Live data from Hacker News

Yahoo, still an awful company

news.ycombinator.com

11–20 of 26 posts

Re: Yahoo, still an awful company

#11

You don't have the password, can't answer the secret questions, and want access to the account? Anybody can forge photo ID sent via fax, I'm glad Yahoo's doing a good job of protecting user accounts.

The questions were set years ago. Though documents can be forged, there have to be other methods to get your rightful account back if you are indeed the owner and there's something messed up with the secret questions. The account isn't on its own accord, it belongs to a _person_. What if a person is in an accident and has amnesia? They forfeit their online identities? Ridiculous....

> Though documents can be forged, there have to be other methods to get your rightful account back if you are indeed the owner and there's something messed up with the secret questions.

No there doesn't. Yahoo has no way of knowing that you are actually the owner. Nor are they obligated to go out of the way to verify ownership (which would pretty much require in-person verification, and be expensive, and even then that only works if the user signed up with personal information matching their real life identity).

> They forfeit their online identities?

Yes, that is how online accounts work. If you don't like it then use a more expensive email service with such features, or take better care of your passwords by writing them down. If things were ran your way, everybody's email would be accessible to every little Mitnick crawling around out there.

Re: Yahoo, still an awful company

#12

Earlier quoted context omitted.

The questions were set years ago. Though documents can be forged, there have to be other methods to get your rightful account back if you are indeed the owner and there's something messed up with the secret questions. The account isn't on its own accord, it belongs to a _person_. What if a person is in an accident and has amnesia? They forfeit their online identities? Ridiculous....

> Though documents can be forged, there have to be other methods to get your rightful account back if you are indeed the owner and there's something messed up with the secret questions. No there doesn't. Yahoo has no way of knowing that you are actually the owner. Nor are they obligated to go out of the way to verify ownership (which would pretty much require in-person verification, and be expensive, and even then th…

Just because social engineering exists, doesn't mean we should have to forfeit our online accounts because businesses can't support the costs of verification in extreme circumstances. I find your stance arcane.

Re: Yahoo, still an awful company

#13

There are ways to extract passwords from iOS backups, that might be a way to go? I believe the entire keychain could be accessed.

I tried Keychain Viewer package from a 3rd party repo on Cydia. It didn't get the Yahoo password unfortunately. If you know of any specific packages to try, please let me know. I got so angry when she said 'I will not give you my name. There is no manager here. Goodbye' that I threw my iPhone at the wall and shattered it to pieces. Now I'm also out $400. I really hate Yahoo .. :-/

Well that was a bit silly.

Re: Yahoo, still an awful company

#14
Firstly, I agree, Yahoo is an awful company (like most). I also feel bad for your situation since of course your parents wouldn't know they need to use 1Pass or that business accounts should always be on their own hosted domain.

That being said, other than Yahoo taking a long time and being potentially rude, they did the right thing. If you don't have the password and can't answer the security questions and or don't have access to the recovery email address then yes you will lose full access. Otherwise, what would stop someone else from comprising someones account? Photo ids and other documents can be faked and or stolen. My 1Password holds all my passwords but if someone was able to do what you desire they could potentially gain access to my email account and then do password resets on my bank accounts and all other accounts and take over everything even without my 1Password accounts. (well I use 2 factor for most but you get the idea).

Now if Yahoo did give you access without providing a password or answer to security questions then yes that is a big security issue.

Once again, still sucks for your parents though. And if really important I imagine you can just jailbreak the iPad and their are ways to see save passwords assuming they saved it on their ipad in mail app or another app possibly. Or if they have a Mac it would be in Keychain.app.

Re: Yahoo, still an awful company

#15
You could use a proxy between the ipad and the server to strip the ssl and get the password.

I have used chralesproxy[1] to do something similar, but you might want to try proxy.app it was just mentioned here on HN a couple days ago[2]

1: http://www.charlesproxy.com/ 2: https://news.ycombinator.com/item?id=7777807

Re: Yahoo, still an awful company

#16

There are ways to extract passwords from iOS backups, that might be a way to go? I believe the entire keychain could be accessed.

I tried Keychain Viewer package from a 3rd party repo on Cydia. It didn't get the Yahoo password unfortunately. If you know of any specific packages to try, please let me know. I got so angry when she said 'I will not give you my name. There is no manager here. Goodbye' that I threw my iPhone at the wall and shattered it to pieces. Now I'm also out $400. I really hate Yahoo .. :-/

There is an app called Keychain Access on the mac which allows you to copy a password to the clipboard. If they're using iCloud keychain and they can login to their iCloud account, you might be able to pull it off that way.

Re: Yahoo, still an awful company

#17
post #16

Earlier quoted context omitted.

I tried Keychain Viewer package from a 3rd party repo on Cydia. It didn't get the Yahoo password unfortunately. If you know of any specific packages to try, please let me know. I got so angry when she said 'I will not give you my name. There is no manager here. Goodbye' that I threw my iPhone at the wall and shattered it to pieces. Now I'm also out $400. I really hate Yahoo .. :-/

There is an app called Keychain Access on the mac which allows you to copy a password to the clipboard. If they're using iCloud keychain and they can login to their iCloud account, you might be able to pull it off that way.

That's what I did when the same happened to me. Enable iCloud Keychain on the iPad and the Mac, wait for the passwords to sync (might take a few minutes) and then open Keychain Access on the Mac and find the password on it.

Re: Yahoo, still an awful company

#18
post #16

Earlier quoted context omitted.

I tried Keychain Viewer package from a 3rd party repo on Cydia. It didn't get the Yahoo password unfortunately. If you know of any specific packages to try, please let me know. I got so angry when she said 'I will not give you my name. There is no manager here. Goodbye' that I threw my iPhone at the wall and shattered it to pieces. Now I'm also out $400. I really hate Yahoo .. :-/

There is an app called Keychain Access on the mac which allows you to copy a password to the clipboard. If they're using iCloud keychain and they can login to their iCloud account, you might be able to pull it off that way.

This won't work. Yahoo credentials are stored for later use as "XYMCOOKIE" which is some kind of hashed authentication mechanism for SMTP and IMAP. And yes, I tried. I also attempted to monitor SSL communications through SMTP and saw the XYMCOOKIE exchange firsthand. This sucks :-/

Re: Yahoo, still an awful company

#19

You could use a proxy between the ipad and the server to strip the ssl and get the password. I have used chralesproxy[1] to do something similar, but you might want to try proxy.app it was just mentioned here on HN a couple days ago[2] 1: http://www.charlesproxy.com/ 2: https://news.ycombinator.com/item?id=7777807

Charles proxy only does HTTPS, not SMTP via SSL. I tried it so I know.

Anyho, I did end up writing a Theos Mobile Substrate tweak to syslog SSL communications and it turns out Yahoo authenticates via a XYMCOOKIE only usable with SMTP and IMAP. So pretty useless for actually logging into yahoo.com

Here's the theos code if anyone else wants to log SSL on their jailbroken device: http://pastebin.com/K6nDG39Y

Re: Yahoo, still an awful company

#20
post #17
post #16

Earlier quoted context omitted.

There is an app called Keychain Access on the mac which allows you to copy a password to the clipboard. If they're using iCloud keychain and they can login to their iCloud account, you might be able to pull it off that way.

That's what I did when the same happened to me. Enable iCloud Keychain on the iPad and the Mac, wait for the passwords to sync (might take a few minutes) and then open Keychain Access on the Mac and find the password on it.

This did not work because the Yahoo password is not stored on the device after being entered. Apparently Yahoo has something called XYMCOOKIE authentication for SMTP and IMAP which is basically just acceptance of a pre-sent hash/cookie. The iPad discards the actual password the first time you enter it and instead stores a XYMCOOKIE.

See here: https://www.google.com/search?q=XYMCOOKIE+authentication

Post reply on HN