Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

21–30 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#21

Post by serf »

ben174 wrote: post #15

This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.

honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?

Re: Yahoo discloses hack of 1B accounts

#23

Post by moo360 »

jonathantm wrote: post #17
NoPiece wrote: post #9

Earlier quoted context omitted.

I hope everyone stops relying on security questions!

What is your mother's maiden name? T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

Of the Greenwich T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl's ?

Re: Yahoo discloses hack of 1B accounts

#24

Post by ausjke »

I'm speechless.

More and more are migrating to cloud these days, I expect more and more epidemic leakage will come.

I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is dying from what I read)...

Re: Yahoo discloses hack of 1B accounts

#25

Post by Klathmon »

jonathantm wrote: post #17
NoPiece wrote: post #9

Earlier quoted context omitted.

I hope everyone stops relying on security questions!

What is your mother's maiden name? T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

Which only works until you call in asking for a password reset and when they ask you the question you just say "I just hit the keyboard a bunch".

Re: Yahoo discloses hack of 1B accounts

#26

Post by camus2 »

Notice that this is yet ANOTHER hack, not the one HN was talking about a few month ago. also notice they were still using MD5 passwords AND without salts ... None of these hacks have been disclosed directly to their users, I never got an email saying I may have been hacked and I should reset my password, irresponsible.

Re: Yahoo discloses hack of 1B accounts

#27

Post by mtgx »

fname wrote: post #7

Maybe that can get Verizon another $1B discount.

I'm hoping Verizon kills the deal. It would send a powerful message (unintentional on Verizon's part, but irrelevant) that a major data breach + installing NSA's rootkit on your servers could one day cost you billions of dollars, as well as give you a forever tainted reputation.

https://motherboard.vice.com/read/yahoo-government-email-sca...

Re: Yahoo discloses hack of 1B accounts

#29

Post by xanadohnt »

niftich wrote: post #14

> August 2013 > hashed passwords (using MD5) I don't even know what to say. > investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies How is this possible? Aren't most auth cookies just a session ID that can be used to lo…

Web tokens, for example, don't necessarily include just a session ID. Some include the full session details within its payload. This can be quite useful, actually, because it offloads session-lookup onto the client.
Post reply on HN