"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…
What do you mean by a password that can't be reasonably brute forced? EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.
Yahoo discloses hack of 1B accounts
531–540 of 596 posts
Re: Yahoo discloses hack of 1B accounts
#532Re: Yahoo discloses hack of 1B accounts
#533One day, this will be Google announcing they've had a breach of this size. Not looking forward to that day.
At the very least they probably wouldn't be using md5.
Re: Yahoo discloses hack of 1B accounts
#534Re: Yahoo discloses hack of 1B accounts
#535Earlier quoted context omitted.
I'm willing to accept that perhaps that was not how my account was compromised but the time frame when this happened was well in line for when this breach supposedly occurred. Regardless, it was some sort of automated spam/phishing emails that were sent from Yahoo's network using my account to contacts on my list. I analyzed the headers of multiple bounced messages that were sent to email addresses no longer in use a…
You reused the password on other websites, I'm guessing. Especially likely if it was a strong (i.e. hard to memorise) password. The bulk hacking attacks that began around Spring 2010 hit all the big webmail providers. The source of the passwords was always, without fail, reversed hashes from breakins at other big websites: https://googleblog.blogspot.ch/2013/02/an-update-on-our-war-... Source: was a tech lead on the…
Nope, not password re-use either. I learned that lesson the hard way over a decade ago.
Regardless, it's something that has always continued to eat at me since I can't say for certain how it happened.
Re: Yahoo discloses hack of 1B accounts
#536Earlier quoted context omitted.
As far as I can tell it wasn't someone spoofing my email address. Emails were sent to people on my contact list and the numerous bounce messages to contacts that no longer had valid email addresses confirmed the origin of the traffic.
It's possible that a contact of yours was compromised, and that contact had many contacts in common with you. And then they spoofed your address.
That's a good theory but in my case the sets of common contacts would be almost nil for that account.
Re: Yahoo discloses hack of 1B accounts
#537DO NOT delete your Yahoo account! In their disclaimer when you delete it, they state: > "[...] we may allow other users to sign up for and use your current Yahoo! ID and profile names after your account has been deleted" Bummer if you forget that it was the password reset email for your Facebook account, huh? Instead of deleting your account, purge it of all data: https://honeypot.net/purge-your-yahoo-account/
This is a terrible policy. Do other email providers have a similar policy?
Microsoft seems to, although I can't find a specific statement from them confirming it: http://windowsitpro.com/blog/recycled-email-addresses-and-ou...
Re: Yahoo discloses hack of 1B accounts
#538Earlier quoted context omitted.
Or you could SHA256 the original password and feed the hash to bcrypt. Remember to use the 64-byte hexadecimal hash, not the 32-byte binary because bcrypt chokes on null bytes. Everyone's been saying "just use bcrypt", but bcrypt has too many gotchas to be the default choice. We really need to work on getting scrypt and argon2 into the most popular programming languages and frameworks a.s.a.p.
> Everyone's been saying "just use bcrypt", but bcrypt has too many gotchas to be the default choice This has got to be the underlying problem of modern security. By the time a best practice is well known, it's no longer best practice.
I think that's a good observation. The implication seems to be that we're not iterating fast enough, or not sufficiently fast in implementing changes/improvements.
On the flipside, isn't there a risk of moving too quickly? There's a certain culture of caution because there's something to be said for "if it aint broke, don't fix it." and even if something is broke, how certain are we that cool new encryption algorithm is better or safer?
Re: Yahoo discloses hack of 1B accounts
#539Earlier quoted context omitted.
Web tokens, for example, don't necessarily include just a session ID. Some include the full session details within its payload. This can be quite useful, actually, because it offloads session-lookup onto the client.
How do you invalidate a JWT server-side without the user interacting with the server ?
I'm not too familiar with JWT, but i have some hands-on experience with Macaroons; the simplest way would be to have a custom caveat of validity set in the token, let's say, a validity GUID, which is an id of server-side record of validity (true/false), e.g. in some database table. Once you set that record of validity to false, the token bearing that GUID automatically becomes invalid.
Otherwise, without server-side changes (such as change of secret key used for signature generation), it is impossible.
Re: Yahoo discloses hack of 1B accounts
#540there's a couple of things that these major providers getting pwned teaches you: 1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays) 2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it) 3) the price of ads/convenience is no lo…
Just use your own domain. That gives you the ultimate power over the your emails regardless of the mail provider you end up using.
haha I don't understand why this comment isn't more prevalent, especially here on Hacker News. Like really, why are so many using vanilla yahoo.com and gmail.com addresses?