Yahoo hack warning: What happened and should you be worried?
telegraph.co.uk
Yahoo hack warning: What happened and should you be worried?
1–10 of 44 posts
Re: Yahoo hack warning: What happened and should you be worried?
#2Is there a better source? That link just mentions it in the title and then plugs other articles they've posted for the rest of it.
EDIT: This seems like a better source: http://www.telegraph.co.uk/technology/2017/02/16/yahoo-hack-...
Re: Yahoo hack warning: What happened and should you be worried?
#3Jeez, how do they still have a positive net worth? Like seriously, obviously their users & user data is worthless, they don't care about it getting stolen, nor do they seem serious about fixing their dilapidated, insecure systems.
This is just a case of poor management, if Google, Facebook, Twitter and others can figure out how to secure their sites, Yahoo can.
Re: Yahoo hack warning: What happened and should you be worried?
#4Has anybody ever seen Y! Confidential link pop-up in the bottom right corner of some Yahoo! articles which seemed to redirect to an internal corporate site? It came and went away at least a dozen times and in some instances it stayed for days.
Re: Yahoo hack warning: What happened and should you be worried?
#5How could someone forge a cookie after stealing the source code? Did yahoo use a hardcoded private key in the code? Then any developer at yahoo could have broken into an account. That cannot be right.
Re: Yahoo hack warning: What happened and should you be worried?
#6I wonder how many people got that "a forged cookie may have been used" email. I suppose they're sending it even if the chance is remote
Re: Yahoo hack warning: What happened and should you be worried?
#7How could someone forge a cookie after stealing the source code? Did yahoo use a hardcoded private key in the code? Then any developer at yahoo could have broken into an account. That cannot be right.
Maybe the cookie generation had some sort of vulnerability (such as length extension) and looking at the source code helped attackers locate it and exploit it.
Re: Yahoo hack warning: What happened and should you be worried?
#8Jeez, how do they still have a positive net worth? Like seriously, obviously their users & user data is worthless, they don't care about it getting stolen, nor do they seem serious about fixing their dilapidated, insecure systems. This is just a case of poor management, if Google, Facebook, Twitter and others can figure out how to secure their sites, Yahoo can.
And you think those other sites are more secure? The differences are slight. Giant public websites are tricky. It is very hard to deploy real security across such a large team/platform. Even if you make the effort, some security measures simply wont fly, especially in regards to change control or network segmentation. This sort of bug is only one level of the issue.
Open up any random NIST, ISO or even PCI doc to see what is involved above and beyond bug squashing.
Re: Yahoo hack warning: What happened and should you be worried?
#9Has anybody ever seen Y! Confidential link pop-up in the bottom right corner of some Yahoo! articles which seemed to redirect to an internal corporate site? It came and went away at least a dozen times and in some instances it stayed for days.
https://www.google.com/search?q="Y%21+Confidential"
Certainly lots of very confused people keep seeing it.
Re: Yahoo hack warning: What happened and should you be worried?
#10"After disclosing two distinct hacks late last year, one of which implicated a billion users, Yahoo ..."
This is a weird place to use implicated as it makes the reader think those billion users are to blame for the hack. If that's true, it's a human-scale DDOS - no IoT devices needed.