Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

271–280 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#271

Post by jsjohnst »

cm2187 wrote: post #141
Endy wrote: post #123

Earlier quoted context omitted.

From everything I've read, the engineers did. The problem was that the security team had to go head-to-head with the budget team. And unfortunately, the budget team won - since the upper levels didn't feel that the IT security salaries were a necessary expenditure. And beyond that, there was concern that making people actually change their passwords regularly and requiring anything like security in said passwords was…

But would it require users to change their password? The way I would have implemented it, but would be keen to know how secure it is, is that you start with the md5 of the password ( md5(password) ). You then bcrypt or scrypt that md5 ( bcrypt(md5(password)) ) and replace the md5 in your database with the bcrypt hash. When a user logs in, all you need to do is to calculate the md5 first then check that md5 against th…

bcrypt(md5(password)) is what Yahoo! did when they switched.

Re: Yahoo discloses hack of 1B accounts

#272

Post by mlangdon »

234dd57d2c8db wrote: post #254
jrockway wrote: post #236

Earlier quoted context omitted.

You've somehow managed to turn a bug report into a soundboard for your racist insecurities. Impressive. In a sad way.

... "offshore workers" are not a race. You realize offshore workers could be the same race as the person posting right?

This is technically true, which is the best kind of true. Swap in nationalist, chauvinist. It's utterly clear what was meant by racism above, in spite of your semantics.

Re: Yahoo discloses hack of 1B accounts

#273

Post by leereeves »

manarth wrote: post #266
leereeves wrote: post #226

Earlier quoted context omitted.

> hash = sha512(salt + MD5(password)) Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back. So the security level is not the same, though it may be resistant to some attacks on MD5. And it's probably not important for most people, since there are less than 2^56 eight character ASCII passwords.

> "Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back." Assuming that the new hash is secure (and sha512 is generally agreed to be secure), then, given a specific sha512 hash, the original MD5 hash can only be determined via rainbow tables, which is a Big-O operation. Even though entropy is reduced, it's still a significant work to determine the original MD5 hash (significant…

In this case an attacker isn't looking for a collision (which would mean creating two passwords with the same hash, and what hash that is doesn't matter).

The attacker needs a password with a specific hash, and the best reported attack for that is around 2^128.

Re: Yahoo discloses hack of 1B accounts

#274

Post by badsock »

throwaway1X2 wrote: post #262
jrockway wrote: post #236

Earlier quoted context omitted.

You've somehow managed to turn a bug report into a soundboard for your racist insecurities. Impressive. In a sad way.

Yes, 'offshore' is a race. Every critique is a racism. Coming from said 'offshore' (at least in regards to the US), I see that 'quality' people work remotely for monies comparable to the onsite workers, launch startups, et cetera. If you outsource to the offshore for the costs, guess what, you get lesser quality for the said cost. Nothing racist in that, but I understand your position - a SJW to every household!

I'm sure they meant to say xenophobic.

Re: Yahoo discloses hack of 1B accounts

#275

Post by alyandon »

dsl wrote: post #197
alyandon wrote: post #11

"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…

The forged cookie attack was used on a limited number of accounts, by a state sponsored actor. Going to this amount of effort and then sending spam would be on par with breaking into a bank just to steal the printer paper from the office. Most likely either: 1) you were phished and didn't realize it 2) logged in to your Yahoo account from a device that had malware on it

I'm willing to accept that perhaps that was not how my account was compromised but the time frame when this happened was well in line for when this breach supposedly occurred.

Regardless, it was some sort of automated spam/phishing emails that were sent from Yahoo's network using my account to contacts on my list. I analyzed the headers of multiple bounced messages that were sent to email addresses no longer in use and confirmed the origin of the traffic.

I'm not going to fall for a phishing attack and I only access email from devices I personally control. Could one of them had some sort of malware infection? I guess it is possible but I am security conscious and it is highly unlikely. I also would expect a hacker that has compromised one of my devices would be far more interested in using my banking credentials than using my Yahoo account to send spam.

Re: Yahoo discloses hack of 1B accounts

#276

Post by jlgaddis »

I just attempted to log in to an old @yahoo.com account that I haven't used in probably five years or more.

On the login screen, there was a short notice about this breach (with a link to more details), and after logging in I was prompted to create a new password, and update recovery emails / phone numbers.

That doesn't negate any of this shit that happened, obviously, but maybe they're at least gonna try to make things better (we can hope, anyways).

Re: Yahoo discloses hack of 1B accounts

#277

Post by kej »

Endy wrote: post #234
kej wrote: post #218

Earlier quoted context omitted.

> I especially hate their lack of folders GMail supports labels as folders. When you create a new label it will ask you if you want to nest the label under another label and you can do this repeatedly to make a nested folder structure. Crucially, this will show up as nested folders via IMAP.

No, no - I understand that you can think this, and that they claim it, but from a UI angle, it's wrong. I hate the implementation of labels. They don't actually disappear when I click on inbox. When I want my inbox, I want just that folder - all filtered content goes elsewhere and disappears until I want it. That's not GMail's way.

I have a giant folder hierarchy in my gmail, so I assure you this can work.

In your case it sounds like you're taking a message with the "Inbox" label and adding the "some/folder" label, which will indeed still show it in both places. If you move the message, which removes "Inbox" and adds "some/folder" it will no longer show up in the Inbox.

Re: Yahoo discloses hack of 1B accounts

#278

Post by user5994461 »

cm2187 wrote: post #141
Endy wrote: post #123

Earlier quoted context omitted.

From everything I've read, the engineers did. The problem was that the security team had to go head-to-head with the budget team. And unfortunately, the budget team won - since the upper levels didn't feel that the IT security salaries were a necessary expenditure. And beyond that, there was concern that making people actually change their passwords regularly and requiring anything like security in said passwords was…

But would it require users to change their password? The way I would have implemented it, but would be keen to know how secure it is, is that you start with the md5 of the password ( md5(password) ). You then bcrypt or scrypt that md5 ( bcrypt(md5(password)) ) and replace the md5 in your database with the bcrypt hash. When a user logs in, all you need to do is to calculate the md5 first then check that md5 against th…

It's one way to do it, which is okay sometimes.

The other way is to add a new empty column for bcrypt. The next time the user logs in, you save the bcrypt hash and you remove the MD5 hash.

Over time, the active users will be migrated to the new scheme. The only issue is the abandoned accounts, they'll keep the old weak scheme.

Re: Yahoo discloses hack of 1B accounts

#279

Post by bagacrap »

duaneb wrote: post #203
Arubis wrote: post #165

Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.

Gonna guess that's a bad message for a password length violation or something else. Not that it's much better. Is it so hard to allow 50 character passwords?

I'm guessing it detected an @ symbol?

Re: Yahoo discloses hack of 1B accounts

#280

Post by kodablah »

user5994461 wrote: post #261
ausjke wrote: post #24

I'm speechless. More and more are migrating to cloud these days, I expect more and more epidemic leakage will come. I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is…

> More and more are migrating to cloud these days, I expect more and more epidemic leakage will come. Why? Couldn't isn't relevant to security. If anything, it makes it easier to configure firewalls and rights, so it's easier to put security in place.

> Irrelevant. Cloud doesn't impact security.

I disagree. The larger the congregation of value by a single target, the higher value the target. Saying it doesn't impact security is like saying whether a building is a bank or a house doesn't impact security.

(It should also probably be noted that I assume the OP was referring to "cloud" as in centralized data services as opposed to "cloud" as in hosted servers/VMs)

Post reply on HN