An Important Message About Yahoo User Security • Hacker News Board

Re: An Important Message About Yahoo User Security

#131

Post by MichaelApproved » Thu, Sep 22, 2016, 7:42 PM UTC

rezashirazian wrote: post #76

justinv wrote: post #64

"by what it believed was a "state-sponsored actor.""

I don't understand what difference it makes if it's state-sponsored or not. It seems like Yahoo's PR wants to switch focus to state-sponsored hacking and form a narrative around what's been in the news lately as opposed to Yahoo's incompetence. Also it's less embarrassing to get hacked by a whole nation than a few nerds in their basement.

> I don't understand what difference it makes if it's state-sponsored or not.

> Also it's less embarrassing to get hacked by a whole nation than a few nerds in their basement.

Seems like you understand just fine.

Re: An Important Message About Yahoo User Security

#132

Post by elorant » Thu, Sep 22, 2016, 7:42 PM UTC

There’s one thing I don’t understand with this “state sponsored actor”. Say you are an oppressive regime and you target activists who use yahoo mail to publish your dirty laundry. Why on earth would you hack half a billion accounts just to get access to a few dozen ones? Doesn’t make sense. You attract too much attention. A thing like that would never go unnoticed. If on the other hand you’ve found some exploit and target specific accounts which are numbered in the tens, say hundreds, you can easily get away with it.

BTW, I don’t know if it’s coincidental but just yesterday I received a notification from Yahoo to disable access to Mail from third party apps.

Re: An Important Message About Yahoo User Security

#133

Post by mathattack » Thu, Sep 22, 2016, 7:42 PM UTC

nostromo wrote: post #69

"The data stolen may have included names, email addresses, telephone numbers, dates of birth and hashed passwords but may not have included unprotected passwords, payment card data or bank account information, the company said." What's the difference between "may have" and "may not have" in this context? It seems like they're saying anything could have been stolen.

Similar language to athletes denying drug rumors. "I have never knowingly taken an illegal supplement, and have never been notified of having failed a drug test."

Re: An Important Message About Yahoo User Security

#134

Post by BinaryIdiot » Thu, Sep 22, 2016, 7:44 PM UTC

kolbe wrote: post #107

nodesocket wrote: post #89

You'd think this would affect the stock price, but currently YHOO only trading down 8 cents (-0.18%). I honestly see this all the time. What sounds like really horrible news for a company, does not affect the price. Howerver, some random analyst or reporter who works at the Mercury Star Sun Inquirer writes a negative article or downgrade and the stock tanks. Doesn't make much sense.

Investors are conflicted: on the one hand, Yahoo had a data breach that will cost them trust, but on the other hand, investors are surprised to hear there are still 500 million Yahoo users.

I don't think investors are quite that stupid. First that was 500m users in 2014, not today. It also doesn't say active so it's likely some subset of a total. I wouldn't be surprised if Yahoo had even more than 500m accounts in 2014 and today but I would be SHOCKED if they had nearly that many active users.

Re: An Important Message About Yahoo User Security

#135

Post by gcp » Thu, Sep 22, 2016, 7:45 PM UTC

rezashirazian wrote: post #76

justinv wrote: post #64

"by what it believed was a "state-sponsored actor.""

I don't understand what difference it makes if it's state-sponsored or not. It seems like Yahoo's PR wants to switch focus to state-sponsored hacking and form a narrative around what's been in the news lately as opposed to Yahoo's incompetence. Also it's less embarrassing to get hacked by a whole nation than a few nerds in their basement.

A state sponsored attacker has some (easy) possibilities that are normally out of the league of a normal attacker.

Like showing up on the doorstep of a CA and asking them to issue forged SSL certificates.

This was relevant for the pinning bug that was just fixed in Firefox 49: normal users shouldn't care about it, but it's very dangerous for Tor users.

Re: An Important Message About Yahoo User Security

#136

Post by eric_h » Thu, Sep 22, 2016, 7:45 PM UTC

ActsJuvenile wrote: post #37

zymhan wrote: post #4

Does this mean Verizon would assume liability if the purchase closes before a lawsuit/fine is brought?

Verizon legal team might have forced Yahoo to disclose this in order to remove the liability before acquisition.

Very interesting point. This suggests to me that Yahoo has been sitting on this for quite some time and only revealed it when their hand was forced...

Re: An Important Message About Yahoo User Security

#137

Post by malz » Thu, Sep 22, 2016, 7:45 PM UTC

brian-armstrong wrote: post #104

pavornyoh wrote: post #85

Can anyone elaborate as to why this is being announced two years later? Why now and not when it happened?

I believe a common reason for this is that they don't want to announce it until they're completely sure the breach is gone and that they have control of things again. Announcing that it happened and that it's ongoing forces them to either cease operations or face liability.

So covering up a known in-progress security breach is standard procedure? Instead of telling your users to change their passwords and so on?

Personally, I demand criminal investigation and at least a $1000 fine per account breached.

Re: An Important Message About Yahoo User Security

#138

Post by Lewisham » Thu, Sep 22, 2016, 7:46 PM UTC

soci wrote: post #120

Wait, Yahoo believes the data was stolen by a "state-sponsored actor"! If they have such evidence, why don't they explain so? To me it looks like a tactic to put the focus on the "noughty" government instead of themselves. Anyway, it will be an interesting read (if ever written) how Yahoo discovered they had been stolen and by who (what state?). Also, if "the state" is finally behind this, who will they prosecute til…

a) Big US enterprises are under attack from state-sponsored actors on a daily basis, so it's not that weird. It's not like the NSA weren't caught with their hands in the cookie jar either.

b) If you name the state you think is behind it, you better be ready for the diplomatic repercussions between the US government and the rogue state, as well as potentially stopping doing business in that state (see Google and China)

Re: An Important Message About Yahoo User Security

#139

Post by smaili » Thu, Sep 22, 2016, 7:47 PM UTC

Anyone happen to know if this was the largest hack in history?

Re: An Important Message About Yahoo User Security

#140

Post by BinaryIdiot » Thu, Sep 22, 2016, 7:47 PM UTC

TylerE wrote: post #98

nodesocket wrote: post #89

You'd think this would affect the stock price, but currently YHOO only trading down 8 cents (-0.18%). I honestly see this all the time. What sounds like really horrible news for a company, does not affect the price. Howerver, some random analyst or reporter who works at the Mercury Star Sun Inquirer writes a negative article or downgrade and the stock tanks. Doesn't make much sense.

Yahoo has zero value as a web property. What value there is on the name and the advertising side.

> Yahoo has zero value as a web property

What!? Surely you're being flippant. Alexa currently ranks Yahoo.com as #5 worldwide and in the United States. NUMBER 5! How anyone could think that has zero value makes no sense to me.