Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

221–230 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#221

Post by raverbashing »

Arubis wrote: post #165

Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.

Just leave it at passwordpassword, it will be leaked eventually anyway

Strong passwords that need to be memorized shouldn't be wasted on security bozos

Re: Yahoo discloses hack of 1B accounts

#222

Post by Dr0Dre »

0x0 wrote: post #189
alyandon wrote: post #11

"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…

Are you sure they actually logged in to your account to send spam (are the spam emails visible in your sent folder), or could it be that someone is just spoofing the SMTP MAIL FROM / email From: header?

I had the same issue, I could see the email sent from sent folder. This happened about year ago and I was very surprised.

Re: Yahoo discloses hack of 1B accounts

#223

Post by nsxwolf »

What good is requiring you to change your password on the next login? How do they know it's not just being re-compromised? There are a lot of accounts that are orphaned, but the contents are exposed and still a threat to the original owners.

Why not just lock the accounts?

Re: Yahoo discloses hack of 1B accounts

#224

Post by manarth »

LeoPanthera wrote: post #80
ggregoire wrote: post #71

Earlier quoted context omitted.

Honest question: why did you need a Yahoo account?

There are many, many active communities and mailing lists still using Yahoo Groups.

And to clarify, some Yahoo Groups require a Yahoo account to participate. You cannot participate with a regular email address, you must sign up to a Yahoo account.

If you join a real-world social gathering which happens to use such a Yahoo group, you may find yourself excluded from online communication with that social network unless you agree to sign up to Yahoo.

Re: Yahoo discloses hack of 1B accounts

#225

Post by joering2 »

dsl wrote: post #197
alyandon wrote: post #11

"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…

The forged cookie attack was used on a limited number of accounts, by a state sponsored actor. Going to this amount of effort and then sending spam would be on par with breaking into a bank just to steal the printer paper from the office. Most likely either: 1) you were phished and didn't realize it 2) logged in to your Yahoo account from a device that had malware on it

> just to steal the printer paper from the office

Or stealing $6,000 with $100,000 gun :)

http://www.fenrir.com/free_stuff/columns/callcops/ctc-436.ht...

Re: Yahoo discloses hack of 1B accounts

#226

Post by leereeves »

manarth wrote: post #140
ashark wrote: post #105

Earlier quoted context omitted.

Well, you can only rehash if you have the plaintext password. So you have to wait until they login again, or force a password reset for everyone. In the former case you're stuck with a bunch of md5 passwords hanging around for any account that's not very active, and for the latter you'll lose some percentage of active accounts whose reset process is for some reason no longer functional. You could mix-and-match the tw…

You can only rehash if you have the plaintext password There are techniques to rehash, even without the plain-text password, and without the user having to login to trigger a rehash. Drupal 7 used such a technique for upgrades from Drupal 6, migrating from MD5 to a salted sha512 hash, but it's not an uncommon technique. The old passwords are stored as MD5 hashes in the databases. The MD5 hash is processed through the…

> hash = sha512(salt + MD5(password))

Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back.

So the security level is not the same, though it may be resistant to some attacks on MD5.

And it's probably not important for most people, since there are less than 2^56 eight character ASCII passwords.

Re: Yahoo discloses hack of 1B accounts

#227

Post by manarth »

mobilefriendly wrote: post #114
hbosch wrote: post #18

So, the scuttlebutt last time was that they disclosed the hack due to a potential Verizon buyout forcing their hand. Seems as though this could be the same thing, generally speaking. Can anyone enlighten me as to how Verizon compels Yahoo to disclose this information? Or rather, how does Verizon know about these intrusions, if they do?

Some states like CA have a legal requirement to notify in the event of a breach, so hiding this event is illegal.

The article is from Yahoo, it's a notification from Yahoo, announced by their head of security. They're not hiding the event.

Re: Yahoo discloses hack of 1B accounts

#228

Post by DougBTX »

agf wrote: post #91
ubercore wrote: post #79

Earlier quoted context omitted.

What do you mean by a password that can't be reasonably brute forced? EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.

If it's a password so long and complex it wouldn't be in any rainbow table computable in reasonable time. While MD5 can be computed quickly, there is still a limit to how many you can compute -- and there are an infinite number of possible passwords if they aren't length limited.

Interestingly even if the password has infinite length, an MD5 hash has a fixed finite length. You can think of it as a glorified modulus operator, beyond some point the longer passwords will have hashes that match shorter ones.

Re: Yahoo discloses hack of 1B accounts

#229

Post by contravariant »

raverbashing wrote: post #221
Arubis wrote: post #165

Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.

Just leave it at passwordpassword, it will be leaked eventually anyway Strong passwords that need to be memorized shouldn't be wasted on security bozos

I can kind of understand that reasoning, but one of the nicer things about strong passwords is that there are a lot of them. In some sense that's what makes them strong passwords.
Post reply on HN