Earlier quoted context omitted.
It's because we all keep logging in to change our passwords.
Increased engagement!
They just need more ads on the forgot password page for life lock and they can turn it around!
An Important Message About Yahoo User Security
281–290 of 356 posts
Re: An Important Message About Yahoo User Security
#282I have an account that was definitely compromised. I had completely forgotten this account existed and never used it to sign up for anything else. I was rather surprised when I realized someone had that email and password.
Re: An Important Message About Yahoo User Security
#283Earlier quoted context omitted.
I think it has to do with the sophistication of the attack. If they used multiple zero-days, multiple pieces of custom coded software, and a team of operators working full time for long periods of time then it can be assumed it's a multi-million dollar effort involving a large team of engineers. In such a case the list of potential adversaries can be reduced to corporate or state actors.
It is PR. It makes them seem less incompetent if the attack was performed by a "state sponsored actor".
It seems like the Hillary/Russia thing has everyone thinking, without any evidence, that it's always fake when a state actor is accused. I don't see any reason to doubt them, do people think that countries are not trying to hack into these systems?
Re: An Important Message About Yahoo User Security
#284Earlier quoted context omitted.
Moving to a new email address (and taking all your existing mails with you to the new inbox) is actually far easier than changing phone numbers. Almost all (old) providers let you set up a mail forwarding (to the new provider). But even better, several services let you set up some fetchmail-like program where it imports all the messages from the old provider, e.g. via POP3 or IMAP, and even deletes them with the old…
FastMail has working tech but customer service leaves a lot to be desired. Google is leagues ahead of them there. It's better than Office365 support though.
I guess I'm the outlier here. I signed up for a paid personal account while trying to sign up for a business account. The custom domain option being available for a personal account threw the wrench in my plans.
The tech support rep who answered barely understood their platform and kept giving me incorrect instructions. It took a long while on the phone with that rep to get the account moved to a business account.
Re: An Important Message About Yahoo User Security
#285"We are recommending that all users who haven’t changed their passwords since 2014 do so."
And then don't include an easy link to where users can do that? Great work yahoo.
I found my way to http://profile.yahoo.com but apparently from my machine at an AU University: "profile.yahoo.com’s server DNS address could not be found"
Re: An Important Message About Yahoo User Security
#286"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.
Technically, NSA would also be a "state sponsored actor"
So would any corporation receiving government aid, support, favorits, fundings, grants, etc...
Re: An Important Message About Yahoo User Security
#287Moving email addresses out from one provider and creating another one is more difficult than moving phone numbers (in the latter case, number portability could help, if available). What exactly can an average/common end user do for such incidents, even if it is to avoid them in the future? I use different passwords across accounts, with all of them being somewhat complex or very complex. I have looked at a few differ…
Zoho has a free, ad-free service¹ that allows: 1 domain, 5GB per user e-mail hosting, and 5GB per user document storage for up to 25 users. Pricing seems reasonable beyond that. They provide incentives in the form of additional users for referrals (my referral code: WX7yxEKy). They also support 2-factor authentication. ¹ https://www.zoho.com/mail/zohomail-pricing.html
I tried to sign up for Zoho a few months ago. Absolutely nothing in the signup process worked. I just got messages to "try later." So I gave up after about a day of peridocally retrying.
Re: An Important Message About Yahoo User Security
#288Earlier quoted context omitted.
It is PR. It makes them seem less incompetent if the attack was performed by a "state sponsored actor".
I agree, but the typical PR spin tends to be "a sophisticated adversary". It'd look bad to say an attack was state sponsored if you didn't have good reason to believe it, since that's a pretty specific accusation. My guess is they hired a firm that actually knows security - probably FireEye or Crowdstrike - and their analysts came to that conclusion.
> since that's a pretty specific accusation.
No it's not. It's an entirely vague specification.
Was it the Russians, the Chinese, the NSA?
It's also something they'll never have to prove or verify so from a PR perspective it makes you look far less incompetent if you say 'state sponsored actor' instead of '17 year old high-schooler from Estonia'.
Re: An Important Message About Yahoo User Security
#289Yet another "state actor hit us with 0days" statement.
Re: An Important Message About Yahoo User Security
#290Earlier quoted context omitted.
You're likely under-estimating the amount of CPU time they're willing to throw at the problem. If you have to ask, the answer is "not strong enough for your password. Change your Yahoo password. Change all other passwords that were shared. Stop sharing passwords across sites." On the other hand, my LinkedIn password was 15 base-64 characters, poorly hashed with just SHA-1. As a rough ballpark, cracking it on average…
So salted bcrypt isn't relatively safe?
It's safer than, say, unsalted MD4 (NTLM).
However, the specifics of the hash only make a difference if your password is weak. As long as the hash is non-invertible, use passwords containing at least 96 bits of entropy, and you're fine.
I use https://github.com/kmag/store_password_gpg , which is a 200-line Python script I wrote a while ago to generate a random password and encrypt it using gpg. Any decent password manager should allow you to generate unique, random, per-site passwords.