Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

471–480 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#471

Post by zeveb »

XorNot wrote: post #403
cookiecaper wrote: post #328

Earlier quoted context omitted.

Yep, people who've run marginally popular sites have dealt with this before. Give someone a text box and watch them try to stuff 4GB of content in it. There has to be a cutoff somewhere, but as you note, it should be well outside of the realm of reasonable password lengths (hundreds of characters).

Hash the password locally (you are serving JavaScript over SSL right?) and only send the SHA256.

That would lock out anyone who chooses not to execute your JavaScript.

Requiring me to trust your code in order for you to decide whether or not to trust me is asking too much.

Re: Yahoo discloses hack of 1B accounts

#472

Post by mhays »

ausjke wrote: post #270
ausjke wrote: post #24

I'm speechless. More and more are migrating to cloud these days, I expect more and more epidemic leakage will come. I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is…

"Based on further analysis of this data by the forensic experts, we believe an unauthorized third party, in August 2013, stole data associated with a broader set of user accounts, including yours. " "The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers. "…

Suing companies for this sort of thing isn't as easy as you'd think. One of the issues is damages, as in, you need to prove you incurred some sort of tangible harm or damage. This is usually calculated in financial damage. Currently there is a big split in the legal community about whether having your password or other info stolen, without any thing else happening (such as leveraging that information to get inside bank accounts and stealing money) is enough harm to satisfy the damages requirement because there was no financial damage done. Not saying I agree, but it's an issue.

If you can prove financial or other harm resulted from this, then yes, you'd might have a case.

Another avenue you could take is breach of contract or some similar claim. As in, you paid them and formed a contract according to their ToS, and their ToS (I assume) states they use at least reasonable security. Yet they didn't, which would be a breach of contract.

Re: Yahoo discloses hack of 1B accounts

#473

Post by 2sk21 »

kstrauser wrote: post #430

DO NOT delete your Yahoo account! In their disclaimer when you delete it, they state: > "[...] we may allow other users to sign up for and use your current Yahoo! ID and profile names after your account has been deleted" Bummer if you forget that it was the password reset email for your Facebook account, huh? Instead of deleting your account, purge it of all data: https://honeypot.net/purge-your-yahoo-account/

This is a terrible policy. Do other email providers have a similar policy?

Re: Yahoo discloses hack of 1B accounts

#475

Post by aaronbasssett »

amenghra wrote: post #457
bschwindHN wrote: post #443

Earlier quoted context omitted.

Is "just use scrypt" an acceptable answer then? I'm not a security expert and I don't know the advantages of one over the other.

Yes, scrypt is a perfectly fine password hash. If you are currently using something else (say salted md5 or even just plain md5), you can migrate your passwords to scrpyt(current_hash()) without having to change everyone's password and/or wait for everyone to log in. See also this comment thread: https://news.ycombinator.com/item?id=12549110

Don't do that. You've essentially just turned the old hashes into plain-text passwords, and how sure are you that those hashes don't exist in backups anywhere?

Re: Yahoo discloses hack of 1B accounts

#478

Post by mianaezat »

Arubis wrote: post #165

Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.

Stay at home mom Kelly Richards from New York after resigning from her full time job managed to average from $6000-$8000 a month from freelancing at home… This is how she done

,,,,,,,,,,,,,,, http://www.ebiz3.com

Re: Yahoo discloses hack of 1B accounts

#479

Post by kijin »

bschwindHN wrote: post #443
kijin wrote: post #418

Earlier quoted context omitted.

Or you could SHA256 the original password and feed the hash to bcrypt. Remember to use the 64-byte hexadecimal hash, not the 32-byte binary because bcrypt chokes on null bytes. Everyone's been saying "just use bcrypt", but bcrypt has too many gotchas to be the default choice. We really need to work on getting scrypt and argon2 into the most popular programming languages and frameworks a.s.a.p.

Is "just use scrypt" an acceptable answer then? I'm not a security expert and I don't know the advantages of one over the other.

scrypt is okay if you use it correctly. It's too easy to use it incorrectly, though, because scrypt is a low-level algorithm that wasn't specifically designed for password storage. [1]

http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scryp...

In order to be able to tell people to "just use scrypt", we would need to have a sort of standard wrapper that uses the correct parameters by default and produces identical results in every common programming language.

Re: Yahoo discloses hack of 1B accounts

#480

Post by mkj »

2sk21 wrote: post #473
kstrauser wrote: post #430

DO NOT delete your Yahoo account! In their disclaimer when you delete it, they state: > "[...] we may allow other users to sign up for and use your current Yahoo! ID and profile names after your account has been deleted" Bummer if you forget that it was the password reset email for your Facebook account, huh? Instead of deleting your account, purge it of all data: https://honeypot.net/purge-your-yahoo-account/

This is a terrible policy. Do other email providers have a similar policy?

Probably not that terrible if they only do it for accounts that were created and never used. Like all the good GitHub usernames that seem to be abandoned.
Post reply on HN