The Chris Motes Blog

Secret Questions Not So Secret

Great article from my friend Vinoo on Palin's hack email account.

The short version: Secret questions used to recover lost passwords are not so secret in the social web era. Here is a quote from the alleged hacker:

"Birthday? 15 seconds on wikipedia, zip code? well she had always been from wasilla, and it only has 2 zip codes (thanks online postal service!)... “where did you meet your spouse?” did some research, and apparently she had eloped with mister palin after college, if youll look on some of the screenshits that I took and other fellow anon have so graciously put on photobucket you will see the google search for “palin eloped” or some such in one of the tabs.   

I found out later though more research that they met at high school, so I did variations of that, high, high school, eventually hit on “Wasilla high” I promptly changed the password to popcorn and took a cold shower…"

This is a high profile hack. I'd expect Yahoo! and other sites to respond to this pretty quickly with much harder secret questions.

Rules of Product Management

Requirements are never done - you'll always miss something.

Design is never perfect - you can always do better.

But projects never finish unless you set deadlines on requirements and design.

Always force yourself to run out of time.

Rules of Product Management

Not all fires need to be put out right away.

Rules of Product Management

If you can't measure the impact of a new feature, don't bother launching it.

How to get that bug count down

From Seth Levine's blog:

"From my partner, Chris Wand , describing a program one of his companies put in place over the holiday to encourage employees to clear a bunch of outstanding bugs in their backlog:Anyone that wanted to fix a bug during their holiday break could earn $50/$75/$100 (depending on the severity of the bug) for each known bug they fixed (the catch was that QA had to approve the fix). The person that fixed the most bugs also earned an additional bonus (I think it was $500). They managed to clear about 100 bugs off their list… It was so successful, they’re thinking of implementing it at other times (i.e. over a long weekend, etc.—of course making sure that they don’t set it up so people are working on the bug fixes during normal working hours). "