11–20 of 44 posts
Is there a better source? That link just mentions it in the title and then plugs other articles they've posted for the rest of it. EDIT: This seems like a better source: http://www.telegraph.co.uk/technology/2017/02/16/yahoo-hack-...
That's surely a death knell for Yahoo, as if it needed another?
How could someone forge a cookie after stealing the source code? Did yahoo use a hardcoded private key in the code? Then any developer at yahoo could have broken into an account. That cannot be right.
How could someone forge a cookie after stealing the source code? Did yahoo use a hardcoded private key in the code? Then any developer at yahoo could have broken into an account. That cannot be right.
Jeez, how do they still have a positive net worth? Like seriously, obviously their users & user data is worthless, they don't care about it getting stolen, nor do they seem serious about fixing their dilapidated, insecure systems. This is just a case of poor management, if Google, Facebook, Twitter and others can figure out how to secure their sites, Yahoo can.
And you think those other sites are more secure? The differences are slight. Giant public websites are tricky. It is very hard to deploy real security across such a large team/platform. Even if you make the effort, some security measures simply wont fly, especially in regards to change control or network segmentation. This sort of bug is only one level of the issue. Open up any random NIST, ISO or even PCI doc to see…
Jeez, how do they still have a positive net worth? Like seriously, obviously their users & user data is worthless, they don't care about it getting stolen, nor do they seem serious about fixing their dilapidated, insecure systems. This is just a case of poor management, if Google, Facebook, Twitter and others can figure out how to secure their sites, Yahoo can.
And you think those other sites are more secure? The differences are slight. Giant public websites are tricky. It is very hard to deploy real security across such a large team/platform. Even if you make the effort, some security measures simply wont fly, especially in regards to change control or network segmentation. This sort of bug is only one level of the issue. Open up any random NIST, ISO or even PCI doc to see…
Jeez, how do they still have a positive net worth? Like seriously, obviously their users & user data is worthless, they don't care about it getting stolen, nor do they seem serious about fixing their dilapidated, insecure systems. This is just a case of poor management, if Google, Facebook, Twitter and others can figure out how to secure their sites, Yahoo can.
And you think those other sites are more secure? The differences are slight. Giant public websites are tricky. It is very hard to deploy real security across such a large team/platform. Even if you make the effort, some security measures simply wont fly, especially in regards to change control or network segmentation. This sort of bug is only one level of the issue. Open up any random NIST, ISO or even PCI doc to see…
a) didn't know the company was hacked.
b) claimed they didn't know they were hacked,
c) didn't bother to do proper discovery to quantify the extent of the hack until years later.
Is there a better source? That link just mentions it in the title and then plugs other articles they've posted for the rest of it. EDIT: This seems like a better source: http://www.telegraph.co.uk/technology/2017/02/16/yahoo-hack-...
Jeez, how do they still have a positive net worth? Like seriously, obviously their users & user data is worthless, they don't care about it getting stolen, nor do they seem serious about fixing their dilapidated, insecure systems. This is just a case of poor management, if Google, Facebook, Twitter and others can figure out how to secure their sites, Yahoo can.
The other article linked in this thread[1] attributes this attack to a "state-sponsored actor", which is interesting considering that Google was hacked by such an actor [2], but I'm not sure they ever acknowledged it.
I doubt anyone can say for sure that Facebook and/or Twitter haven't been hacked in such a way. If anything, all we can say is that we haven't heard about it.
[1] http://www.telegraph.co.uk/technology/2017/02/16/yahoo-hack-...
[2] http://www.slate.com/blogs/future_tense/2013/10/30/nsa_smile...