Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Important Message About Yahoo User Security

yahoo.tumblr.com

Post reply on HN
Print view View original

351–356 of 356 posts

Re: An Important Message About Yahoo User Security

#351

Post by evgen »

DashRattlesnake wrote: post #303
pbhjpbhj wrote: post #228

Earlier quoted context omitted.

So, what would be the "signature" of a state-sponsored actor, what in this sort of hack costs money and resources on the scale of "[physical?] suppression of air defenses"?

Isn't the signature of state sponsored hacking basically: 1) careful, narrow targeting 2) sophisticated tools 3) being covert as possible 4) really being covert as possible Going for account info for 500 million accounts doesn't really fit #1.

Going after authentication info (esp. the security questions) _is_ a narrow target. You are probably looking at a couple of tens of GB total. If you get away with it clean you can also then go back in and hit specific targets using that authentication info, so you walk away with a useful basket of data that does not reveal anyone you might have targeted but in turn makes it easier to go after those targets in the future.

Re: An Important Message About Yahoo User Security

#352

Post by alphapapa »

xp84 wrote: post #319
alphapapa wrote: post #227

Earlier quoted context omitted.

EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") could be replaced with: EADDRESS={$1:-noreply@example.com} From the man page: ${parameter:-word} Use Default Values. If parameter is unset or null, the expansion of word is substituted. Otherwise, the value of parameter is substituted. For: EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') you could use: EADDRESS=${EADDRESS/@/%40}

Curious - exactly what man page do you find that in? I've always seen that construction but given that it just uses random punctuation it's impossible to Google it. I don't even know what those are called!!

That's from the Bash man page. :) If you open it in less, you can do `/ :- RET` to search for `:-` and jump to it, which will take you to that part.

Re: An Important Message About Yahoo User Security

#353

Post by MarkMc »

redbeard0x0a wrote: post #248
nodesocket wrote: post #89

You'd think this would affect the stock price, but currently YHOO only trading down 8 cents (-0.18%). I honestly see this all the time. What sounds like really horrible news for a company, does not affect the price. Howerver, some random analyst or reporter who works at the Mercury Star Sun Inquirer writes a negative article or downgrade and the stock tanks. Doesn't make much sense.

It doesn't affect stock price because it doesn't really affect the money being made. There aren't going to be any huge fines that need to be paid, they aren't really going to lose customers explicitly due to this. After all, it was _hackers_ that broke in and did bad things, you can't completely protect yourself from hackers. If the difference between having a secure company and an insecure company were cut and dry,…

I wonder whether a marketing campaign focused on security would be effective. For example, "We are the only accounting software to use end-to-end encryption of your financial data. Don't trust your sensitive data with anyone else!"

Re: An Important Message About Yahoo User Security

#354

Post by monix »

ValentineC wrote: post #334
monix wrote: post #42

Earlier quoted context omitted.

Truth be told, with Google Apps you get phone support and email support usually answers withing 24 hours in my experience. Problem is they couldn't help me much when I had problems. Google Apps has serious limits and contacting support won't help you get around those limits. Most of the time support just tells you what you can already find in their online docs. They only solved two issues for me: (1) when I wanted to…

> They only solved two issues for me: (1) when I wanted to change my primary domain, after 2-3 months of asking them repeatedly, they finally enrolled me into this beta programming and finally changed my primary domain. Were you on the grandfathered free tier? It seems to be quite trivial to change the primary domain if you're on a paid tier.

No, I was on the paid tier. If you're talking about September 2016, maybe. I was talking about 2015, being just an example of how Google's support was unhelpful.
Post reply on HN