Earlier this week, a commenter named Y. Woodman Brown posted his online passwords in the Washington Post comments section to show just how little his online security mattered to him. It was quickly picked up by the press as an example of online security hubris. Naturally, we had to find him. Alex talks to Y. Woodman Brown and the person who hijacked his Twitter account after the passwords were posted.
Alex Goldman: On Monday, someone who calls themselves Y. Woodman Brown left this comment on a Washington post article about the Heartbleed bug. Quote:
“I couldn't give a flying fig about the Heartbleed thingamajig. Two years already the thing has been running loose ... and not a word of someone crying over its damage. Say ... does anyone really know its origin? Russian crackers? Seattle high-schoolers? the NSA? Yahoo's marketing department?
Read all the eMail I have. Sneak into my WaPo, NYT or CNN accounts and go crazy making comments in my name. Break-into my Facebook or Twitter profiles and change my hometown to Gas City Indiana, swap-out my avatar with a picture of your nads, make friends with people I don't know.”
He then posted two passwords he uses across most of his online presence. Other posters warned him that this was probably not the brightest idea and The Washington Post quickly remove the comment, but it’s really not difficult to figure out what happened next. Within hours, people had gotten control of his deviantart account, his facebook, his tumblr and his wordpress blog. The person who took control of his twitter account changed his location to “Gas City, Indiana” Washington Post writer Brian Fung made an article out Y Woodman Brown’s comment, using it as a cautionary tale on internet security hubris.
I knew I had to get in touch with him, but I didn’t really know where to begin. Online, Y. Woodman Brown is a bit of a cypher. He has a robust online presence, leaving comments all over the place - on sports sites, on political sites, on huffington post and of course the washington post. But there’s barely any information about who he actually is on the internet, and try as I might, I couldn’t find an email address. So I tried getting in touch with the folks I knew would be most likely to have his contact information. The people who hijacked his accounts.
Katie : Hello?
Alex Goldman: This is Alex. How are you doing?
Katie: Good! How are you doing?
This is Katie. She is now in control of Woodman Brown’s Twitter account. I don’t know anything about her other than that she’s a college student, and she thinks this is all very funny.
Katie: All I did was take someone’s password and log into their account and take their twitter. I guess if you want to interview me for that, that’s awesome.
Alex Goldman: If you could do me a favor - could you tell me how you found out about Woodman Brown?
Katie: Yeah, so everyone’s heard of the whole heartbleed bug thing, so I typed it into google and I found a news article on it, and I was looking at the comments because comments are always pretty amusing to look at and there was one that stood out. This guy who was like “all you americans are so paranoid, everyone’s freaking out!” and ok, I understand that, but then he did this thing where he put his passwords on, on his comment and said “hey, come hack me or whatever.” You know, hacking, or whatever it is. So I was like “that’s not real, but I’m just gonna try it.” And I tried it and it worked! I mean this guy doesn’t use his twitter ever, but it goes back to 2012 I think, and well I guess I’d rather take it and post stupid things on it than have someone take it and ruin this guy’s life. Because of course he doesn’t deserve that.
Alex Goldman: So in a way, you’re like a benevolent thief.
Katie: I guess so. That fits me pretty well, I guess. A benevolent thief.
Alex Goldman: Whats your plan for this - are you going to hang onto it forever? Are you ever going to post on it again?
Katie: Well what I wanted to do last night this is what I thought of, and I’m still working on it, but was to take song lyrics - song lyrics everyone knows and modify them about taking a twitter, taking passwords, and just post a new one every day.
Alex Goldman: Do you have any ideas so far?
Katie: Well the first one should be from My Heart Will Go On, because that’s a great song. That’s a fantastic song. C’mon!
Alex Goldman: So one of the things I wanted to do as part of this is get in touch with Woodman Brown, but I have no idea how to contact him. So I’m curious if since you have the keys to his twitter account -- do you know how I could get in touch with him?
Katie: I can give you his email, but I’m guessing it’s been compromised. I think most of his stuff has been compromised.
Alex Goldman: If you could give me his email, that would be amazing. In my perfect world, in my dream, the way that this story ends is with me finding Y woodman brown. And in a double extra perfect world, Y Woodman Brown will say “I’m totally unrepentant about this. I totally don’t regret having done this, I think it was a great idea.
Katie: Yes, oh my god, that’d be hilarious. I hope he just responds with “YOLO”
Alex Goldman: Katie passed along an email address, and I sent an email that began “Dear person who has probably taken over Y Woodman Brown’s Email Account,” in the hopes that they could lead me to the man himself. So I was surprised when I got this email back:
Nobody took-over my account. That's my point. Real criminals aren't out there hijacking Gmail accounts. Only pranksters--and only when you freaking invite them...otherwise, you're perfectly safe.
And that is how I met Woody Brown.
Woody Brown: In the olden days, nobody even locked their front doors, not in the neighborhood I grew up in. And the choice is either live behind the locked door or don’t. And for me freedom is choosing not to live behind the locked door.
Alex Goldman: You know, I think that the way that this story was told on an internet was sort of an idiot who posted his password and got his comeuppance. Does it bother you that that’s the way that that story was told?
Woody Brown: I expect it. It’s the conventional view. I suppose I did get my comeuppance if you consider that somebody then walked into my accounts on Facebook and added an extra page that said “boy are you stupid.” I don’t know. I’m inviting you in. I don’t think that some Russian mob guy that invents something like the heartbleed bug is going to waste his time looking for my money. I think he’s after bigger fish to fry. I think what I’m risking is teenage pranks - ha ha ha I tagged your account - and what does that amount to?
Alex Goldman: But you know, you exist online as Y Woodman Brown, which is your real name. And when I found your name, I looked all over the internet, and I found comments by you and you gave people the keys to write on the internet as you. Weren’t you concerned about your reputation as Y. Woodman Brown?
Woody Brown: Uh...no, I guess not. I guess not. I suppose if Y. Woodman Brown was actually somebody in this world, I might have thought twice, but since I’m just your average joe, that didn’t occur to me.
Alex Goldman: I’m actually curious, if you don’t mind telling me, I found your presence all over the internet, but there’s very little on it about you. It’s mostly you commenting on things. And I was curious who you are. Not, you know, your address, but where you live and sort of what you do.
Woody Brown: Uh…
Alex Goldman: You don’t have to tell me if you don’t want to.
Woody Brown: No that’s ok. I’m just a technical writer?
Alex Goldman: And what do you do with your free time?
Woody Brown: What do I do with my free time? Oh…
Alex Goldman: I’m so interested in the person who gave his passwords on Washington Post. I just think that it takes a level of bravery that I couldn’t begin to muster. I think what you did was so corageous, even though to you it just seemed like an act of...defiance, maybe?
Woody Brown: I guess during most of life, I’m a low-risk guy because you won’t find me bungee jumping, and you won’t find me doing clips that show up on Tosh.O. Believe me, I’m not daring enough to try that stuff and risk a Tosh-worthy accident. I think I know what you mean about bravery. There was this movie that came out - I don’t know how old you would have been, how long ago was it? Good Morning Vietnam.”
Alex Goldman: Oh, I remember that, it was from the late 80’s I think.
Woody Brown: So the moment that defines the movie actually is there’s where Robin Williams is teaching English as a second language to a group of people. He’s talking to an elderly man, and he’s saying to this elderly man “I’m attacking you! I have a spoon and I’m attacking you with my spoon! What do you do?” So he says “I’m sitting here. I do nothing.” And Robin Williams says “well I’m coming after you, I’ve got my spoon, I’m going for you, I’m about to kill you!” and the man said something like “then I am dying.
What he’s saying is “I subscribe to peace. So if you truly have the incivility to attack me to the point of death, then what I’m doing is, I’m dying. Real bravery is staying to committed to your principles even if it means your own death. That’s quite extreme. I’m not sure that I’m that far along, but I understand the theory.
Alex Goldman: Wow. You took me on a real journey with that answer. Now comes the confession period of this discussion. The way I found your email address is that I actually reached out to the person who hijacked your twitter account.
Woody Brown: Oh that’s ok. You don’t get to be 53, and put your password on the washington post and not expect that something is going to happen.