Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verizon just raised a big warning flag for Yahoo

washingtonpost.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Verizon just raised a big warning flag for Yahoo

#41

Post by bartl »

syshum wrote: post #40
ghughes wrote: post #36

Earlier quoted context omitted.

Given that not too long ago they were publicly shamed for implementing an invasive tracking system that completely undermines their customers' privacy, [1] you'll have to do a little better than "some past experience" and "from what I've seen" if you want your assertion that "Verizon is very serious about security" to be taken seriously. [1] https://www.wired.com/2014/10/verizons-perma-cookie/amp/

One has nothing to do with the other You can be VERY good at systems security, while simultaneously wanting to violate your customers privacy....

Well ironically, in this case, Verizon's problem with Yahoo is allegedly about customers' privacy.

Re: Verizon just raised a big warning flag for Yahoo

#42

Post by bartl »

flukus wrote: post #25
PeCaN wrote: post #15

Earlier quoted context omitted.

Probably because only women can be discriminated against. …Well, that, or because it's most definitely off topic.

> Probably because only women can be discriminated against. I agree with the off topic part. But that statement is beyond crazy if you're serious.

I think it was sarcastic.

Re: Verizon just raised a big warning flag for Yahoo

#43

Post by [deleted] »

flukus wrote: post #25
PeCaN wrote: post #15

Earlier quoted context omitted.

Probably because only women can be discriminated against. …Well, that, or because it's most definitely off topic.

> Probably because only women can be discriminated against. I agree with the off topic part. But that statement is beyond crazy if you're serious.

[deleted]

Re: Verizon just raised a big warning flag for Yahoo

#45

Post by ewzimm »

oneloop wrote: post #17
ewzimm wrote: post #11

Earlier quoted context omitted.

I'm outing you as a Russian shill, but yes, there's a strange amount of Russian-blaming going on. Meanwhile, Russians are distancing themselves from American software companies. I would too in this environment.

I'm outing you as a moron.

Just to be absolutely clear, I'm not seriously suggesting that you're a Russian shill. That's meant as sarcasm and immediately contradicted by my next statement. I'm seriously concerned about the amount of Russian-blaming going on. Although I'm making fun of the people who blame everything on Russia, the chance for war is serious business.

Re: Verizon just raised a big warning flag for Yahoo

#47

Post by heroprotagonist »

ghughes wrote: post #36
heroprotagonist wrote: post #5

While I suspect some of this is posturing for a better price, I'm certain from some past experience that Verizon is very serious about security. A lot of large enterprise take an approach my colleagues have referred to as 'rubber stamp security', that checks boxes in a compliance report while still remaining largely ineffective. For example, these companies buy tools and install them, but then never configure them pr…

Given that not too long ago they were publicly shamed for implementing an invasive tracking system that completely undermines their customers' privacy, [1] you'll have to do a little better than "some past experience" and "from what I've seen" if you want your assertion that "Verizon is very serious about security" to be taken seriously. [1] https://www.wired.com/2014/10/verizons-perma-cookie/amp/

Well, it is just anecdotal. Feel free to withhold judgement, it is just an anonymous internet comment instead of a detailed report from a thorough study. I'm certainly not giving you my CV. However, I was referring to what I saw of their stance towards their own security, rather than toward the privacy of their customers.

Still, I think the point that there's more for Verizon to worry about from Yahoo than the direct impact of the exposed customer data is a valid one. Failure to discover (if we believe them), or at least a failure to disclose, a breach for close to two years, does not speak well for them. Maybe this breach was only possible during some temporary time period two years ago, but it's also possible that whatever allowed the breach was open for a long time, allowing further opportunity to exploit other services on their network. The claim that it was possibly a 'state actor' either means they don't know and are covering their incompetence, or it was a fairly advanced threat that could potentially still be in place or even have expanded its footprint since 2014.

Re: Verizon just raised a big warning flag for Yahoo

#48

Post by jessaustin »

oneloop wrote: post #8
jessaustin wrote: post #4

But Silliman made clear on Thursday that the “state-sponsored” nature of the breach would have no bearing on the analysis of materiality. “From a legal perspective,” he said, “the question . . . ‘is it a state-sponsored attack?’ isn't really relevant in terms of what we're looking at. The question is whether this [had] a material or an adverse effect on the asset we are buying.” One can see why he didn't want to call…

Come on... WikiLeaks drops shit on Clinton, blame Russia. Mayer does a terrible job, blame Russia. Who wants to bet that next we'll hear Elizabeth Holmes blaming Russia for her silly Edison machines not working properly.

What media conglomerate did China pay off? They used to get blamed for all the magical unavoidable super hacking... well, them and North Korea both.

Re: Verizon just raised a big warning flag for Yahoo

#49

Post by JohnTHaller »

rms_returns wrote: post #33
JohnTHaller wrote: post #32

Earlier quoted context omitted.

It's certainly not a lot of people's experience. Youtuber boogie2988 (3.5m subscribers) had his accounts hacked and his channel deleted (his primary source of income) via a Verizon social engineering hack. The hack via Verizon gained the hackers access to his Twitter, YouTube/Google accounts, even his PayPal account.

Here are more details about that[1]. I'm still surprised how they could have gained access to his Youtube and Twitter just by using his phone number. [1] https://www.reddit.com/r/boogie2988/comments/4psg4x/i_was_ha...

If you know someone's Gmail account used for YouTube and have access to their cell phone to receive text message verifications for account resets, you have full access.

Being able to verify a code sent to the mobile phone registered with the account is used as proof of identity for account recovery by basically everything online except banking.

Re: Verizon just raised a big warning flag for Yahoo

#50

Post by rms_returns »

JohnTHaller wrote: post #49
rms_returns wrote: post #33

Earlier quoted context omitted.

Here are more details about that[1]. I'm still surprised how they could have gained access to his Youtube and Twitter just by using his phone number. [1] https://www.reddit.com/r/boogie2988/comments/4psg4x/i_was_ha...

If you know someone's Gmail account used for YouTube and have access to their cell phone to receive text message verifications for account resets, you have full access. Being able to verify a code sent to the mobile phone registered with the account is used as proof of identity for account recovery by basically everything online except banking.

k. But in boogie2988 case, did the hacker got access to his actual cell phone or just cell number? That's not clear.
Post reply on HN