Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Important Message About Yahoo User Security

yahoo.tumblr.com

Post reply on HN
Print view View original

301–310 of 356 posts

Re: An Important Message About Yahoo User Security

#301

Post by douche »

jrnichols wrote: post #300
douche wrote: post #299

Earlier quoted context omitted.

Reminded me to delete my LinkedIn account...

Is that even possible? I got a password reset email for a LinkedIn account that I thought I had deleted years ago. I know that sometimes logging in can reactivate an account, but it's been YEARS now. And it was like I was always there. LinkedIn is like dallisgrass. pesky stuff to get rid of.

It seems to have worked; at least the recruiters have stopped sending me emails every day about jobs that don't match anything in my resume.

Re: An Important Message About Yahoo User Security

#303

Post by DashRattlesnake »

pbhjpbhj wrote: post #228
evgen wrote: post #167

Earlier quoted context omitted.

If I hand you an F-16 and you use it to do damage that would indicate possible US air force involvement. If the F-16 that attacked me was preceded by advanced ECM, suppression of air defenses using stand-off munitions, and was performed in a particular precision attack pattern then US air force involvement would be much more likely. These signatures are not just about the tools, but the opsec and procedures that the…

So, what would be the "signature" of a state-sponsored actor, what in this sort of hack costs money and resources on the scale of "[physical?] suppression of air defenses"?

Isn't the signature of state sponsored hacking basically:

1) careful, narrow targeting 2) sophisticated tools 3) being covert as possible 4) really being covert as possible

Going for account info for 500 million accounts doesn't really fit #1.

Re: An Important Message About Yahoo User Security

#304

Post by joemi »

nikcub wrote: post #293
supergirl wrote: post #77

"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.

Yahoo shouldn't be doing the attribution, it's a conflict of interest[0]. At the moment the standard for incident disclosure is "eventually disclose the leak to users", which some companies, like Yahoo in this case, really stretch. I'd like to see the standard become engaging an outside firm and have them release as much information as possible so that the techniques used, information stolen, potential attribution et…

> Yahoo shouldn't be doing the attribution, it's a conflict of interest

What about that would be a conflict of interest? (Just curious)

Re: An Important Message About Yahoo User Security

#305

Post by nylsaar »

newscracker wrote: post #38
Sami_Lehtinen wrote: post #26

Earlier quoted context omitted.

Why not Tutanota?

Thanks so much for pointing this out. I had never heard of it before and had a look. It looks good and has a team whose values I identify with. What's more, it has flexibility in billing that looks quite attractive (users, storage, aliases, etc.). Unfortunately, it does not support IMAP or POP, which I prefer just to have local copies of mails as a backup. A paid account looks appropriate (and would help the company…

I think startmail has a free week trial you might want to check out.

Re: An Important Message About Yahoo User Security

#306

Post by mkagenius »

nikcub wrote: post #293
supergirl wrote: post #77

"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.

Yahoo shouldn't be doing the attribution, it's a conflict of interest[0]. At the moment the standard for incident disclosure is "eventually disclose the leak to users", which some companies, like Yahoo in this case, really stretch. I'd like to see the standard become engaging an outside firm and have them release as much information as possible so that the techniques used, information stolen, potential attribution et…

Why would a nation state actor sell it for such cheap in black market..

Re: An Important Message About Yahoo User Security

#308

Post by lesdeuxmagots »

BinaryIdiot wrote: post #258
lesdeuxmagots wrote: post #193

Earlier quoted context omitted.

I'm not sure what you're trying to say. The algorithms adjust for bots, spam, cross-platform duplication, etc. 900M - 1B is defined as the Monthly Active Users figure. Naturally, there are areas where we know the algorithms are not translating the inputs to real users with 100% fidelity, but we know that the discount is relatively minor, not nearly as substantial as youre suggesting. Multiple counter-parties had thei…

> 900M - 1B is defined as the Monthly Active Users figure. Okay that's the disconnect. Monthly uniques typically count is unique accesses of a web page by non-bots / spam. This is how I've seen it defined in every analytics software package I've ever used. Monthly active users is a vastly different concept as it implies repeat access within the month. Though judging by the downvotes on my parent comment I'm guessing…

Sorry, my mistake for being loose with my own terminology. I thought it was implied that I meant unique users, which, given my own comment about terminology, was a bit hypocritical of me.

Re: An Important Message About Yahoo User Security

#309

Post by schoen »

perfectfire wrote: post #154
TallGuyShort wrote: post #147

Earlier quoted context omitted.

The other possibility is somehow intercepting them between SSL termination and hashing.

That's a good point. If they got ahold of Yahoo's cert key they could even grab passwords before SSL termination.

Not passively anymore: login.yahoo.com is negotiating PFS ciphersuites which the private key can't decrypt without a copy of the ephemeral ECDHE parameters.

Re: An Important Message About Yahoo User Security

#310

Post by pfarnsworth »

newscracker wrote: post #5

Moving email addresses out from one provider and creating another one is more difficult than moving phone numbers (in the latter case, number portability could help, if available). What exactly can an average/common end user do for such incidents, even if it is to avoid them in the future? I use different passwords across accounts, with all of them being somewhat complex or very complex. I have looked at a few differ…

I create a new email address for every new service I have, with a different password. I literally have 120 different emails that all funnel into the same email address via forwarding.
Post reply on HN