91–100 of 356 posts
"encrypted or unencrypted security questions and answers" This is bad right? Like, worse than your hashed password and your mailing address. The only good thing is that if I ever implement security questions, I'll remember Yahoo! and how it could end up in the wrong hands.
Don't implement security questions. Those are no good to begin with.
"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.
all hacks have signatures.. usually the tools used by the hackers to compromise the system.
Can anyone elaborate as to why this is being announced two years later? Why now and not when it happened?
Earlier quoted context omitted.
for the longest time, it was unsalted MD5. it may still be. very easy to crack with a rainbow table.
"hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers" The went on to say they have unactivated all clear text security questions. Really, WTF Yahoo. Why bother hashing a pw if you are going to have plaintext security questions. Though at least they were not using MD5
If they had not hashed the passwords you would be able to login to millions of Yahoo accounts with this leaked data.
Earlier quoted context omitted.
Don't implement security questions. Those are no good to begin with.
Don't many sites require them?
Just make it something reasonably short as you might have to repeat it to a live customer service agent.
"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.
all hacks have signatures.. usually the tools used by the hackers to compromise the system.
You'd think this would affect the stock price, but currently YHOO only trading down 8 cents (-0.18%). I honestly see this all the time. What sounds like really horrible news for a company, does not affect the price. Howerver, some random analyst or reporter who works at the Mercury Star Sun Inquirer writes a negative article or downgrade and the stock tanks. Doesn't make much sense.
You'd think this would affect the stock price, but currently YHOO only trading down 8 cents (-0.18%). I honestly see this all the time. What sounds like really horrible news for a company, does not affect the price. Howerver, some random analyst or reporter who works at the Mercury Star Sun Inquirer writes a negative article or downgrade and the stock tanks. Doesn't make much sense.
You can verify if your credentials have been compromised at https://heroic.com