> MD5 hash
JUST
Yahoo discloses hack of 1B accounts
431–440 of 596 posts
Re: Yahoo discloses hack of 1B accounts
#432Earlier quoted context omitted.
Hash the password locally (you are serving JavaScript over SSL right?) and only send the SHA256.
Never trust the client.
This isn't about trusting the client: it's about your endpoint being able to only accept a SHA256 hash sum from the client (thus: length limited) while allowing the user to input arbitrarily long passwords.
They hash in the browser: the only way they can mess with it by producing silly outputs, but that only hurts them.
Re: Yahoo discloses hack of 1B accounts
#433Earlier quoted context omitted.
Yep, people who've run marginally popular sites have dealt with this before. Give someone a text box and watch them try to stuff 4GB of content in it. There has to be a cutoff somewhere, but as you note, it should be well outside of the realm of reasonable password lengths (hundreds of characters).
GitHub is the only website I can think of off the top of my head that doesn't limit to an arbitrarily small number (aka <100). Do you name any other "major" websites that allow 100 character passwords?
Amazon.com allows 128 characters: https://www.amazon.com/gp/help/customer/display.html?nodeId=...
Re: Yahoo discloses hack of 1B accounts
#434Re: Yahoo discloses hack of 1B accounts
#435I logged into my yahoo email in chrome in an incognito tab and it logged into someone else's account. This was probably in 2014 (it could have been in 2013). I wonder if this was related at all.
What's likely is that two people were logging in at once and they ended up with the same credential because someone didn't realize that a servlet is a singleton.
Thanks. I posted to reddit asking what happened but no one ever answered. I thought it had to do with someone leeching my wifi or something causing some "saved data" from IP or something crazy like that. The other user was also living in Japan (I sent him an email on his own account telling him what happened but didn't stick around to see what happened). No, I didn't read his emails but when I looked at "new" expecting mine I saw a few emails about something in Fukuoka Japan (probably where he is or close to where he is).
Re: Yahoo discloses hack of 1B accounts
#436Earlier quoted context omitted.
Apologies, I've heard the details at this point and I can't disclose them. The limit of what I can do is poke holes in the theories that are wrong.
Aren't the details "three years after we were hacked, law enforcement told us that we had been hacked, and we believe them?" The press release explicitly says "We have not been able to identify the intrusion associated with this theft." I especially noticed that the "What are we doing to protect our users?" section doesn't mention anything about Yahoo fixing any security issues. Presumably, then, as a Yahoo engineer,…
> the "What are we doing to protect our users?" section doesn't mention anything about Yahoo fixing any security issues.
"We continuously enhance our safeguards and systems that detect and prevent unauthorized access to user accounts."
At the end of the same paragraph. They're already continuously updating security, before they even knew they were hacked. Three years have passed, so for all they know something in those continuous updates covered this hack.
Re: Yahoo discloses hack of 1B accounts
#437Earlier quoted context omitted.
And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem. I'm not really a software developer but I really can't imagine it being a huge change…
Hashing the hash isn't a good idea, you're reducing the domain of your secure_hash function to the range of md5. The way to do it is to have a "password hash algo version" column and when the user puts in their password, you verify against the hash[algo](password) and rehash with the later version, changing the algo column for that user.
You need to do both. If you only do the latter, then stale accounts which never log in again will never have their passwords upgraded to the more secure hash. Hashing the hash allows you to replace the md5 hashes immediately, and then you can perform the upgrade if/when the user logs in again.
Re: Yahoo discloses hack of 1B accounts
#438Everything will come to light. All our info is being stored somewhere. One day, people who know you will be able to easily search a database of all your information for specific things.
Re: Yahoo discloses hack of 1B accounts
#439Earlier quoted context omitted.
> I don't like 2FA either That seems to be a rather dangerous position to hold these days. I personally dislike that googles 2FA is SMS based (unless there's a way to use e.g. Authy with it that I'm unaware of), but still seems that the only way to be reasonably safe is a strong password and 2FA. I'll add that The authy app on the Apple Watch has made 2FA for services that support it rather painless.
Google also allows you to use google authenticator, but I don't believe they allow third party services.
You can use any TOTP app you like, they all use the same QR code format. You can even build your own, it's all well documented.
Re: Yahoo discloses hack of 1B accounts
#440Earlier quoted context omitted.
Google also allows you to use google authenticator, but I don't believe they allow third party services.
Google does allow other apps (I think it is still same as GAuth) SASS pass and other authenticators with good. But yes they don't allow other token provides like Yubikey or RSA fobs
Google is one of the major proponents of U2F, which is based on hardware tokens. Yubikeys support it, either the cheap U2F-only one or a Neo / 4. I use it and it works flawlessly. At the moment, only Chrome implements the required APIs as far as I know, but Mozilla is working on adding it to Firefox.