Live data from Hacker News

Engineer admits hacking Yahoo accounts searching for images

ktvu.com

61–70 of 99 posts

Re: Engineer admits hacking Yahoo accounts searching for images

#61
post #48
post #28

Earlier quoted context omitted.

Just for the sake of feedback, I found your post confusing. It's not really clear to me what you are saying exactly.

Presumably, this person is airing frustration with common responses to privacy oriented discussions he or she has experienced as participant and/or vicariously. He or she has characterized them ending in ad homenims, whereby the privacy minded individual is construed as politically or intellectually unmoored, similar to Alex Jones. Spedru posits the covert and exposed deviants within companies, that we've exchanged o…

> At least, that's as charitably as I can characterize the comment.

That implies there's an uncharitable characterization. What would that be?

Re: Engineer admits hacking Yahoo accounts searching for images

#62
post #41

I had a YouTube employee login to my account, defaced my video titles and description. And Google wouldn’t do a thing about it. Don’t trust FAANGs and other ‘wangs’ with your private content !

I strongly doubt that Google harbors any negative feelings for you specifically. Do you have any concrete evidence for your claim?

They said someone at Google, not everyone at Google.

Re: Engineer admits hacking Yahoo accounts searching for images

#63

Chris Putnam, who used to work at Facebook, did almost exactly the same thing with videos.

Wait, what? I knew the part where he wormed Facebook and eventually got hired, but I didn't know that. Do you have a source? I only was able to find the part I already know about.

Given that it's a brand new account you can take it with a grain of salt.

Re: Engineer admits hacking Yahoo accounts searching for images

#64
post #36

Earlier quoted context omitted.

Encryption, in email? lol... This is what happens when end-to-end encryption isn't the default in communications software. All email providers are vulnerable to this bar none.

Honestly I'd like to see one of the webmail providers do a decent attempt at gpg. The web migrated from a primarily unencrypted state to an encrypted one - it's not impossible with the right UX.

The attempts have been made, but for some reason it hasn't taken off.

https://github.com/google/end-to-end

https://github.com/YahooArchive/end-to-end

Re: Engineer admits hacking Yahoo accounts searching for images

#65
post #45
post #3

It's sobering to think about this in tandem with the fact that people in the IQ bracket for “engineer” tend to get away with crimes. Honestly, though, at least this can be turned into a concrete example to shoot down “if you don't have anything to hide...” and the like. The banal, lascivious panopticon elicits a real disgust response that might be moving, as opposed to the “shut up you alex jones weirdo” that sticks…

Let me try to rephrase this in a simpler way: This is even more troubling because smart people are less likely to be caught. At least, like Snowden's leaks, this is proof that privacy extremists aren't conspiracy nuts, and hopefully it will open a few eyes to the real danger of giving up privacy. Other comments are right: stop using big words and write plain sentences.

"Some rando engineer stealing private images elicits a real disgust response that might be moving, as opposed to talk of the NSA"

Such a simple point, and look over how many heads it went.

Re: Engineer admits hacking Yahoo accounts searching for images

#66

I had a YouTube employee login to my account, defaced my video titles and description. And Google wouldn’t do a thing about it. Don’t trust FAANGs and other ‘wangs’ with your private content !

Fun story: A GitHub employee renamed my user account because his buddy wanted the name. Nothing was ever done about it.

Re: Engineer admits hacking Yahoo accounts searching for images

#67

End-to-end encryption is the only foolproof was of preventing this. But if that is not possible, training and audit/alerts is the next best thing. Training is important because new employees or new college grads might not be aware of truly how egregious it is to view someone's personal data. It really had to be drilled into the culture. By audits and alerts, I mean that if one employee accesses sensitive information,…

I'd actually love to have this implemented client side - i.e if an employee views accesses your info, the client gets an alert.

Re: Engineer admits hacking Yahoo accounts searching for images

#68
post #36

Earlier quoted context omitted.

Honestly I'd like to see one of the webmail providers do a decent attempt at gpg. The web migrated from a primarily unencrypted state to an encrypted one - it's not impossible with the right UX.

The attempts have been made, but for some reason it hasn't taken off. https://github.com/google/end-to-end https://github.com/YahooArchive/end-to-end

These projects depend on some way to discover public keys, but Keybase is not federated and https://github.com/google/keytransparency/ is way behind schedule.

Re: Engineer admits hacking Yahoo accounts searching for images

#69
post #10

Earlier quoted context omitted.

The updated Yahoo Finance app is really slick, actually. It actually makes me wonder WTF happened to Google Finance? Why did they essentially abandon it? Charts just show up at the top of the results page but there's no dedicated site anymore.

The fall of Google finance is astounding. You can go to https://finance.google.com and search for "Slack" with no results. You can search for "WORK" (Slack's stock symbol) with no results. You have to actually type "NYSE:Work" to have it show up in the search results. It's astonishing.

Not just finance.

Compare Google Street View with Apple's "look around" feature. Night and day. To be fair I haven't looked at street view recently, and Google's coverage is better for now.

Or Gmail spam filtering... I can't even begin to fathom what they are thinking, whoever is in charge of that. I mean really... they have the privilege of working at Google? And... really, that's the level of effort and quality they give us, after 20 years of time with the problem?

Yes I know it can be a hard problem, and an arms race, but the level to which they are utterly falling down with good signals in the data, like the fact that I explicitly signed up for and sometimes read and reply to a mailing list, is mind boggling.

Re: Engineer admits hacking Yahoo accounts searching for images

#70
post #4

The fact he was able to usually means something is lacking in the backend security. Yes, bad employee, but more encryption and security models are required. Back when I was working on share trading software, this was one of our requirements of the system.

Encryption, in email? lol... This is what happens when end-to-end encryption isn't the default in communications software. All email providers are vulnerable to this bar none.

Not sure why I'm getting downvoted. Prove me wrong.
Post reply on HN