Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

171–180 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#171

Post by username223 »

serf wrote: post #21
ben174 wrote: post #15

This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.

honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?

honest answer: one of those sites is your recovery email, the one way back into your digital life if something goes deeply wrong. It's the password reset email if another site is hacked. It's the "bootstrap myself from some other computer" account if your machine dies or your house burns down.

IMHO you should memorize one very strong password for one somewhat-trustworthy site.

Re: Yahoo discloses hack of 1B accounts

#172

Post by [deleted] »

JonDav wrote: post #130
ubercore wrote: post #79

Earlier quoted context omitted.

What do you mean by a password that can't be reasonably brute forced? EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.

Pretty much even if you choose a high entropy password like say: `]{;& rQQQjoJkxm0ayM+gG,@vf*>#-{X4E>aZG(A1~tf the MD5 algorithm can be broken using various techniques like collisions, unsalted I believe means that their database would accept the hashes the third party has. End result is they should have migrated away from MD5 after it was declared unsafe.

[deleted]

Re: Yahoo discloses hack of 1B accounts

#173

Post by uptown »

When credit cards are compromised, the responsible party is usually responsible for providing identity theft protection. Why not tech firms that seek to store sensitive personal information? Maybe it'd scale back the desire for every firm to collect as much personal info as you'll provide them.

Re: Yahoo discloses hack of 1B accounts

#174

Post by gottam »

x0 wrote: post #75
dopamean wrote: post #56

Earlier quoted context omitted.

I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.

And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem. I'm not really a software developer but I really can't imagine it being a huge change…

Having worked with monolithic legacy codebases that they likely have, it has gone through hundreds of developers who dont work for the company anymore that created a bunch of spaghetti code means its a huge effort required to make sure that none of their other services break when they implement such changes. Also, management HATES when dev teams do this because it isn't "new stuff" thats immediately visible to their bosses nor the end user.

If anything goes wrong with the password update, users get angry, lose faith in the services, stress, a few people get fired maybe, etc etc. On the other hand, letting it stay old and crappy just everything stays just peachy, and nobody is the wiser that the entire system is a house of cards. Until the day someone hacks the database of course... which happened so its "now" a problem.

They're not going to begin to take security seriously even after this incident. They'll do what they need to right now but there's no auditing and their users don't normally care about this sort of thing, therefore the management won't care either.

Re: Yahoo discloses hack of 1B accounts

#176

Post by ajmurmann »

uptown wrote: post #173

When credit cards are compromised, the responsible party is usually responsible for providing identity theft protection. Why not tech firms that seek to store sensitive personal information? Maybe it'd scale back the desire for every firm to collect as much personal info as you'll provide them.

I generally like this idea, but wonder if it would result in even fewer disclosures.

Re: Yahoo discloses hack of 1B accounts

#177

Post by semicolon_storm »

JonDav wrote: post #136
metafunctor wrote: post #94

Earlier quoted context omitted.

A preimage attack for MD5 has complexity of about 2^123. So, even if you get the MD5 hash for a password, it will be exceedingly hard to find a password that has the same hash (assuming the original password is long and random).

I thought the whole point of the MD5 vulnerability was that the limit was 2^128 and as such there are more inputs that possible output hashes, meaning more possible input collisions.

All hashing algorithms that I am aware of have more inputs than outputs. By the pigeon hole principle, there will always be collisions. MD5 is weak, but it still isn't trivial to find an input that hashes to the same thing as a high entropy password.

Re: Yahoo discloses hack of 1B accounts

#178

Post by djsumdog »

uptown wrote: post #173

When credit cards are compromised, the responsible party is usually responsible for providing identity theft protection. Why not tech firms that seek to store sensitive personal information? Maybe it'd scale back the desire for every firm to collect as much personal info as you'll provide them.

To be fair, that identity theft protection is lip service/worthless bullshit.

Re: Yahoo discloses hack of 1B accounts

#179

Post by dmix »

droopyEyelids wrote: post #117
cmurf wrote: post #111

OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific comp…

You're demanding accountability from insane people. I learned long ago, never to wrestle with a pig. You get dirty, and besides, the pig likes it. Read more at: https://www.brainyquote.com/quotes/quotes/g/georgebern137450...

Ironically, you're quoting George Bernard Shaw who believed in eugenics, anti-vaccination, and "expressed admiration for both Mussolini and Stalin".

I'd be sufficiently curious to find a single person who fits the profile of the ideologue the OP is referring to. I'm afraid such a person doesn't exist.

Post reply on HN