Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Important Message About Yahoo User Security

yahoo.tumblr.com

Post reply on HN
Print view View original

31–40 of 356 posts

Re: An Important Message About Yahoo User Security

#31

Post by newscracker »

jeremyt wrote: post #22
newscracker wrote: post #5

Moving email addresses out from one provider and creating another one is more difficult than moving phone numbers (in the latter case, number portability could help, if available). What exactly can an average/common end user do for such incidents, even if it is to avoid them in the future? I use different passwords across accounts, with all of them being somewhat complex or very complex. I have looked at a few differ…

Try protonmail

Thanks. I've looked at it before and like the privacy part very much. But it's quite expensive for my needs since I would have to get a few ProtonMail Plus accounts, taking the cost to a couple of hundred dollars a year or more.

Re: An Important Message About Yahoo User Security

#32

Post by cylo »

godzillabrennus wrote: post #28
marco1 wrote: post #18

Earlier quoted context omitted.

Moving to a new email address (and taking all your existing mails with you to the new inbox) is actually far easier than changing phone numbers. Almost all (old) providers let you set up a mail forwarding (to the new provider). But even better, several services let you set up some fetchmail-like program where it imports all the messages from the old provider, e.g. via POP3 or IMAP, and even deletes them with the old…

FastMail has working tech but customer service leaves a lot to be desired. Google is leagues ahead of them there. It's better than Office365 support though.

My experience has been entirely the opposite of yours. Fastmail has excellent (and personal) customer service whereas getting ahold of someone at Google is nearly impossible.

Re: An Important Message About Yahoo User Security

#33

Post by tunap »

willow9886 wrote: post #27

Yahoo's login experience has been horrible lately. This must be a contributing factor.

Create a bookmark to your inbox when logged in. Next time you log-in, immediately click your inbox bookmark so you can skip all the irritating "give us your phone number or you will suffer greatly" pages.

As for personal info, don't give it to them. Anyone who doesn't require it by law gets mis-info, this has served my privacy & security since the turn of the century. EVERYONE wants your phone number "for security" these days* , and yet, when they bungle their security yours goes out the window with a million+ others'.

*Your phone number is marketing gold to those who believe they value your personal, identifiable data more than you do.

edit: more asterisks, less italics

Re: An Important Message About Yahoo User Security

#34

Post by contingencies »

guessmyname wrote: post #20
heroiccyber wrote: post #8

You can verify if your credentials have been compromised at https://heroic.com

Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application…

I don't use OO when I write PHP but it seems the real vulnerability there is the use of eval(). There is almost never a legitimate use for that function. I would definitely draw in to question the wisdom of OWASP deciding to classify this as a separate vulnerability. You should use the disable_functions directive in php.ini to hard-disable eval() (and other iffy functions) on production servers. One tutorial @ http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpi...

Re: An Important Message About Yahoo User Security

#35

Post by honkhonkpants »

heroiccyber wrote: post #15
FT_intern wrote: post #11

Earlier quoted context omitted.

Is your service any better than haveibeenpwned.com ?

HIBP is a great service and was the first one on the scene. HEROIC has more breached records than HIBP and with a free account on HEROIC you can see more details about how you have been compromised along with better search capabilities.

But apparently not a strict superset of HIBP, since your site shows nothing for an address that I know was exposed in multiple hacks/leaks.

Re: An Important Message About Yahoo User Security

#38

Post by newscracker »

Sami_Lehtinen wrote: post #26
jeremyt wrote: post #22

Earlier quoted context omitted.

Try protonmail

Why not Tutanota?

Thanks so much for pointing this out. I had never heard of it before and had a look. It looks good and has a team whose values I identify with. What's more, it has flexibility in billing that looks quite attractive (users, storage, aliases, etc.).

Unfortunately, it does not support IMAP or POP, which I prefer just to have local copies of mails as a backup.

A paid account looks appropriate (and would help the company stays in business), but it's a bit pricey for my needs (though not as much as other providers who don't have a lot of flexibility on users/storage/aliases).

I will try the free account to experience it firsthand.

Re: An Important Message About Yahoo User Security

#39

Post by mschuster91 »

contingencies wrote: post #34
guessmyname wrote: post #20

Earlier quoted context omitted.

Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application…

I don't use OO when I write PHP but it seems the real vulnerability there is the use of eval() . There is almost never a legitimate use for that function. I would definitely draw in to question the wisdom of OWASP deciding to classify this as a separate vulnerability. You should use the disable_functions directive in php.ini to hard-disable eval() (and other iffy functions) on production servers. One tutorial @ http:…

This tutorial disables curl_exec. Good luck getting any popular API client to work, they all use cURL... or if you're lucky, a modern-enough version of Guzzle that can use socket connections, but LOL that's opening another can of worms...

HTTP parsing is notoriously difficult and I'd rather trust cURL (which is battle-tested in a load of environments) than a PHP userspace library.

Re: An Important Message About Yahoo User Security

#40

Post by newscracker »

heroiccyber wrote: post #8

You can verify if your credentials have been compromised at https://heroic.com

For me it shows almost the same information as haveibeenpwned.com. How would someone find out about the breach that this post/article is referring to? Are you loading this one soon?
Post reply on HN