Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.
Honest question: why did you need a Yahoo account?
Yahoo discloses hack of 1B accounts
71–80 of 596 posts
Re: Yahoo discloses hack of 1B accounts
#72MD5 in 2016?.I hope yahoo can save itself and tech community all this embarrassment by just going out of business one and for all.Folks at the helm of affairs at yahoo are incompetent. And it is about time government started to persecute incompetent CEO.
It occurred in 2013
Re: Yahoo discloses hack of 1B accounts
#73This is being discussed at https://news.ycombinator.com/item?id=13180101
Re: Yahoo discloses hack of 1B accounts
#74Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.
Is it possible to extract all emails+contacts from yahoo without paying ? furthermore my paypal account is linked to yahoo.
You could use an IMAP client such as Thunderbird to copy your mail away from these clowns to another service that supports IMAP. Fastmail has an IMAP-based bulk importer that in my experience works well. I used it to hoover all of my mail out of GApps and into my FM account.
Re: Yahoo discloses hack of 1B accounts
#75Earlier quoted context omitted.
Bloody hell. Sloppy and incompetent.
I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.
And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem.
I'm not really a software developer but I really can't imagine it being a huge change. Instead of md5(pass) you could probably just change that to secure_hash(md5(pass), salt), add another column in the database for the salt, and rehash all the passwords. Customers wouldn't notice. Rehashing the databases would take a while, but otherwise that's really not a huge amount of work.
Re: Yahoo discloses hack of 1B accounts
#76Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.
But that's where all my junk mail goes...
I recently decided that if I don't trust the company not to send me spam, I don't need to avail myself of their services. It might not be possible for everyone, but it's made my life a lot simpler.
Re: Yahoo discloses hack of 1B accounts
#77Earlier quoted context omitted.
Web tokens, for example, don't necessarily include just a session ID. Some include the full session details within its payload. This can be quite useful, actually, because it offloads session-lookup onto the client.
How do you invalidate a JWT server-side without the user interacting with the server ?
With JSON web tokens (JWT), the client or server must know the secret key used to sign the token in order to validate it, but anyone can view its payload.
Re: Yahoo discloses hack of 1B accounts
#78Earlier quoted context omitted.
Web tokens, for example, don't necessarily include just a session ID. Some include the full session details within its payload. This can be quite useful, actually, because it offloads session-lookup onto the client.
How do you invalidate a JWT server-side without the user interacting with the server ?
Could do it if you knew the JWT token text in theory?
Re: Yahoo discloses hack of 1B accounts
#79"Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a pa…
What do you mean by a password that can't be reasonably brute forced?
EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.