Live data from Hacker News

An Important Message About Yahoo User Security

yahoo.tumblr.com

61–70 of 356 posts

Re: An Important Message About Yahoo User Security

#61
post #50

Earlier quoted context omitted.

Did Google stop offering a free tier for Apps For Your Domain? I guess I missed the part about being grandfathered in.

Yes. It's now $5/month/user. (plans are grandfathered however)

You also get 1TB of storage with that, and unlimited storage with 5+ accounts. I do this for my family, and we all have unlimited backups and custom domain email.

Re: An Important Message About Yahoo User Security

#62
post #48

Earlier quoted context omitted.

Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application…

As long as I have you here... ;) I primarily write JS for a living but because I freelance I often have to work with wordpress. After spending a few weeks digging into the internals I soon realized that every single wordpress project I've inherited–paid themes included–were horrendous and failed to utilize the most basic facilities provided by core. In most of these projects a quick turnaround was more important than…

I believe this is what you're looking for: http://www.phptherightway.com/

Re: An Important Message About Yahoo User Security

#63
post #7

Moving email addresses out from one provider and creating another one is more difficult than moving phone numbers (in the latter case, number portability could help, if available). What exactly can an average/common end user do for such incidents, even if it is to avoid them in the future? I use different passwords across accounts, with all of them being somewhat complex or very complex. I have looked at a few differ…

I have had good luck with fastmail.com, but at $30/year for the entry-level option it sits in what you classify as the "expensive" category. For a dedicated service with keen developers and ongoing product development (yay U2F support), great and accessible support, reasonable expectations of privacy, it has been well worth it. YMMV, of course.

I've been using fastmail. I don't necessarily like it better than gmail, especially since I use hangouts for most of my conversations. however I outright dislike their mobile app, it won't load with no internet connection, like it doesn't cache anything. so maddening. I've been using it a few months paying $5/mo, but will likely discontinue it soon.

Re: An Important Message About Yahoo User Security

#65

using 2 Factor Authentication comes handy in situations like this.

Not necessarily. 2FA only prevents access to the account, but passwords are both hard to decrypt and easy to change so I'm not too concerned about that. The real valuable data in this hack are the names, emails addresses, DOBs, telephone numbers, and security questions. Those things are very hard to change and would be very valuable data points for anyone trying to steal your identity or social engineer themselves in other accounts of yours.

Re: An Important Message About Yahoo User Security

#67
post #14

Moving email addresses out from one provider and creating another one is more difficult than moving phone numbers (in the latter case, number portability could help, if available). What exactly can an average/common end user do for such incidents, even if it is to avoid them in the future? I use different passwords across accounts, with all of them being somewhat complex or very complex. I have looked at a few differ…

Buying a domain name is the equivalent of number portability. Recommended for everyone.

On the flip side, I did that and while generally it's been a positive experience, providing your email address over the phone has become huge pain!

I definitely took for granted how easy it is to say to someone "first initial + last name at major email provider . com", instead of "really easy first part at custom domain, wait let me give you the phonetic alphabet equivalent, no just the letter b, not actually the word bravo... . io - yes io, item oscar, it's the indian ocean. Yeah I'm sure it works"

Then pray you actually get the email.

Re: An Important Message About Yahoo User Security

#68
post #23

Anybody know what hash they use at yahoo for account passwords?

for the longest time, it was unsalted MD5. it may still be. very easy to crack with a rainbow table.

"hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers"

The went on to say they have unactivated all clear text security questions.

Really, WTF Yahoo. Why bother hashing a pw if you are going to have plaintext security questions.

Though at least they were not using MD5

Re: An Important Message About Yahoo User Security

#69
"The data stolen may have included names, email addresses, telephone numbers, dates of birth and hashed passwords but may not have included unprotected passwords, payment card data or bank account information, the company said."

What's the difference between "may have" and "may not have" in this context?

It seems like they're saying anything could have been stolen.

Re: An Important Message About Yahoo User Security

#70
post #23

Anybody know what hash they use at yahoo for account passwords?

Yahoo's announcement (link changed since some of these comments were posted) says the "vast majority" used bcrypt.

I've been getting an "Unexpected sign-in attempt" email from Yahoo every day for the last couple of weeks, but I don't see any evidence that the attempts were successful.

Post reply on HN