81–90 of 596 posts
MD5 in 2016?.I hope yahoo can save itself and tech community all this embarrassment by just going out of business one and for all.Folks at the helm of affairs at yahoo are incompetent. And it is about time government started to persecute incompetent CEO.
It occurred in 2013
I'm speechless. More and more are migrating to cloud these days, I expect more and more epidemic leakage will come. I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is…
[edit] by the way I wonder how useful would be a tutorial "for dummies" of how to set up your own mail server from scratch. I assume that users who would be happy to pay for their own server but feel it is too complicated would likely be windows users, i.e. wouldn't mind having to pay for a license and would like to use an environment with a relatively exhaustive UI. I'll give it a try.
Earlier quoted context omitted.
[deleted]
It's really not. Unsalted MD5 has been shameful for a long, long time.
According to Wikipedia:
* 2004 it became possible to find MD5 collisions at a rate of one per hour on a cluster
* 2005 it became possible to do this within "a few hours" on a consumer laptop
* 2006 it became possible to do this within one minute
* nowadays it's possible to do this "within seconds"
Plus, as others have mentioned, it's now possible to find collisions instantly by using widely available rainbow tables, e.g. https://md5db.net/decrypt
Earlier quoted context omitted.
What is your mother's maiden name? T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl
Which only works until you call in asking for a password reset and when they ask you the question you just say "I just hit the keyboard a bunch".
MD5 in 2016?.I hope yahoo can save itself and tech community all this embarrassment by just going out of business one and for all.Folks at the helm of affairs at yahoo are incompetent. And it is about time government started to persecute incompetent CEO.
It occurred in 2013
Earlier quoted context omitted.
Bloody hell. Sloppy and incompetent.
I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.
Earlier quoted context omitted.
I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.
And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem. I'm not really a software developer but I really can't imagine it being a huge change…
This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.
honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?
I really ought to go through and do some janitorial work in there, but some of those are for sites that actually still exist and for which those logins are likely still valid. I don't care enough about them to go log in on each and change passwords, but I also don't want to simply delete them and leave yet another orphaned account.
1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays)
2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it)
3) the price of ads/convenience is no longer worth it. I'm assuming at least a sizable minority of internet users are using ad-blockers these days. They can't get your eyeballs, so they package and sell your data. Granted, you can probably now get the same (raw) data on the black market by paying a fraction in bitcoin and you'll get to see those billions of emails telling people someone attacked their farm in farmville from 2009
Lastly (and I really hope this happens), Yahoo implodes/collapses (cause the average Joe won't migrate willingly) and leaves a vacuum for their 500+ million email users. Hopefully the smaller providers (Proton, Migadu, Posteo, Tuta, etc.) get at least 10% of these users and the email-cartel is broken (somewhat).
Well on the upside, if you changed your password as a result of the hack from a few months ago, you should theoretically be safe against this one which happened in 2013 . Those security questions, on the other hand, are still fair targets.
So I ignored the hack a few months ago. I also never got notified that I was vulnerable.
Just now I tried to log in to see if my password had been invalidated. Nope. It was my old insecure "pattern-based" password (myprefixYAHOO) that I use nowhere any more. Probably short enough to have brute forced with MD5 in a few minutes at most.
And yet...no spam sent from my account. No spam in my account (except some kind of announcement from "Aabaco, the new name of Yahoo Small Business" from a year ago. Just some of the mail from the email list that petered out over two years ago as the list transitioned into a Meetup group.
So I guess Yahoo either has considerably more than 1B users, or there were simply so many compromised accounts that they didn't bother trying to use all of them to send spam.
Changed the password just now to something secure "just because", but it's hard to care.