But then again, any service that does not send auth. information over SSL or equiv…. not good.
I would still like to get my account back though. Any suggestions?
Update: Aparently it was just the icq servers having serious problems. But I should still get away from non-SSL though. Google Talk and Jabber in general seems to be the solutions there.
2 Comments
Leave a comment
If you get a cert (Thawte offers free e-mail web-of-trust certs) AIM will encrypt traffic. I thought the login sequence was already encrypted though — AOL is extremely paranoid about account stealing. ICQ is also run by AOL, are you sure the auth info, as opposed to chat traffic, isn’t encrypted?
That certainly depend on the client. Some clients still use the good old “roasted password”, which is just an XOR or the password with a static array. Hurray!