Earlier quoted context omitted.
Not by several orders of magnitude.
Are you saying yahoo has... trillions of users?
Trillions of accounts, based on reputable sources. Users and accounts are different.
Yahoo discloses hack of 1B accounts
491–500 of 596 posts
Re: Yahoo discloses hack of 1B accounts
#492Re: Yahoo discloses hack of 1B accounts
#493Nobody in here mentioned it: phone numbers were leaked, too. Which I consider even worse. I wanted to sign up for Flickr, but the Yahoo login requirement was a big turnoff, because it requires a phone number. This nagged me so much that I never did it. Turns out: right decision. Because my 8 year old phone number isn't target of spam yet.
Phone number being a requirement for signup is bad. There are providers who mandate a valid phone, which they verify through SMS or call, even for paid accounts and services (not just for the payment processing step). Whenever possible, I avoid signing up for such services.
Re: Yahoo discloses hack of 1B accounts
#494Earlier quoted context omitted.
Yes, scrypt is a perfectly fine password hash. If you are currently using something else (say salted md5 or even just plain md5), you can migrate your passwords to scrpyt(current_hash()) without having to change everyone's password and/or wait for everyone to log in. See also this comment thread: https://news.ycombinator.com/item?id=12549110
Don't do that. You've essentially just turned the old hashes into plain-text passwords, and how sure are you that those hashes don't exist in backups anywhere?
Not if you mark the converted versions and try scrypt(oldhash()) on users authenticating with them.
Re: Yahoo discloses hack of 1B accounts
#495Earlier quoted context omitted.
Yes, scrypt is a perfectly fine password hash. If you are currently using something else (say salted md5 or even just plain md5), you can migrate your passwords to scrpyt(current_hash()) without having to change everyone's password and/or wait for everyone to log in. See also this comment thread: https://news.ycombinator.com/item?id=12549110
Don't do that. You've essentially just turned the old hashes into plain-text passwords, and how sure are you that those hashes don't exist in backups anywhere?
Woah! Very good point!
Re: Yahoo discloses hack of 1B accounts
#496there's a couple of things that these major providers getting pwned teaches you: 1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays) 2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it) 3) the price of ads/convenience is no lo…
If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho. I hate Google's mail interface, I hate the way they make 'conversations' out of discrete emails, and I especially hate their lack of folders. I use GMail begrudgingly at work, and only when necessary, and every time, I look at it and go, "what dipshit ever thought this was a functional way to deal with email?" As a dedicated Windows user, I'm…
> If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho.
Zoho needs a phone number verification for signup. Unless you're confident that Zoho will never get hacked like Yahoo has been (multiple times), your phone number could be one more piece of information that's exposed yet again whenever it gets hacked (this also depends on how you use email and if you include your phone number in emails).
Re: Yahoo discloses hack of 1B accounts
#497Earlier quoted context omitted.
if the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.
It sort of does matter for bcrypt, surprisingly: http://security.stackexchange.com/questions/39849/does-bcryp... In the interests of hewing closest to cryptographic reality, I design not to allow a password longer than the algorithm can usefully use.
That's just a bug. Truncation invalidates the 'stored properly' part of the statement.
Re: Yahoo discloses hack of 1B accounts
#498Re: Yahoo discloses hack of 1B accounts
#499Earlier quoted context omitted.
Is it possible to extract all emails+contacts from yahoo without paying ? furthermore my paypal account is linked to yahoo.
Yes, you need to scrape their webpages. 10 years ago when I pulled everything from my Yahoo acct, there were several choices of open source scripts which could do it.
No, it's no longer necessary to resort to scraping the webmail pages. You can easily setup a client like Mozilla Thunderbird for IMAP with Yahoo and get all your mails and folders on to it for free. I have done this recently and it has been working. Only the ad-free webmail from Yahoo is a paid option.
Re: Yahoo discloses hack of 1B accounts
#500Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.
Is it possible to extract all emails+contacts from yahoo without paying ? furthermore my paypal account is linked to yahoo.
Download Mozilla Thunderbird, setup a new account with your Yahoo credentials and it will auto-configure it for IMAP. This does not require any payment. I did it recently and am still using it. You need to setup folder synchronization for offline downloads of all the messages and folders you have on your account.