Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo discloses hack of 1B accounts

yahoo.tumblr.com

Post reply on HN
Print view View original

511–520 of 596 posts

Re: Yahoo discloses hack of 1B accounts

#511

Post by acdha »

Canada wrote: post #119
cmurf wrote: post #111

OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific comp…

> including no lawsuits Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.

There are many who view contacts as a holy right but would also allow you to sign away anything in a contract – so if you accepted a EULA which makes it hard to sue, it's your fault. There's a certain consistency to that position but it completely ignores the scale of the power differential.

Re: Yahoo discloses hack of 1B accounts

#514

Post by ajanuary »

Arubis wrote: post #165

Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.

I tried to change it to a 64 character random 1Password string with numbers, characters and symbols. It complained it was too easy to guess. I submitted the exact same password and it accepted it.

Re: Yahoo discloses hack of 1B accounts

#515

Post by Endy »

newscracker wrote: post #496
Endy wrote: post #153

Earlier quoted context omitted.

If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho. I hate Google's mail interface, I hate the way they make 'conversations' out of discrete emails, and I especially hate their lack of folders. I use GMail begrudgingly at work, and only when necessary, and every time, I look at it and go, "what dipshit ever thought this was a functional way to deal with email?" As a dedicated Windows user, I'm…

> If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho. Zoho needs a phone number verification for signup. Unless you're confident that Zoho will never get hacked like Yahoo has been (multiple times), your phone number could be one more piece of information that's exposed yet again whenever it gets hacked (this also depends on how you use email and if you include your phone number in emails).

I never gave them a phone number...

Re: Yahoo discloses hack of 1B accounts

#516

Post by pbhjpbhj »

haser_au wrote: post #331
pbhjpbhj wrote: post #302

Earlier quoted context omitted.

>It's a huge amount of work // Really? Moving from doing md5(password) to bcrypt(password,salt)? I see organisations make things hard and legacy code-base, yadda, yadda but surely if Yahoo couldn't do this then they couldn't manage scratching their own butt; it really seems like quite a small change in the scheme of things. Like one senior engineer, one afternoon of work (then testing, etc., OK, sure) ... ?

"It Takes 6 Days to Change 1 Line of Code" https://news.ycombinator.com/item?id=13119138 I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation. Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to lo…

You're right on the first count. It wasn't sarcasm, it was a question.

On the storing of hashes though the standard protocol has been to pass the hash in as if it were a password.

Re: Yahoo discloses hack of 1B accounts

#517

Post by pbhjpbhj »

hawkice wrote: post #358
pbhjpbhj wrote: post #292

Earlier quoted context omitted.

>Md5(password) can yield the same result for many different values of password // Not "many different" using the normal constraints of text/numbers/typographical-marks and with maximum password lengths of 32 or so (I'll bet Yahoo's was shorter than that in 2013). Are there any MD5 collisions in [:graph:]{,32} ?

Yes, because MD5 digests are much shorter than 32 characters, even if it's just ascii, so by the pidgeonhole principle there must be. If you're asking if there are _known_ collisions between two messages with less than 32 printable ascii characters -- the answer is likely yes, but there are not known to me and likely not publicly known at all yet.

I thought md5 were 32 characters. But you're right every md5 hash would be in that space, so there must be collisions.

Re: Yahoo discloses hack of 1B accounts

#518

Post by bartl »

metafunctor wrote: post #198
JonDav wrote: post #136

Earlier quoted context omitted.

I thought the whole point of the MD5 vulnerability was that the limit was 2^128 and as such there are more inputs that possible output hashes, meaning more possible input collisions.

All hash functions have collisions. The point is that a good cryptographic hash function makes it very hard to find collisions. The “preimage attack” on a cryptographic hash function tries to find a message that has a specific hash value. That is, you lock down a hash value (the MD5 hash for a password) and try to find a message that hashes to that value (the original password, or any other input that happens to have…

What about Rainbow Tables? (https://en.wikipedia.org/wiki/Rainbow_table#Precomputed_hash...)

Instead of computing the MD5 of a huge number of passwords looking for a match, you simply store the precomputed password and hash pairs in a database table.

Re: Yahoo discloses hack of 1B accounts

#519

Post by djhworld »

Yahoo is so frustrating

I got the email this morning regarding the hack, I've not used Yahoo for a long, long, long time, so figured I would go and delete my account.

So I log in, password in 1password is incorrect, no big deal I go to reset it. They send me an email, I reset the password then go through the account deletion process. It tells me my account is "deactivated" and will be deleted in 90 days

...Once that was done I just so happened to look through my emails to see what Yahoo had sent me in the past and I saw that I had undergone the exact same procedure (deleting my Yahoo account, presumably after news about another hack) about 3 months ago but completely forgotten about it.

So what I must have done today was relogged into my 'deactivated' account that I 'deactivated' back in September, which caused it to become active again, then issued a 'deactivate' request again, so now I have to wait ANOTHER 90 days for it to be deleted.

I've made a note of this fact this time to avoid relogging into Yahoo again...

Re: Yahoo discloses hack of 1B accounts

#520

Post by mtgx »

djhworld wrote: post #519

Yahoo is so frustrating I got the email this morning regarding the hack, I've not used Yahoo for a long, long, long time, so figured I would go and delete my account. So I log in, password in 1password is incorrect, no big deal I go to reset it. They send me an email, I reset the password then go through the account deletion process. It tells me my account is "deactivated" and will be deleted in 90 days ...Once that…

Yes, that's worse than Facebook, which does the same thing, but for 30 days.
Post reply on HN