Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

31–40 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#31

Post by jsjohnst »

niftich wrote: post #14

> August 2013 > hashed passwords (using MD5) I don't even know what to say. > investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies How is this possible? Aren't most auth cookies just a session ID that can be used to lo…

1) As Yahoo "upgraded" all password storage in UDB (where all login / registration details are stored) to be bcrypt before 2013, I'm curious how this was possible.

2) Yahoo doesn't use a centralized session storage. If you know a few values (not disclosing the exact ones) from the UDB, it's theoretically (guess not so theoretical now) possible to create forged cookies if you steal the signing keys. To my knowledge, the keys were supposed to only be on edit/login boxes (but it's been a while so I may be forgetting something), so this is a pretty big breach.

Re: Yahoo discloses hack of 1B accounts

#32

Post by ben174 »

serf wrote: post #21
ben174 wrote: post #15

This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.

honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?

Back in 2013 I wasn't using the password generator feature for some reason. I was just using it as a vault for my memorized passwords. A bit silly I realize and now generate passwords.

Re: Yahoo discloses hack of 1B accounts

#33

Post by ocdtrekkie »

jonathantm wrote: post #17
NoPiece wrote: post #9

Earlier quoted context omitted.

I hope everyone stops relying on security questions!

What is your mother's maiden name? T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

But when the security question answers are leaked in plain text, they can still use it to get into your account.

Re: Yahoo discloses hack of 1B accounts

#35

Post by loader »

ponco wrote: post #28

I almost hope the data is made somewhat public so Troy / https://haveibeenpwned.com/ can get a hold of it and provide the public with reassurance.

That was my first thought. I used to have a Yahoo email and I'm assuming at this point (multiple hacks), it's out in the wild.

Re: Yahoo discloses hack of 1B accounts

#36

Post by camus2 »

xanadohnt wrote: post #29
niftich wrote: post #14

> August 2013 > hashed passwords (using MD5) I don't even know what to say. > investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies How is this possible? Aren't most auth cookies just a session ID that can be used to lo…

Web tokens, for example, don't necessarily include just a session ID. Some include the full session details within its payload. This can be quite useful, actually, because it offloads session-lookup onto the client.

How do you invalidate a JWT server-side without the user interacting with the server ?

Re: Yahoo discloses hack of 1B accounts

#38

Post by obmelvin »

harigov wrote: post #3

I hope they stopped depending upon those security questions if that is part of the leak. On a side note, this seems like a great time to be an abuser. One can collect so much information about users - they may actually have more data than any govt in the world.

Did you catch this?

"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies."

While I agree with your sentiment towards security questions, they are irrelevant when something like that is done. A bit scary.

Re: Yahoo discloses hack of 1B accounts

#40

Post by [deleted] »

serf wrote: post #21
ben174 wrote: post #15

This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.

honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?

[deleted]
Post reply on HN