Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

561–570 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#561

Post by imaginenore »

joatmon-snoo wrote: post #557
imaginenore wrote: post #555

Earlier quoted context omitted.

MD5 is still not too bad, if properly salted. And if you use multiple rounds of hashing, it can be as slow as Bcrypt. As far as I know, MD5 is still not generally broken, we only found some weaknesses. To prove me wrong you can try and reverse this one (unsalted , just one round): 27c8ac15df9357d92385f59aea2049e0

Even so, the fact that we have the knowledge to generate collisions in MD5 means you really shouldn't be relying on it when there are better alternatives.

Try and generate a collision with the hash I gave. You can't, as far as I'm aware.

We can only generate collisions of carefully crafted sources, not arbitrary ones.

So MD5 is fine, as long as you follow the standard procedure for storing password hashes:

1) Unique salts + long master salt (to prevent rainbow table lookups).

2) Enough rounds of hashing.

3) Don't allow the most common passwords.

4) Don't allow very short passwords.

I'm not saying MD5 is ideal, I use Bcrypt / Scrypt myself. But it's not MD5's fault Yahoo's engineers are lame.

Re: Yahoo discloses hack of 1B accounts

#562

Post by alibee »

jsjohnst wrote: post #407
normaljoe wrote: post #387

Earlier quoted context omitted.

I'm guessing by your handle I know who you are :). Ex-Yahoo super chat moderating guy here, which should let you know me. Wouldn't the upgrade require the accounts to actually login to migrate password? Last I was at Yahoo there was at least 3B junk accounts in UDB. With out knowing details I am guessing that many of the "compromised" accounts fall into that bucket. I get that membership can't just trash junk account…

Just to confirm, purple Yahoo! car in YEF spot ;) As to your question, no, they didn't need to login due to how the hash "upgrade" was done (unlike how Tumblr did it around the same time). I was one of the people in the billion accounts and I definitely have logged in and also changed my password multiple times (also have very high entropy passwords and use TFA).

What's funny is that there's someone currently working at Yahoo with a name scarily similar to yours and I was pretty sure for a moment that you were some random ycombinator person faking being him.

Although...he IS cool.

Re: Yahoo discloses hack of 1B accounts

#563

Post by b_emery »

kstrauser wrote: post #430

DO NOT delete your Yahoo account! In their disclaimer when you delete it, they state: > "[...] we may allow other users to sign up for and use your current Yahoo! ID and profile names after your account has been deleted" Bummer if you forget that it was the password reset email for your Facebook account, huh? Instead of deleting your account, purge it of all data: https://honeypot.net/purge-your-yahoo-account/

If someone knows how to delete more than 100 emails at a time, let me know. I have more the 10k emails, 80% of which are probably spam!

Re: Yahoo discloses hack of 1B accounts

#565

Post by b_emery »

b_emery wrote: post #563
kstrauser wrote: post #430

DO NOT delete your Yahoo account! In their disclaimer when you delete it, they state: > "[...] we may allow other users to sign up for and use your current Yahoo! ID and profile names after your account has been deleted" Bummer if you forget that it was the password reset email for your Facebook account, huh? Instead of deleting your account, purge it of all data: https://honeypot.net/purge-your-yahoo-account/

If someone knows how to delete more than 100 emails at a time, let me know. I have more the 10k emails, 80% of which are probably spam!

... And the answer is, scroll to the very bottom, then delete. I was able to delete over 1000 that way.

Re: Yahoo discloses hack of 1B accounts

#567

Post by intopieces »

manarth wrote: post #211
intopieces wrote: post #76

Earlier quoted context omitted.

I recently decided that if I don't trust the company not to send me spam, I don't need to avail myself of their services. It might not be possible for everyone, but it's made my life a lot simpler.

I don't trust any company to not send me spam. Even if they don't do it today, they may get bought-out, hacked, or otherwise lose control of the data. Even if everything suggests that they won't spam me, I'm not entirely convinced. Even if they're the most upstanding company on the planet, I'm still not convinced. Based on past experience, you understand.

Well, I still have a spam filter algorithm. But I'm overall done balancing multiple personal email accounts because of the liability involved. If it gets hacked (and it's one I don't ever check), will I notice? It seems unwise to have extra email accounts open, potentially with my personal data and associated with my identity online.

It's also a matter of attention: I have a limited amount of it, and tracking multiple email accounts and managing a spam account isn't worthy of it.

Re: Yahoo discloses hack of 1B accounts

#568

Post by Kadin »

kuschku wrote: post #183
chillydawg wrote: post #16

Earlier quoted context omitted.

No, sorry. They're borderline criminally negligent. When you have 1bn passwords stored in raw md5, a decade after the first rainbow tables were published, then you don't deserve anyone's business or your freedom.

Sure, it's borderline negligent. But it's already a godsend compared to what many banks do, storing passwords in plaintext, sending reset passwords via plaintext email, requiring 4-8 character passwords that can only contain digits and a limited set of characters, etc. I'd be more than happy if any bank would follow Yahoo!'s password standards.

Most banks don't have a billion customers. (There are probably a few that do, but not many.)

Re: Yahoo discloses hack of 1B accounts

#569

Post by csallen »

rukittenme wrote: post #190
csallen wrote: post #150

Earlier quoted context omitted.

On a similar note, if you're going to tell someone they're wrong about something, you owe it to them to explain why. Otherwise they won't (nor should they) take your feedback seriously.

I did. I said the person was building a straw-man and can solve it by understanding the topic more. That means research free market capitalism then present an argument.

IMO if you're going to tell someone they're attacking a strawman, you should point out specifically what they've got wrong about their opponent's argument. Otherwise any random person in the world can simply say, "Strawman, read more plz".

Re: Yahoo discloses hack of 1B accounts

#570

Post by syncsynchalt »

wtfishackernews wrote: post #459
throwaway34916 wrote: post #156

Earlier quoted context omitted.

I'd like to believe that. However, I was recently asked to test a new website for an organization I volunteer for, and discovered their "forgot password" flow emailed me my plaintext password. I wrote an explanation of why this was bad, and how it could be fixed, to a non-technical friend of mine who works there; he passed my email to the (Bay Area based!) consulting shop that did their website. The shop sent this re…

submit the website to http://plaintextoffenders.com/

Ironically, hosted on a Y! site.
Post reply on HN