Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

251–260 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#251

Post by jsjohnst »

alyandon wrote: post #11

"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…

Nope, that doesn't explain it. Without Yahoo! UDB access to get a couple values unique to your login, you can't forge a cookie that allows you access to Yahoo! Mail.

Re: Yahoo discloses hack of 1B accounts

#252

Post by djsumdog »

jonathantm wrote: post #17
NoPiece wrote: post #9

Earlier quoted context omitted.

I hope everyone stops relying on security questions!

What is your mother's maiden name? T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

I hate it when I'm asked this in person at banks and shit.

"Your mother's maiden name has four numbers in it?"

"It's a password. You should never use real answers for security questions."

Re: Yahoo discloses hack of 1B accounts

#254

Post by 234dd57d2c8db »

jrockway wrote: post #236
sqldba wrote: post #230

Technically; no. Bureacratically; maybe. Given the skill and self direction of offshore workers; impossibly.

You've somehow managed to turn a bug report into a soundboard for your racist insecurities. Impressive. In a sad way.

... "offshore workers" are not a race. You realize offshore workers could be the same race as the person posting right?

Re: Yahoo discloses hack of 1B accounts

#255

Post by dbg31415 »

Arubis wrote: post #165

Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.

* Defending Against Hackers Took a Back Seat at Yahoo, Insiders Say - The New York Times || http://www.nytimes.com/2016/09/29/technology/yahoo-data-brea...

Time to update that article from September. Hooray for Yahoo, they made it 76 days without a 500M+ user security breach.

(No, I don't know the actual dates... just making a joke.)

Re: Yahoo discloses hack of 1B accounts

#256

Post by djsumdog »

noxToken wrote: post #68
mkhpalm wrote: post #30

Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.

You're right, but it goes beyond that. Yahoo used to be a titan. I was a regular user of Yahooligans back in the day. Yahoo (at one time) had been my go to search engine. I can't say that it was ever my primary email account, but I used it. I used Yahoo Messenger. I was part of a community that centered around some Yahoo games. Yahoo used to be a titan that was a direct Google competitor in the realms of communicatio…

This goes into the much bigger issues of there not being enough search engines. Back in the day if you couldn't find something, there was Lycos, Hotbot, AltaVista, MSN .. each had their own indexes (or they purchased access to a few major indexes).

Later we saw people ditch their indexes and just using a few big players. Now we have Google, Yandex ..and...Bing? DuckDuckGo uses a combination of Yandex and others, Microsoft has been found parsing Google to build their index ...

I want more options, but the search space barrier to entry is very high.

Re: Yahoo discloses hack of 1B accounts

#260

Post by jsjohnst »

mturmon wrote: post #247
jsjohnst wrote: post #231

Earlier quoted context omitted.

1) I'd be flabbergasted beyond belief if there was ever a Yahoo! engineer who had user passwords on their laptop / Dev box. The technical hurdle for that would be a stretch, let alone the fact of the other ramifications of doing this. 2) there's no SQL database involved with Yahoo!'s storage of passwords. It's a custom built db system with proprietary access and replication protocols.

Yet, somehow they did get out.

Apologies, I've heard the details at this point and I can't disclose them. The limit of what I can do is poke holes in the theories that are wrong.
Post reply on HN