Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

151–160 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#151

Post by ozten »

x0 wrote: post #75
dopamean wrote: post #56

Earlier quoted context omitted.

I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.

And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem. I'm not really a software developer but I really can't imagine it being a huge change…

For an IdP at the scale of Yahoo, the can adopt something as complicated as supporting versioned passwords and migrating credentials to the latest secure algorithm upon successful login. You have the clear text password at that point. You can store metadata such as the version (or algorithms) used to hash the credential.

Re: Yahoo discloses hack of 1B accounts

#152

Post by golf1052 »

loader wrote: post #35
ponco wrote: post #28

I almost hope the data is made somewhat public so Troy / https://haveibeenpwned.com/ can get a hold of it and provide the public with reassurance.

That was my first thought. I used to have a Yahoo email and I'm assuming at this point (multiple hacks), it's out in the wild.

I used to as well but if you still can access it you should delete it: https://help.yahoo.com/kb/account/close-yahoo-account-sln204...

Re: Yahoo discloses hack of 1B accounts

#153

Post by Endy »

phantom_oracle wrote: post #89

there's a couple of things that these major providers getting pwned teaches you: 1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays) 2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it) 3) the price of ads/convenience is no lo…

If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho. I hate Google's mail interface, I hate the way they make 'conversations' out of discrete emails, and I especially hate their lack of folders. I use GMail begrudgingly at work, and only when necessary, and every time, I look at it and go, "what dipshit ever thought this was a functional way to deal with email?" As a dedicated Windows user, I'm more likely to use iCloud than GMail if Yahoo goes down; but I doubt that.

I like Yahoo email as a user. Yes, they've made mistakes, and I accept that. I'd prefer their mistakes over Google's superiority complex.

Re: Yahoo discloses hack of 1B accounts

#154

Post by bhauer »

ausjke wrote: post #24

I'm speechless. More and more are migrating to cloud these days, I expect more and more epidemic leakage will come. I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is…

Axigen's free e-mail server is pretty solid and easy to set up.

Re: Yahoo discloses hack of 1B accounts

#155

Post by jwatte »

Canada wrote: post #119
cmurf wrote: post #111

OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific comp…

> including no lawsuits Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.

No, but there are libertarians who believe that risk mitigation skills never be required up front, no matter how unable the party at fault would be to restore whatever was lost. (Note: Some things cannot be restored at all; lives and disability being the obvious cases)

The point of government is to mitigate external and unacceptable risks, and we have grown this system based on experience over hundreds of years. Some super free market types seem to argue that we should throw all that away and then institute systems that, over time, will just reinvent the same things. My guess is they believe they will personally come out on top during the reset period through whatever strength/privilege they inhabit.

Re: Yahoo discloses hack of 1B accounts

#156

Post by throwaway34916 »

stanleydrew wrote: post #61
dopamean wrote: post #56

Earlier quoted context omitted.

I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.

Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade. It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.

I'd like to believe that. However, I was recently asked to test a new website for an organization I volunteer for, and discovered their "forgot password" flow emailed me my plaintext password. I wrote an explanation of why this was bad, and how it could be fixed, to a non-technical friend of mine who works there; he passed my email to the (Bay Area based!) consulting shop that did their website. The shop sent this response:

"We do not store passwords as a plain text in database. We have functionality which encrypts and decrypts passwords. We have only ecnrypted passwords in the database.

Almost all other servers use one-way encryption. In this case, passwords cannot be decrypted from hashing."

Again, this is a Bay Area based shop. For code written in 2016.

I was shocked to receive this, but it (among other things) leads me to suspect that there are lot of people out there, in positions of power, who aren't just ignorant, but who actively cling to password-storage anti-patterns.

I'm at a loss for how to fix this.

Re: Yahoo discloses hack of 1B accounts

#157

Post by manarth »

rz2k wrote: post #125
ashark wrote: post #105

Earlier quoted context omitted.

Well, you can only rehash if you have the plaintext password. So you have to wait until they login again, or force a password reset for everyone. In the former case you're stuck with a bunch of md5 passwords hanging around for any account that's not very active, and for the latter you'll lose some percentage of active accounts whose reset process is for some reason no longer functional. You could mix-and-match the tw…

Does an insecure algorithm mean that you effectively have the plain text passwords?

Not necessarily, because of collisions.

The password "foo" may encrypt to the hash "12345". If an attacker were to discover that the hash is "12345", they would look for a password that hashes to "12345", which could, hypothetically, be the password "bar". They don't know the original password "foo", they've simply discovered an alternative, which happens to match the algorithm enough to unlock access.

In general, rainbow tables are used for identifying and attacking common passwords, but that doesn't mean that the algorithm is insecure.

Insecure algorithms can be attacked through collisions, which don't necessarily give you the original password, they just provide an alternative password which is accepted by the algorithm. The distinction matters when it comes to password reuse, because if Site A uses MD5, but Site B uses sha512, finding a collision that grants access on Site A doesn't necessarily give you a password that will grant access on Site B.

Re: Yahoo discloses hack of 1B accounts

#160

Post by unpwn »

cmurf wrote: post #111

OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific comp…

Well maybe you can tell me how you get phished without being retarded? In all my experiences phishing schemes are like bit.ly links that have a form that requires the user to enter in all their data. If you fall for something like that, i don't have much sympathy tbh
Post reply on HN