The weakest link by far is Apple
How is Apple the weakest link in this? According to Honan's account, Amazon was as equally, if not more weak in its verification processes:<p><a href="http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/" rel="nofollow">http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...</a><p>> <i>First you call Amazon and tell them you are the account holder, and want to add a credit card number to the account. All you need is the name on the account, an associated e-mail address, and the billing address. Amazon then allows you to input a new credit card. (Wired used a bogus credit card number from a website that generates fake card numbers that conform with the industry’s published self-check algorithm.) Then you hang up.</i><p>> <i>Next you call back, and tell Amazon that you’ve lost access to your account. Upon providing a name, billing address, and the new credit card number you gave the company on the prior call, Amazon will allow you to add a new e-mail address to the account. From here, you go to the Amazon website, and send a password reset to the new e-mail account. This allows you to see all the credit cards on file for the account — not the complete numbers, just the last four digits. But, as we know, Apple only needs those last four digits. We asked Amazon to comment on its security policy, but didn’t have anything to share by press time.</i><p>At least to get into the Apple account, you need the credit card on file. For Amazon, you can <i>send a fabricated credit card number</i> and get complete access (because you can add a new email account, to which you send a password reset to).<p>Apple just seems like the worser player because Mat Honan put so much power into the hands of iCloud. If Honan was in charge of administering enterprise services using Amazon's EC2 services, and hackers used his account to wipe out everything (or compromise corporate security), everyone would be calling out Amazon.<p><i></i>Edit: I haven't seen this fact mentioned much, but Honan's billing address was compromised through a WHOIS lookup on his domain. This is a huge reason to use registry protection services. It's true someone could look you up using things like Pipl and Spokeo, but that's only if you have something in public records, such as a mortgage (or, in some cases, leases).<p>Honan is in an especially tough situation because of the uniqueness of his real name.