Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

61–70 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#61

Post by stanleydrew »

dopamean wrote: post #56
chillydawg wrote: post #5

Earlier quoted context omitted.

Bloody hell. Sloppy and incompetent.

I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.

Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade.

It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.

Re: Yahoo discloses hack of 1B accounts

#64

Post by rqebmm »

hbosch wrote: post #18

So, the scuttlebutt last time was that they disclosed the hack due to a potential Verizon buyout forcing their hand. Seems as though this could be the same thing, generally speaking. Can anyone enlighten me as to how Verizon compels Yahoo to disclose this information? Or rather, how does Verizon know about these intrusions, if they do?

It's most likely just part of the due-diligence required for the merger.

Yahoo brass probably decided that publicizing this information wasn't worth the PR hit, and so they buried it, but Verizon doesn't want to take on the risk of a potential lawsuit, so their lawyers required Yahoo to disclose it if they want the deal to go through.

Re: Yahoo discloses hack of 1B accounts

#65

Post by Forlien »

mikestew wrote: post #44
Klathmon wrote: post #25

Earlier quoted context omitted.

Which only works until you call in asking for a password reset and when they ask you the question you just say "I just hit the keyboard a bunch".

No, I pull up the answer out of 1Password and read it off to them.

I thought Klathmon was pointing out say that they an attacker could say that they just mashed on the keyboard and that would be good enough for the fallible human on the other end of the phone.

Anecdotally, I had a time where I couldn't remember may answer to a secret question except that it was a type of food. I called in and the human on the other end let me reset my password with just that explanation. Take that for what you will, but it seems like if someone knows you use passwords that are random strings, they can use that to break in.

Re: Yahoo discloses hack of 1B accounts

#67

Post by taurath »

Its scary to think about the consequences if the only reason Yahoo knew they got hacked was that they are more, and not less competent at security. Do you think the security team {insert retailer, other nontech company with a login screen here} is somehow MORE competent?

Re: Yahoo discloses hack of 1B accounts

#68

Post by noxToken »

mkhpalm wrote: post #30

Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.

You're right, but it goes beyond that.

Yahoo used to be a titan. I was a regular user of Yahooligans back in the day. Yahoo (at one time) had been my go to search engine. I can't say that it was ever my primary email account, but I used it. I used Yahoo Messenger. I was part of a community that centered around some Yahoo games. Yahoo used to be a titan that was a direct Google competitor in the realms of communication, search, news and entertainment.

Sure, I can delete an account for any service belonging to any company(!) if I want. But when you use a service, there's an explicit level of trust that they'll protect your information to the best of their ability. We assume that we can use their services as our primary driver without worrying about MD5 hashes without salt. We assume that they'll take more security procedures than a student making a toy app testing boundaries in a 400-level course.

Sure, we can delete our account, but this is an unnerving situation. It's not like Yahoo was thought to be some back alley operation where everyone nervously awaited news like this. Yahoo was a direct competitor and contender to some of the biggest digital companies on the Web. This level of incompetence is mind blowing.

At least it is to me.

Re: Yahoo discloses hack of 1B accounts

#69

Post by rezashirazian »

moo360 wrote: post #23
jonathantm wrote: post #17

Earlier quoted context omitted.

What is your mother's maiden name? T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

Of the Greenwich T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl's ?

I laughed too hard at this.

Re: Yahoo discloses hack of 1B accounts

#70

Post by bpicolo »

mtgx wrote: post #22
chillydawg wrote: post #5

Earlier quoted context omitted.

Bloody hell. Sloppy and incompetent.

Also malicious (allowing NSA to search through everyone's emails).

Current law seems to dictate that if the NSA wants that, it's what they're getting. Blame the government.
Post reply on HN