security is important, but lets not forget the strides theyve made in making meaningful connections with their audience via collaborative relationships with powerful leaders such as Katie Couric
Yahoo discloses hack of 1B accounts
121–130 of 596 posts
Re: Yahoo discloses hack of 1B accounts
#122Re: Yahoo discloses hack of 1B accounts
#123Earlier quoted context omitted.
Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade. It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.
But it's not like if we didn't have a pretty much continuous stream of major data leaks for the past 5 years. Surely yahoo engineers occasionally open a newspaper...
From everything I've read, the engineers did. The problem was that the security team had to go head-to-head with the budget team. And unfortunately, the budget team won - since the upper levels didn't feel that the IT security salaries were a necessary expenditure. And beyond that, there was concern that making people actually change their passwords regularly and requiring anything like security in said passwords was going to discourage users from using Yahoo and send them over to GMail.
Unfortunately... that argument wasn't wrong.
Re: Yahoo discloses hack of 1B accounts
#124I almost hope the data is made somewhat public so Troy / https://haveibeenpwned.com/ can get a hold of it and provide the public with reassurance.
By now I suspect you can simplify it down to just matching on the RHS for any domain registered to Yahoo.
A number of ISPs have used Yahoo to provide mail services in the past, so it's probably not quite as straightforward as that.
Re: Yahoo discloses hack of 1B accounts
#125Earlier quoted context omitted.
And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem. I'm not really a software developer but I really can't imagine it being a huge change…
Well, you can only rehash if you have the plaintext password. So you have to wait until they login again, or force a password reset for everyone. In the former case you're stuck with a bunch of md5 passwords hanging around for any account that's not very active, and for the latter you'll lose some percentage of active accounts whose reset process is for some reason no longer functional. You could mix-and-match the tw…
Does an insecure algorithm mean that you effectively have the plain text passwords?
Re: Yahoo discloses hack of 1B accounts
#126Earlier quoted context omitted.
But I'm afraid I have no sympathy for outraged users. No more than if it was gmail or hotmail. They didn't pay for the service, they got an email service for free. It's hard to complain when it is free. And they did enter into an agreement where they sell their privacy against a free service.
Knock-Knock... I pay for Y!Mail Plus. It's not just free users wanting a drop-box for spam.
I actually wasn't aware there was also a paid service.
Though I doubt this is a large share of the 1B accounts.
Re: Yahoo discloses hack of 1B accounts
#127OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific comp…
> including no lawsuits Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.
Yeah if anything lawsuits/courts are central to their argument, that the owners of property will use legal recourse to settle damages to them, and that mechanism serves most of the functions of gov't regulation.
Re: Yahoo discloses hack of 1B accounts
#128Re: Yahoo discloses hack of 1B accounts
#129OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific comp…
You're building a straw-man. Before trying to argue against a position you should try to understand it.
Re: Yahoo discloses hack of 1B accounts
#130"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…
What do you mean by a password that can't be reasonably brute forced? EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.
Pretty much even if you choose a high entropy password like say:
`]{;&rQQQjoJkxm0ayM+gG,@vf*>#-{X4E>aZG(A1~tf