Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

361–370 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#361

Post by MarkMc »

234dd57d2c8db wrote: post #254
jrockway wrote: post #236

Earlier quoted context omitted.

You've somehow managed to turn a bug report into a soundboard for your racist insecurities. Impressive. In a sad way.

... "offshore workers" are not a race. You realize offshore workers could be the same race as the person posting right?

I don't know whether sqldba was suggesting something racist, but I would say it is not necessary to identify a particular race hint at a racist viewpoint.

When Ronald Regan said "welfare queen", did he mean to imply "black woman on welfare"? If I write, "Middle-eastern people are lazy" do I mean to imply "Arabs are lazy - but not necessarily Jews"?

I also wonder whether you can have a racist view of your own race. For example, a stereotype is that black people are inherently bad at math - are there any blacks that believe this?

Re: Yahoo discloses hack of 1B accounts

#362

Post by danielweber »

_asummers wrote: post #87
x0 wrote: post #75

Earlier quoted context omitted.

And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem. I'm not really a software developer but I really can't imagine it being a huge change…

Hashing the hash isn't a good idea, you're reducing the domain of your secure_hash function to the range of md5. The way to do it is to have a "password hash algo version" column and when the user puts in their password, you verify against the hash[algo](password) and rehash with the later version, changing the algo column for that user.

> you're reducing the domain of your secure_hash function to the range of md5.

Oh no, only 128 bits. The NSA will be able to brute force one of those passwords in 80 years.

Re: Yahoo discloses hack of 1B accounts

#364

Post by danielweber »

wapz wrote: post #340

I logged into my yahoo email in chrome in an incognito tab and it logged into someone else's account. This was probably in 2014 (it could have been in 2013). I wonder if this was related at all.

What's likely is that two people were logging in at once and they ended up with the same credential because someone didn't realize that a servlet is a singleton.

Re: Yahoo discloses hack of 1B accounts

#365

Post by b2600 »

cm2187 wrote: post #282
jsjohnst wrote: post #267

Earlier quoted context omitted.

I've done it before on a 1 billion word / password list and didn't get any collisions.

That being said md5 does generate collisions. I was playing with the IMDB movie database that you can download. They use a combination of the title and the year as a primary key. I tried using an md5 instead to save space (but giving a reproducible ID instead if an identity column), and got many collisions. No collision with SHA256.

What you're describing is not possible given the database you tested. Are there more details that would clarify your post?

Re: Yahoo discloses hack of 1B accounts

#366

Post by jsjohnst »

CobrastanJorji wrote: post #337
jsjohnst wrote: post #260

Earlier quoted context omitted.

Apologies, I've heard the details at this point and I can't disclose them. The limit of what I can do is poke holes in the theories that are wrong.

Aren't the details "three years after we were hacked, law enforcement told us that we had been hacked, and we believe them?" The press release explicitly says "We have not been able to identify the intrusion associated with this theft." I especially noticed that the "What are we doing to protect our users?" section doesn't mention anything about Yahoo fixing any security issues. Presumably, then, as a Yahoo engineer,…

Do you honestly believe a press release covers every detail, especially ones with strong legal implications, and might not have rather been worded very carefully?

Re: Yahoo discloses hack of 1B accounts

#367

Post by flukus »

haser_au wrote: post #331
pbhjpbhj wrote: post #302

Earlier quoted context omitted.

>It's a huge amount of work // Really? Moving from doing md5(password) to bcrypt(password,salt)? I see organisations make things hard and legacy code-base, yadda, yadda but surely if Yahoo couldn't do this then they couldn't manage scratching their own butt; it really seems like quite a small change in the scheme of things. Like one senior engineer, one afternoon of work (then testing, etc., OK, sure) ... ?

"It Takes 6 Days to Change 1 Line of Code" https://news.ycombinator.com/item?id=13119138 I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation. Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to lo…

Yes it could take months or years to complete the process, but they've had at least a decade.

Even if it never completes (abandoned accounts), it would still have saved most active accounts from being breached.

Re: Yahoo discloses hack of 1B accounts

#368

Post by tesseract »

username223 wrote: post #171
serf wrote: post #21

Earlier quoted context omitted.

honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?

honest answer: one of those sites is your recovery email, the one way back into your digital life if something goes deeply wrong. It's the password reset email if another site is hacked. It's the "bootstrap myself from some other computer" account if your machine dies or your house burns down. IMHO you should memorize one very strong password for one somewhat-trustworthy site.

I've struggled with this, the issue to me is by their very nature I want those passwords that can be used for bootstrapping/resetting everything else to be very strong ones. I've settled with making a list, encrypting it with a memorized moderately-strong passphrase, and storing copies (flash drive or base64-on-paper) in a few physically secure locations that probably won't all get destroyed at once. Maybe this is overly paranoid but it wasn't a huge amount of effort, either. At least I am pretty confident the weak links are now the security of those services themselves (and my client computers) and not the passwords.

Re: Yahoo discloses hack of 1B accounts

#369

Post by baby »

sk5t wrote: post #319
AsyncAwait wrote: post #310

Earlier quoted context omitted.

if the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.

It sort of does matter for bcrypt, surprisingly: http://security.stackexchange.com/questions/39849/does-bcryp... In the interests of hewing closest to cryptographic reality, I design not to allow a password longer than the algorithm can usefully use.

This is surprising, do you know how Argon2 behaves compared to this?

Re: Yahoo discloses hack of 1B accounts

#370

Post by haser_au »

flukus wrote: post #367
haser_au wrote: post #331

Earlier quoted context omitted.

"It Takes 6 Days to Change 1 Line of Code" https://news.ycombinator.com/item?id=13119138 I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation. Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to lo…

Yes it could take months or years to complete the process, but they've had at least a decade. Even if it never completes (abandoned accounts), it would still have saved most active accounts from being breached.

100% agree. Yahoo should have started the process a long time ago.

I was just replying to the comment it could be completed in an afternoon.

Post reply on HN