Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

11–20 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#11

Post by alyandon »

"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies."

So that exactly explains how my Yahoo account was used to send spam despite having a password that can't be reasonably brute forced (despite them using MD5). :-/

Re: Yahoo discloses hack of 1B accounts

#14

Post by niftich »

> August 2013

> hashed passwords (using MD5)

I don't even know what to say.

> investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies

How is this possible? Aren't most auth cookies just a session ID that can be used to look up a server-side session? Did they not use random, unpredictable, non-sequential session IDs?

Re: Yahoo discloses hack of 1B accounts

#15

Post by ben174 »

This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.

Re: Yahoo discloses hack of 1B accounts

#16

Post by chillydawg »

kuschku wrote: post #12
chillydawg wrote: post #5

Earlier quoted context omitted.

Bloody hell. Sloppy and incompetent.

[deleted]

No, sorry. They're borderline criminally negligent. When you have 1bn passwords stored in raw md5, a decade after the first rainbow tables were published, then you don't deserve anyone's business or your freedom.

Re: Yahoo discloses hack of 1B accounts

#17

Post by jonathantm »

NoPiece wrote: post #9
harigov wrote: post #3

I hope they stopped depending upon those security questions if that is part of the leak. On a side note, this seems like a great time to be an abuser. One can collect so much information about users - they may actually have more data than any govt in the world.

I hope everyone stops relying on security questions!

What is your mother's maiden name?

T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

Re: Yahoo discloses hack of 1B accounts

#18

Post by hbosch »

So, the scuttlebutt last time was that they disclosed the hack due to a potential Verizon buyout forcing their hand. Seems as though this could be the same thing, generally speaking.

Can anyone enlighten me as to how Verizon compels Yahoo to disclose this information? Or rather, how does Verizon know about these intrusions, if they do?

Re: Yahoo discloses hack of 1B accounts

#20

Post by camus2 »

kuschku wrote: post #12
chillydawg wrote: post #5

Earlier quoted context omitted.

Bloody hell. Sloppy and incompetent.

[deleted]

> Sure, SHA1, scrypt or bcrypt with salt were already common back then, but it's an entirely different story than if they had used it today.

Not an excuse, this is Yahoo, not a PHP shop in India doing some low budget contracting.They should have a top of the line security team enforcing the most recent secure practices. Furthermore I got no email from Yahoo telling me that my account may have been hacked. Both incompetent and irresponsible at the same time.

By the way I did some PHP dev back in 2011. bcrypt hashing was already common practice. How can you come up with that argument in good faith ?

Post reply on HN