Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

211–220 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#211

Post by manarth »

intopieces wrote: post #76
JustSomeNobody wrote: post #37

Earlier quoted context omitted.

But that's where all my junk mail goes...

I recently decided that if I don't trust the company not to send me spam, I don't need to avail myself of their services. It might not be possible for everyone, but it's made my life a lot simpler.

I don't trust any company to not send me spam. Even if they don't do it today, they may get bought-out, hacked, or otherwise lose control of the data. Even if everything suggests that they won't spam me, I'm not entirely convinced. Even if they're the most upstanding company on the planet, I'm still not convinced. Based on past experience, you understand.

Re: Yahoo discloses hack of 1B accounts

#212

Post by rckclmbr »

zmmmmm wrote: post #113

Sorry, there's no shielding Marrisa Mayer from this. Yes, she had only been there a year or so. But that's long enough she should have been on top of security. Yes, she's just killing time until she leaves now anyway. But, the symbolic statement is still important - she should resign.

> Yes, she had only been there a year or so

Uh, it's been 4 years... I know, time flies.

Re: Yahoo discloses hack of 1B accounts

#213

Post by rev_bird »

manarth wrote: post #140
ashark wrote: post #105

Earlier quoted context omitted.

Well, you can only rehash if you have the plaintext password. So you have to wait until they login again, or force a password reset for everyone. In the former case you're stuck with a bunch of md5 passwords hanging around for any account that's not very active, and for the latter you'll lose some percentage of active accounts whose reset process is for some reason no longer functional. You could mix-and-match the tw…

You can only rehash if you have the plaintext password There are techniques to rehash, even without the plain-text password, and without the user having to login to trigger a rehash. Drupal 7 used such a technique for upgrades from Drupal 6, migrating from MD5 to a salted sha512 hash, but it's not an uncommon technique. The old passwords are stored as MD5 hashes in the databases. The MD5 hash is processed through the…

I was doing all kinds of mental gymnastics trying to figure out how this would work; thanks for explaining it so clearly.

Re: Yahoo discloses hack of 1B accounts

#214

Post by kingosticks »

fencepost wrote: post #88
serf wrote: post #21

Earlier quoted context omitted.

honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?

In my case, it's because I still have some very old accounts in there. Accounts that predate not only this password manager (LastPass) but the previous one (KeePass) and which in fact go all the way back to something that started with "Yet Another (YA)" back on a Palm device. I really ought to go through and do some janitorial work in there, but some of those are for sites that actually still exist and for which thos…

Lastpass can report which sites are sharing the same passwords (and also which are not using a random password generated by it). For some sites it even automates the password changing for you. It doesn't work for all sites (including this one) but it saved me a load of time just recently.

Re: Yahoo discloses hack of 1B accounts

#215

Post by cptskippy »

0x0 wrote: post #189
alyandon wrote: post #11

"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…

Are you sure they actually logged in to your account to send spam (are the spam emails visible in your sent folder), or could it be that someone is just spoofing the SMTP MAIL FROM / email From: header?

Given Yahoo's security policies, whose to say someone wasn't just sending it from Yahoo's SMTP servers without any access to user's email accounts?

Re: Yahoo discloses hack of 1B accounts

#216

Post by metafunctor »

jlarocco wrote: post #207
metafunctor wrote: post #94

Earlier quoted context omitted.

A preimage attack for MD5 has complexity of about 2^123. So, even if you get the MD5 hash for a password, it will be exceedingly hard to find a password that has the same hash (assuming the original password is long and random).

I don't think that's true. This site from 2006 claims they could find collisions in an average of 45 minutes on a 1.6 Ghz Pentium 4: http://www.bishopfox.com/resources/tools/other-free-tools/md... If you account for speed increases over the last 10 years and assume the password thief has access to a botnet, then it wouldn't surprise me if they've found collisions for the entire list. Edit: Nevermind, the link finds t…

The collision generator behind that link does not implement a preimage attack (given a string X, come up with another string Y with the same MD5 hash).

Instead, it implements the much easier collision attack (come up with two strings that have the same MD5 hash).

Re: Yahoo discloses hack of 1B accounts

#217

Post by ozten »

mschuster91 wrote: post #196
ozten wrote: post #151

Earlier quoted context omitted.

For an IdP at the scale of Yahoo, the can adopt something as complicated as supporting versioned passwords and migrating credentials to the latest secure algorithm upon successful login. You have the clear text password at that point. You can store metadata such as the version (or algorithms) used to hash the credential.

Complex?! It's easy as hell . Even PHP, so often flamed for "bad security" these days supports EASY functions for this (and polyfills are available, if you're running PHP - password_hash, which creates a salted hash (the returned value consists of a type/strength spec, the hash, and the salt) - password_verify, which verifies a password with a hash in a timing-safe manner - password_needs_rehash, which tells you if y…

Nothing is "easy as hell" at scale.

Re: Yahoo discloses hack of 1B accounts

#218

Post by kej »

Endy wrote: post #153
phantom_oracle wrote: post #89

there's a couple of things that these major providers getting pwned teaches you: 1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays) 2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it) 3) the price of ads/convenience is no lo…

If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho. I hate Google's mail interface, I hate the way they make 'conversations' out of discrete emails, and I especially hate their lack of folders. I use GMail begrudgingly at work, and only when necessary, and every time, I look at it and go, "what dipshit ever thought this was a functional way to deal with email?" As a dedicated Windows user, I'm…

> I especially hate their lack of folders

GMail supports labels as folders. When you create a new label it will ask you if you want to nest the label under another label and you can do this repeatedly to make a nested folder structure.

Crucially, this will show up as nested folders via IMAP.

Re: Yahoo discloses hack of 1B accounts

#219

Post by cmurf »

dmix wrote: post #137
Canada wrote: post #119

Earlier quoted context omitted.

> including no lawsuits Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.

Even anarcho-capitalists, the most hardcore libertarians, believe heavily in the court system. So I'm not sure what the OP means "without lawsuits". Because lawsuits would most likely be their answer here. Also maybe competition from other email vendors who take your security seriously and doesn't leak 1 billion emails? Or pressure from investors not to create that type of liability? Pretty obviously a strawman, it's…

Seems that anarchy is contrary to government, and out of necessity a government is needed to have a court. Those pure free market types I'm referring to self describe exactly as anarcho capitalists and say all disputes are resolved by insurance, exactly zero government. If there's a court, maybe that's a venue the insurance companies all agree upon. But if you don't have insurance or don't have good enough insurance you don't get as much representation or as much of a payout and that's your choice, sometimes life is unfair and you get screwed over.

And as it's describe to me I almost immediately start thinking of Gangs of New York and axes. It's such a total departure from anything remotely civil I can only imagine this leading to a bunch of heads being chopped off. But hey, there's insurance for that too I guess.

Re: Yahoo discloses hack of 1B accounts

#220

Post by kej »

rckclmbr wrote: post #212
zmmmmm wrote: post #113

Sorry, there's no shielding Marrisa Mayer from this. Yes, she had only been there a year or so. But that's long enough she should have been on top of security. Yes, she's just killing time until she leaves now anyway. But, the symbolic statement is still important - she should resign.

> Yes, she had only been there a year or so Uh, it's been 4 years... I know, time flies.

GP means that she had only been there a year or so when the leak happend.
Post reply on HN