Yahoo discloses hack of 1B accounts • Hacker News Board

Re: Yahoo discloses hack of 1B accounts

#581

Post by developer2 » Fri, Dec 16, 2016, 2:51 PM UTC

oddevan wrote: post #541

_ao789 wrote: post #502

Earlier quoted context omitted.

I've always wondered when 1Password is going to get hacked..

Won't do much; AFAIK everything is encrypted client-side with your master password. So a hacker could, in theory, get my encrypted database, but by the time they crack my strong password, I will, at the very least, have changed all those passwords.

That's not what a hack against 1Password, LastPass, or similar product will look like. When it happens, it will be because someone manages to commit to the VCS repository of one or more of their client applications (iOS, Android, desktop, etc.). All it takes is a few lines of code to dump the unencrypted contents on the device itself, and post them to some API endpoint or email address.

One commit to a VCS by a disgruntled employee, or an attacker who social engineers credentials to the VCS, and the client applications themselves - which must be trusted to decrypt the contents locally - will be compromised.

This is the problem with proprietary password managers, where the client applications are provided by the company. You cannot vet that software which is running on your device today, let alone all the app updates coming down the pipeline.

Re: Yahoo discloses hack of 1B accounts

#582

Post by prirun » Fri, Dec 16, 2016, 3:06 PM UTC

Alternate (and to me, more believable) explanation: this is a great way to get all of Yahoo's inactive users to sign in, bump the "active in the last year" user count, and goose the company's valuation.

Re: Yahoo discloses hack of 1B accounts

#583

Post by cpplinuxdude » Fri, Dec 16, 2016, 3:42 PM UTC

What's I dislike the most about this situation is that I cannot even shut down my yahoo email account, as it could be re-created by someone else, i.e hijacked.

It's also terrible that such bad password policies are being pushed onto users, yet no guarantee of security is associated with them.

Re: Yahoo discloses hack of 1B accounts

#584

Post by SnacksOnAPlane » Fri, Dec 16, 2016, 4:39 PM UTC

developer2 wrote: post #581

oddevan wrote: post #541

Earlier quoted context omitted.

Won't do much; AFAIK everything is encrypted client-side with your master password. So a hacker could, in theory, get my encrypted database, but by the time they crack my strong password, I will, at the very least, have changed all those passwords.

That's not what a hack against 1Password, LastPass, or similar product will look like. When it happens, it will be because someone manages to commit to the VCS repository of one or more of their client applications (iOS, Android, desktop, etc.). All it takes is a few lines of code to dump the unencrypted contents on the device itself, and post them to some API endpoint or email address. One commit to a VCS by a disgr…

Thank you for writing this. I use a password manager, and whenever I see someone say "it's unhackable because of the encryption" I want to tell them this, exactly. All someone needs to do is to surreptitiously send your password to their own server and all your passwords are owned. It's not difficult.

Re: Yahoo discloses hack of 1B accounts

#585

Post by hcurtiss » Fri, Dec 16, 2016, 4:58 PM UTC

developer2 wrote: post #581

oddevan wrote: post #541

Earlier quoted context omitted.

Won't do much; AFAIK everything is encrypted client-side with your master password. So a hacker could, in theory, get my encrypted database, but by the time they crack my strong password, I will, at the very least, have changed all those passwords.

That's not what a hack against 1Password, LastPass, or similar product will look like. When it happens, it will be because someone manages to commit to the VCS repository of one or more of their client applications (iOS, Android, desktop, etc.). All it takes is a few lines of code to dump the unencrypted contents on the device itself, and post them to some API endpoint or email address. One commit to a VCS by a disgr…

I've often wondered about this. Is there a preferable alternative?

Re: Yahoo discloses hack of 1B accounts

#586

Post by johansch » Fri, Dec 16, 2016, 4:59 PM UTC

Endy wrote: post #163

johansch wrote: post #81

Earlier quoted context omitted.

..and it took them three years to find and report it?

More likely report than find. From what I've seen of their current disclosure policies, and what execs have written on Y!Answers and such, they find the problem, they figure out who did it and how, and then after they've figured out how to fix it, they alert the userbase and the public - in that order. Also, please do remember that we're getting into a different leadership team now at Yahoo; previously they were abso…

The intrusion happened more than a year after Marissa Mayer became CEO of Yahoo.

Re: Yahoo discloses hack of 1B accounts

#587

Post by adultSwim » Fri, Dec 16, 2016, 5:58 PM UTC

When did they know?

Re: Yahoo discloses hack of 1B accounts

#588

Post by allenz » Fri, Dec 16, 2016, 7:45 PM UTC

b_emery wrote: post #565

b_emery wrote: post #563

Earlier quoted context omitted.

If someone knows how to delete more than 100 emails at a time, let me know. I have more the 10k emails, 80% of which are probably spam!

... And the answer is, scroll to the very bottom, then delete. I was able to delete over 1000 that way.

The other way is to search before:"2016/12/15", and delete all the search results.

Re: Yahoo discloses hack of 1B accounts

#589

Post by syncsynchalt » Fri, Dec 16, 2016, 11:00 PM UTC

blauditore wrote: post #577

HappyTypist wrote: post #573

Earlier quoted context omitted.

The other solution (that Yahoo used) is use bcrypt(md5(password)) which allows them to rehash all existing passwords without logging in.

I think that's what he described, plus adding a prefix in order to indicate it's been re-hashed.

That's exactly right, thank you!

Re: Yahoo discloses hack of 1B accounts

#590

Post by KMag » Sat, Dec 17, 2016, 4:01 AM UTC

syntheticnature wrote: post #390

Arubis wrote: post #165

Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.

I've run into off-by-one issues in password length requirements in the past, so if 32 characters is the stated maximum it might only be capable of 31 on the validation side.

That asymmetry in length support strongly suggests they're storing passwords in plain text.