45 ms·

An Important Message About Yahoo User Security

510 points by runesoerensen 10y ago

throwawayReply 10y ago
Is there some kind of "statute of limitations" thing that means we're suddenly finding out about a string of breaches from 2012 now? Or is there some group that is trading breach data privately that have themselves been compromised so that data coming from them is finally leaking out? I'm now more worried about the 4 year delay in these things coming to light than the effect of the breaches themselves given how many times I now show up on haveibeenpwned.
- hap1o 10y ago
  I am curious to know what happened in 2012 that all these breaches occurred. I assume they are holding the data, and trying to squeeze what they can out of it all the way through. However this year there seems to have been a lot of massive breaches that year. does it all stem from one hack? 200m Yahoo accounts could lead to at least a few million LinkedIn accounts I would assume, maybe not as many as was actually compromised in the LinkedIn breach, but still. I just want to know if the same exploits were used in all of these instances. Or maybe they have just found backups for all these companies this year from 2012 and are using those. I don't even how that would happen.
  - throwawayReply 10y ago
    If they found a yahoo employee credentials in the linkedin hack (or vice-versa) then they don't need a million accounts, just those credentials. "Hackers who used an employee’s password, re-used from the LinkedIn breach, to access Dropbox’s corporate network and steal the user credentials" - from a unnamed source quoted in a techcrunch article. So maybe they also managed to traverse from linkedin to Yahoo or Yahoo to linkedin through similar password re-use.
zymhan 10y ago
Does this mean Verizon would assume liability if the purchase closes before a lawsuit/fine is brought?
- ActsJuvenile 10y ago
  Verizon legal team might have forced Yahoo to disclose this in order to remove the liability before acquisition.
  - eric_h 10y ago
    Very interesting point. This suggests to me that Yahoo has been sitting on this for quite some time and only revealed it when their hand was forced...
newscracker 10y ago
Moving email addresses out from one provider and creating another one is more difficult than moving phone numbers (in the latter case, number portability could help, if available). What exactly can an average/common end user do for such incidents, even if it is to avoid them in the future? I use different passwords across accounts, with all of them being somewhat complex or very complex. I have looked at a few different paid service providers before, but they're all very expensive. Expensive for me is anything that charges more than $20 per year, or worse, charges that amount or higher for every single email address/alias on a domain. My use of email for personal purposes is writing about a handful of emails in an entire year, but on the receiving side, I get a lot of emails - most of them somewhat commercial in nature (like online orders, bank statement notifications, marketing newsletters I've explicitly signed up for, etc.). I also have several email addresses, each one used for a different purpose and with some overlap across them. It seems like web hosting has become extremely cheap over time whereas email hosting has stagnated on the price front for a long time.
- GCA10 10y ago
  This hack involves 2012 passwords, according to the Re/code coverage. If you've still got the same password, that's a problem. If you're changing passwords every year or so, your vulnerability drops. Two-factor identification on any account that involves your money is a good idea, too.
  - newscracker 10y ago
    It's true that this hack was in 2012, but the information lost is not only passwords but also account information like name, addresses, other linked email addresses, etc. So those who changed their passwords after this hack still have something to worry about.
    - GCA10 10y ago
      True, but if you've got any internet presence at all, it's already pretty straightforward to associate your name and email address (or addresses). Tools like Datanyze, Spokeo, SellHack, etc. do that routinely. Having 120 million Yahoo records available for mischief (without current passwords) makes things slightly worse, but not much.
heroiccyber 10y ago
You can verify if your credentials have been compromised at https://heroic.com https://heroic.com
- FT_intern 10y ago
  Is your service any better than haveibeenpwned.com ?
  - heroiccyber 10y ago
    HIBP is a great service and was the first one on the scene. HEROIC has more breached records than HIBP and with a free account on HEROIC you can see more details about how you have been compromised along with better search capabilities.
    - honkhonkpants 10y ago
      But apparently not a strict superset of HIBP, since your site shows nothing for an address that I know was exposed in multiple hacks/leaks.
      - heroiccyber 10y ago
        We should have everything that HIBP has plus another .5 billion.
    - elfchief 10y ago
      HIBP is still useful to me, at least, because it will let me find breaches for my entire domain, rather than just for specific email addresses. This is useful since I use a different email address per-site (username-somestring@domain), so just being able to search on my base email address on HEROIC isn't likely to turn much up...
- guessmyname 10y ago
  Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application/x-www-form-urlencoded; charset=UTF-8" \ -H "referer: https://heroic.com/email-security/" \ -H "x-requested-with: XMLHttpRequest" \ -H "origin: https://heroic.com" \ -H "authority: heroic.com" \ --data "action=heroic_scan_email" \ --data "data[email]=${EADDRESS}" \ --compressed --silent ) if command -v php &> /dev/null; then php -r "print(json_encode(unserialize(urldecode('${RESPONSE}'))));" fi PS: Using serialized data is a bad idea: https://www.owasp.org/index.php/PHP_Object_Injection https://www.owasp.org/index.php/PHP_Object_Injection
aaronkrolik 10y ago
How is it that 200M user accounts are worth only $1800?
- idlewords 10y ago
  It's Yahoo.
  - JustSomeNobody 10y ago
    And 2012.
- talmand 10y ago
  Bah, I would have topped out at $50. The vast majority of accounts from a free email service would be worthless.
deleted 10y ago
[deleted]
beezle 10y ago
Anybody know what hash they use at yahoo for account passwords?
- user731955373 10y ago
  rot13
- KMag 10y ago
  You're likely under-estimating the amount of CPU time they're willing to throw at the problem. If you have to ask, the answer is "not strong enough for your password. Change your Yahoo password. Change all other passwords that were shared. Stop sharing passwords across sites." On the other hand, my LinkedIn password was 15 base-64 characters, poorly hashed with just SHA-1. As a rough ballpark, cracking it on average comes out to about 500 times all of the work that has ever been put into BitCoin mining. I still changed my password after the breach. Why not?
  - Fej 10y ago
    So salted bcrypt isn't relatively safe?
    - KMag 10y ago
      It's safer than, say, unsalted MD4 (NTLM). However, the specifics of the hash only make a difference if your password is weak. As long as the hash is non-invertible, use passwords containing at least 96 bits of entropy, and you're fine. I use https://github.com/kmag/store_password_gpg https://github.com/kmag/store_password_gpg , which is a 200-line Python script I wrote a while ago to generate a random password and encrypt it using gpg. Any decent password manager should allow you to generate unique, random, per-site passwords.
- throwawayyahoo2 10y ago
  for the longest time, it was unsalted MD5. it may still be. very easy to crack with a rainbow table.
norea-armozel 10y ago
I think my only concern is what data I had attached to my Yahoo account (for Flickr) which I think they required me to tie to a phone number. So I guess that means I can expect people trying to abuse that phone number as a point of identification in identity theft attempts. Oh joy.
willow9886 10y ago
Yahoo's login experience has been horrible lately. This must be a contributing factor.
- tunap 10y ago
  Create a bookmark to your inbox when logged in. Next time you log-in, immediately click your inbox bookmark so you can skip all the irritating "give us your phone number or you will suffer greatly" pages. As for personal info, don't give it to them. Anyone who doesn't require it by law gets mis-info, this has served my privacy & security since the turn of the century. EVERYONE wants your phone number "for security" these days* , and yet, when they bungle their security yours goes out the window with a million+ others'. *Your phone number is marketing gold to those who believe they value your personal, identifiable data more than you do. edit: more asterisks, less italics
- mod 10y ago
  I had a terrible experience recently. It was so dumb I wrote a rant to a no-reply address they had sent me some options about. I logged in from my only computer, they presented my recovery email addresses with check boxes. I didn't read the prompt, but I selected the one I still use (one was so freaking old--a netzero address). It seemed to remove it from the list, which was the opposite of the behavior I'd expect. I literally didn't care enough to add it back. If I get locked out of my yahoo account...so? Anyway, then they sent me a "new device" email that said I should login from one of my normal devices. It was my normal device, I just hadn't logged in for maybe...years? Surely they can alter the logic to not say something so stupid.
realraghavgupta 10y ago
using 2 Factor Authentication comes handy in situations like this.
- slg 10y ago
  Not necessarily. 2FA only prevents access to the account, but passwords are both hard to decrypt and easy to change so I'm not too concerned about that. The real valuable data in this hack are the names, emails addresses, DOBs, telephone numbers, and security questions. Those things are very hard to change and would be very valuable data points for anyone trying to steal your identity or social engineer themselves in other accounts of yours.
  - realraghavgupta 10y ago
    Yes, you are right. That's really valuable data for anyone impersonating someone. But its becoming more and more difficult which service to use that might protect the information. Hopefully in services like protonmail, everything is encrypted.
leesalminen 10y ago
I wonder how many dummy accounts from the mid-2000s of mine were included in that. I was born in 1990, and my insecure online behavior from 2000-2005 scare me. Hopefully HaveIBeenPwned gets their hands on this so I can scan for my teenage usernames.
- JangleBarney 10y ago
  Same here. I've gotta have at least 10 accounts from 1996-2002.
deleted 10y ago
[deleted]
St-Clock 10y ago
"encrypted or unencrypted security questions and answers" This is bad right? Like, worse than your hashed password and your mailing address. The only good thing is that if I ever implement security questions, I'll remember Yahoo! and how it could end up in the wrong hands.
- nilved 10y ago
  Don't implement security questions. Those are no good to begin with.
  - graeme 10y ago
    Don't many sites require them?
    - sushid 10y ago
      Yes but the parent is telling you, as a developer, don't use them. Personally, I'll make up a fake answer (e.g. What's your favorite pizza topping? A:338192). Just make it something reasonably short as you might have to repeat it to a live customer service agent.
      - pbhjpbhj 10y ago
        "My fave pizza is colon backslash open-cursive-brace pipe ay eight dollar with cheese".
  - satysin 10y ago
    You mean asking me my mother's maiden name or what school I went to isn't bullet proof?!
    - dhimes 10y ago
      The problem is that people give the right answers. Mother's maiden name? Mozilla. School? Mio Fit.
justinv 10y ago
"by what it believed was a "state-sponsored actor.""
- patrickmn 10y ago
  The de facto excuse to use when you get hacked these days. Who could possibly defend against an entire nation? And it's incredibly easy to "prove" that some Russian IP accessed your system at some point, therefore Putin is directly involved and no amount of security would've prevented him from getting in.
  - dwightgunning 10y ago
    Would a hacker who claims unemployment benefits be considered state sponsored?
    - hood_syntax 10y ago
      Truly food for thought...
  - rawnlq 10y ago
    Sidetracked: Can someone explain to me why there seem to be a culture of blackhat hacking from Russia? Do their CS degrees have mandatory advanced courses on how to exploit vulnerabilities for lulz? Not really even saying this in a mean way. Almost all top CS programs in the US have assignments on writing buffer overflow attacks and reverse engineering in their mandatory intro to systems course. But I don't seem to see them going off on their own to learn more sophisticated attacks and acutally using it in the real world. Why does russia seem to foster so many blackhats? Or is it just the proxies that are hosted there?
    - prodigal_erik 10y ago
      Maybe it's just that the avails of theft and fraud are not limited by prevailing wages in your area, so are relatively a better deal?
- 10y ago
Spydar007 10y ago
>Yahoo believes that information associated with at least 500 million user accounts was stolen That tops the HIBP list for the most stolen.[1] [1] https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites
nostromo 10y ago
"The data stolen may have included names, email addresses, telephone numbers, dates of birth and hashed passwords but may not have included unprotected passwords, payment card data or bank account information, the company said." What's the difference between "may have" and "may not have" in this context? It seems like they're saying anything could have been stolen.
- TallGuyShort 10y ago
  Or perhaps wasn't stolen, during the year that may or may not have been 2014. Sorry, ALLEGEDLY 2014.
- rezashirazian 10y ago
  It's lawyer talk. They don't want to say anything definitively in case they have to walk it back.
- arcticfox 10y ago
  That is an incredibly deceptive sentence. They should have listed everything under "may have", unless I'm misunderstanding because they used some convoluted English.
  - hood_syntax 10y ago
    No, it's intentionally deceptive.
  - Jarwain 10y ago
    The way I read it is that the stolen data has a relatively high probability of including the first set of things, but a relatively low probability of including the second set of things. They don't want to say definitively for whatever reason.
    - Bartweiss 10y ago
      I take it as "as far as we know, these weren't stolen, but don't sue us if we turn out to be wrong".
mtgx 10y ago
> We have confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor. GCHQ? Although GCHQ seems to have hacked them even earlier than that. https://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo https://www.theguardian.com/world/2014/feb/27/gchq-nsa-webca...
supergirl 10y ago
"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.
- sickbeard 10y ago
  all hacks have signatures.. usually the tools used by the hackers to compromise the system.
  - talmand 10y ago
    That means nothing. If a hacker somehow managed to get tools previously used by a state doesn't mean the hacker now works for the state.
    - serf 10y ago
      didn't a cache of supposedly state-sponsored tools just get auctioned off by a group who (supposedly) compromised a machine which was under the ownership of one of the three-letter groups?[0] Seems to give more credence to the viewpoint that the tool doesn't indicate the perpetrator too easily. [0]:https://www.wired.com/2016/08/hackers-claim-auction-data-stolen-nsa-linked-spies/ https://www.wired.com/2016/08/hackers-claim-auction-data-sto...
      - evgen 10y ago
        If I hand you an F-16 and you use it to do damage that would indicate possible US air force involvement. If the F-16 that attacked me was preceded by advanced ECM, suppression of air defenses using stand-off munitions, and was performed in a particular precision attack pattern then US air force involvement would be much more likely. These signatures are not just about the tools, but the opsec and procedures that the hackers used to deploy the tools, how they moved laterally to the target, and how they exfiltrated the information. It is the whole package that identifies a real state-sponsored actor vs a freelancer with access to a bag of zero days.
geraldcombs 10y ago
I wonder what percentage of those 500 million accounts correspond to real human beings. Much of the spam on the sites I run come from what appear to be fake @yahoo.com accounts.
jap 10y ago
I wonder if "500M" is a silly way of saying all user account details were stolen.
- zobzu 10y ago
  "yes"
munk-a 10y ago
Does the incredible delay of this announcement count as being grossly negligent? Maybe they're trying to devalue their stock prior to the merger? Similar to what Caris did: http://www.law360.com/articles/684195/caris-employees-get-16-3m-after-co-sharply-devalued-stock http://www.law360.com/articles/684195/caris-employees-get-16...
- bananabill 10y ago
  Unfortunately probably not. All they have to say is that they weren't sure until now.
Alex3917 10y ago
This is where the phrase "adverse material fact" comes into play.
pavornyoh 10y ago
Can anyone elaborate as to why this is being announced two years later? Why now and not when it happened?
- frandroid 10y ago
  Because they didn't know it at the time?
- brian-armstrong 10y ago
  I believe a common reason for this is that they don't want to announce it until they're completely sure the breach is gone and that they have control of things again. Announcing that it happened and that it's ongoing forces them to either cease operations or face liability.
  - malz 10y ago
    So covering up a known in-progress security breach is standard procedure? Instead of telling your users to change their passwords and so on? Personally, I demand criminal investigation and at least a $1000 fine per account breached.
    - dhimes 10y ago
      Yeah, that sucks because I have my business stuff with them (I know, I know). On the bright side I didn't receive an email so maybe they didn't get the biz accounts. Changed my pw anyway. And something's changed with their biz accounts anyway- it's been sold/rebranded or something and I'm not sure where the future lays... :[
    - brian-armstrong 10y ago
      I don't think they actually broke any laws. How do you expect them to be charged for your demands?
      - malz 10y ago
        You got me, they only broke the law in 47 states. http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx http://www.ncsl.org/research/telecommunications-and-informat...
nodesocket 10y ago
You'd think this would affect the stock price, but currently YHOO only trading down 8 cents (-0.18%). I honestly see this all the time. What sounds like really horrible news for a company, does not affect the price. Howerver, some random analyst or reporter who works at the Mercury Star Sun Inquirer writes a negative article or downgrade and the stock tanks. Doesn't make much sense.
- TylerE 10y ago
  Yahoo has zero value as a web property. What value there is on the name and the advertising side.
  - nkozyra 10y ago
    To the parent comment's point, this is the sort of thing that should have a negative effect on brand/name.
  - BinaryIdiot 10y ago
    > Yahoo has zero value as a web property What!? Surely you're being flippant. Alexa currently ranks Yahoo.com as #5 worldwide and in the United States. NUMBER 5! How anyone could think that has zero value makes no sense to me.
    - pcurve 10y ago
      Yeah I keep hearing the same thing, but obviously it's at least worth around what Verizon paid for it. I think it's actually worth more, but there is so much hate for the company and its management team.
      - ixtli 10y ago
        While the thing you're responding to is obviously idiotic it occurs to me that the sanity of the valuation of Yahoo! is not "obvious" at all. It's a result of the application of partially visible heuristics to determine the worth of things like users, views, "talent," and etc, all passed through back-room dealing at the executive level and bargaining behind closed doors. The reason I bother coming here to say this is that I think the idea that 4.8 billion dollars "makes sense" to an outsider is endemic of thinking that leads to a dangerous lack of regulation. In other words, I'd be careful not to assume that the left hand always knows what the right hand is doing in companies at this scale.
ianai 10y ago
Sometimes I play with the notion of a future without asymmetric information. If it is to be known it is known by all.
- geofft 10y ago
  The trouble is that confidentiality and integrity play against each other in useful ways. For instance, even if I have nothing private to say in my email, if you want to authenticate messages as coming from me, I need a private key to sign my email so that nobody else does. Even in a hypothetical future where, say, two employees in a company couldn't communicate privately without the entire rest of the company knowing (and I question whether that would be a good future), you still want the ability for one employee to communicate and certify the message as coming from them. Otherwise I could give myself bonuses. That requires some password or key known to me and only to me; that requires that cookies and other session state on my computer are only accessible to me.
sofaofthedamned 10y ago
Yahoo will survive this regardless of their 'state sponsored' hand waving or not. The day the same happens to Google or Facebook will be very different.
- CodeMage 10y ago
  Will it? Why? If anything, Google and Facebook seem to be more firmly entrenched in everyone's day-to-day lives and are more likely to get the "too big to fail" treatment.
  - sofaofthedamned 10y ago
    It will be more newsworthy. Nothing to do with the impact. Though I do suspect Google and Facebook devote more resources these days to security than Yahoo.
  - vegabook 10y ago
    Agreed. My sense is that if this happened to political heavyweights like Google or Facebook, we'd have serious diplomatic muscle on the case, as indeed we have already seen in the past with Google's China travails, or Obama's barely-hidden warnings to Europe about the antitrust fines.
inestyne 10y ago
The only reason they announced it was to avoid being guilty of an actual crime after being acquired and not announcing it before hand.
jonbarker 10y ago
Yahoo has recommended that users "check their accounts". What exactly would they be checking? Doesn't a compromised account look the same as an uncompromised account from a user perspective?
- blowski 10y ago
  Potentially, you could have weird locations signing in, emails you didn't send in your sent items. But yeah, seems unlikely that a 'state-sponsored attack' on this scale wouldn't be able to cover their tracks in the eyes of Yahoo Mail users.
soci 10y ago
Wait, Yahoo believes the data was stolen by a "state-sponsored actor"! If they have such evidence, why don't they explain so? To me it looks like a tactic to put the focus on the "noughty" government instead of themselves. Anyway, it will be an interesting read (if ever written) how Yahoo discovered they had been stolen and by who (what state?). Also, if "the state" is finally behind this, who will they prosecute till death? I bet it's the hacker :(
- Lewisham 10y ago
  a) Big US enterprises are under attack from state-sponsored actors on a daily basis, so it's not that weird. It's not like the NSA weren't caught with their hands in the cookie jar either. b) If you name the state you think is behind it, you better be ready for the diplomatic repercussions between the US government and the rogue state, as well as potentially stopping doing business in that state (see Google and China)
  - soci 10y ago
    a) Can you point to an article were I can learn more about examples of big US corps being attacked by US sponsored actors? It's a quite interesting topic indeed.
    - jedberg 10y ago
      It's rarely written about, in part because the private companies don't want to share details. Buy a beer for someone who has worked security for a big firm and they can tell you all about it.
    - pquerna 10y ago
      Does NSA tapping Google's fiber count: http://www.bbc.com/news/world-us-canada-24751821 http://www.bbc.com/news/world-us-canada-24751821
    - peterkelly 10y ago
      NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i... We can assume that the US government is not the state-sponsored actor in the OP, because their attack has already been publicly known for some time. This one is probably China or Russia.
elorant 10y ago
There’s one thing I don’t understand with this “state sponsored actor”. Say you are an oppressive regime and you target activists who use yahoo mail to publish your dirty laundry. Why on earth would you hack half a billion accounts just to get access to a few dozen ones? Doesn’t make sense. You attract too much attention. A thing like that would never go unnoticed. If on the other hand you’ve found some exploit and target specific accounts which are numbered in the tens, say hundreds, you can easily get away with it. BTW, I don’t know if it’s coincidental but just yesterday I received a notification from Yahoo to disable access to Mail from third party apps.
- pbosko 10y ago
  Maybe you are NSA and you say "All your data are belong to US", as discovered by Snowden.
- krallja 10y ago
  The hack was probably "take a copy of the DB, decrypt our targets' password offline", not some sophisticated online attack.
smaili 10y ago
Anyone happen to know if this was the largest hack in history?
- hundchenkatze 10y ago
  Information is Beautiful has a bubble chart/graph[0] and here's the same data in Google spreadsheet format[1]. [0] http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ http://www.informationisbeautiful.net/visualizations/worlds-... [1] https://docs.google.com/spreadsheets/d/1Je-YUdnhjQJO_13r8iTeRxpU2pBKuV6RVRHoYCgiMfg/edit#gid=3 https://docs.google.com/spreadsheets/d/1Je-YUdnhjQJO_13r8iTe...
esaym 10y ago
Long live yahoo...oh well. I've never used them for email, I only had an account for yahoo IM, which they just killed. I have no use for them at all now.
eternalban 10y ago
local area askHN: what to do if one had an ancient account that was abandoned but has one's name on it? [p.s. forgot password, etc.]
mschoebel 10y ago
FWIW... I just logged in to my Yahoo Account and removed the security questions. Just to be sure. I had already changed my password a few months ago when first rumors of this came up. I'm pretty sure that the option to remove the security questions wasn't there back then.
finid 10y ago
System was hacked in "late 2014", but we only now found out about it in 2016. That's almost 2 years. Whoever the "state-sponsored" hacker is probably has lost interest in that access.
nradov 10y ago
It seems bizarre that Yahoo would use a post on tumblr.com to make such an important announcement. From what I've seen Tumblr has become mostly a wasteland of worthless garbage in the past few years and no one takes it seriously any more. Isn't this the sort of thing that ought to be on the yahoo.com home page from a PR crisis management standpoint?
- scintill76 10y ago
  If you don't know, they own Tumblr, so maybe it's a "dogfooding" practice.
  - nradov 10y ago
    Yes I know that, but I would think that if this impacts yahoo.com then the announcement should be there rather than some seldom visited backwater.
- ben_jones 10y ago
  All press is good press?
- bluesix 10y ago
  Tumblr lost 65 million accounts "recently" too - maybe they're just reusing their "we've been hacked" account?
therealmarv 10y ago
MD5 for password hashing? Seriously? That was even 2014 waaaaaaay outdated.
sambe 10y ago
One of the more convoluted announcements I've seen. I have to be aware that yahoo officially communicates via tumblr.com, check two different announcement pages which may not yet be up (converting time zones). When I clicked one of them I had to find the notice "in my region" which had only one option (not my region) and linked to another (non-yahoo?) site with an image of a document. I can't imagine all 500M users will jump through these hoops and remember when they last changed their password.
thereisnogadi 10y ago
Wow. If you scroll up and look at the header, that's some very sexy UX. Good job, Yahoo!
mapletree 10y ago
I purchased my own credentials from the hackers just to make sure nobody else gets them. So much easier than coming up with another password.
xorgar831 10y ago
Yahoo won't let you enable two-factor auth with a Google Voice phone number. Oh well, time to delete my account. Here's the magic link: https://edit.yahoo.com/config/delete_user https://edit.yahoo.com/config/delete_user
Fej 10y ago
https://haveibeenpwned.com/ https://haveibeenpwned.com/ More relevant than ever.
halayli 10y ago
What evidence do they have that it's a state sponsored attack?
mey 10y ago
I found it rather perverse that the login and account recovery screens of Yahoo! have 3rd party ads running. Doesn't give me any confidence in their security (in addition to the breach).
- sekasi 10y ago
  You, sir, have just landed at an important topic that we're all too lax on. This third-party injected javascript into otherwise 'trusted' pages is a real serious issue. Besides the 'kill all ads' talk which isn't very helpful, there really needs to be some serious conversation about how this particular issue with the internet is addressed.
backtoyoujim 10y ago
I should have never created that rocketmail account.
chris_wot 10y ago
Will this be reported to the Australian Privacy Commisioner? I'm assuming it affected Yahoo Australia.
itsnotlupus 10y ago
The timeline seems close to that HN item: https://news.ycombinator.com/item?id=8416393 https://news.ycombinator.com/item?id=8416393 (dead link, cache at http://archive.is/PpCth http://archive.is/PpCth ) It could be entirely unrelated.
slicktux 10y ago
Interestingly my account is not part of the compromise and my friends are; I can confirm this because they received a message about the compromise and I did not. . .I asked them how long they've had their accounts and they said for about a year; where as I have had my account for about 5 years. Interesting no?
- deleted 10y ago
  [deleted]
shruubi 10y ago
It's obviously so important that they posted it to Tumblr instead of on the yahoo website itself...
badthingfactory 10y ago
I have an account that was definitely compromised. I had completely forgotten this account existed and never used it to sign up for anything else. I was rather surprised when I realized someone had that email and password.
Fuzzwah 10y ago
"We are recommending that all users who haven’t changed their passwords since 2014 do so." And then don't include an easy link to where users can do that? Great work yahoo. I found my way to http://profile.yahoo.com http://profile.yahoo.com but apparently from my machine at an AU University: "profile.yahoo.com’s server DNS address could not be found"
tzakrajs 10y ago
Yet another "state actor hit us with 0days" statement.
luckydata 10y ago
why don't they die already?
ashitlerferad 10y ago
Interesting that they are moving beyond passphrase authentication towards an "Account Key". I wonder how that works...
yAnonymous 10y ago
Is it possible that certain companies leave their user data open for attacks to illegally share it with third parties? At this point, it should at least be considered. There's obviously quite a bit of incompetence at Yahoo, but still...
bpyne 10y ago
Oddly, I changed the password for 2 Yahoo accounts only a month ago. I have to wonder if Yahoo filtered for people who recently changed passwords before designating me as a person who might be affected.
DeAndre222 10y ago
Do you need a professional hacker for hire? or help in to retrieve accounts that have been taken by hackers, Contact us at 1dataexit@gmail.com or reach us t +1 480 439 6115.
DeAndre222 10y ago
Do you need a professional hacker for hire? or help in to retrieve accounts that have been taken by hackers, Contact us at 1dataexit@gmail.com or reach us t +1 480 439 6115.

510 points by runesoerensen 10y ago

Is there some kind of "statute of limitations" thing that means we're suddenly finding out about a string of breaches from 2012 now? Or is there some group that is trading breach data privately that have themselves been compromised so that data coming from them is finally leaking out? I'm now more worried about the 4 year delay in these things coming to light than the effect of the breaches themselves given how many times I now show up on haveibeenpwned.

hap1o 10y ago
I am curious to know what happened in 2012 that all these breaches occurred. I assume they are holding the data, and trying to squeeze what they can out of it all the way through. However this year there seems to have been a lot of massive breaches that year. does it all stem from one hack? 200m Yahoo accounts could lead to at least a few million LinkedIn accounts I would assume, maybe not as many as was actually compromised in the LinkedIn breach, but still. I just want to know if the same exploits were used in all of these instances. Or maybe they have just found backups for all these companies this year from 2012 and are using those. I don't even how that would happen.
- throwawayReply 10y ago
  If they found a yahoo employee credentials in the linkedin hack (or vice-versa) then they don't need a million accounts, just those credentials. "Hackers who used an employee’s password, re-used from the LinkedIn breach, to access Dropbox’s corporate network and steal the user credentials" - from a unnamed source quoted in a techcrunch article. So maybe they also managed to traverse from linkedin to Yahoo or Yahoo to linkedin through similar password re-use.

zymhan 10y ago

Does this mean Verizon would assume liability if the purchase closes before a lawsuit/fine is brought?

ActsJuvenile 10y ago
Verizon legal team might have forced Yahoo to disclose this in order to remove the liability before acquisition.
- eric_h 10y ago
  Very interesting point. This suggests to me that Yahoo has been sitting on this for quite some time and only revealed it when their hand was forced...

newscracker 10y ago

Moving email addresses out from one provider and creating another one is more difficult than moving phone numbers (in the latter case, number portability could help, if available). What exactly can an average/common end user do for such incidents, even if it is to avoid them in the future? I use different passwords across accounts, with all of them being somewhat complex or very complex. I have looked at a few different paid service providers before, but they're all very expensive. Expensive for me is anything that charges more than $20 per year, or worse, charges that amount or higher for every single email address/alias on a domain. My use of email for personal purposes is writing about a handful of emails in an entire year, but on the receiving side, I get a lot of emails - most of them somewhat commercial in nature (like online orders, bank statement notifications, marketing newsletters I've explicitly signed up for, etc.). I also have several email addresses, each one used for a different purpose and with some overlap across them. It seems like web hosting has become extremely cheap over time whereas email hosting has stagnated on the price front for a long time.

GCA10 10y ago
This hack involves 2012 passwords, according to the Re/code coverage. If you've still got the same password, that's a problem. If you're changing passwords every year or so, your vulnerability drops. Two-factor identification on any account that involves your money is a good idea, too.
- newscracker 10y ago
  It's true that this hack was in 2012, but the information lost is not only passwords but also account information like name, addresses, other linked email addresses, etc. So those who changed their passwords after this hack still have something to worry about.
  - GCA10 10y ago
    True, but if you've got any internet presence at all, it's already pretty straightforward to associate your name and email address (or addresses). Tools like Datanyze, Spokeo, SellHack, etc. do that routinely. Having 120 million Yahoo records available for mischief (without current passwords) makes things slightly worse, but not much.

heroiccyber 10y ago

You can verify if your credentials have been compromised at https://heroic.com https://heroic.com

FT_intern 10y ago
Is your service any better than haveibeenpwned.com ?
- heroiccyber 10y ago
  HIBP is a great service and was the first one on the scene. HEROIC has more breached records than HIBP and with a free account on HEROIC you can see more details about how you have been compromised along with better search capabilities.
  - honkhonkpants 10y ago
    But apparently not a strict superset of HIBP, since your site shows nothing for an address that I know was exposed in multiple hacks/leaks.
    - heroiccyber 10y ago
      We should have everything that HIBP has plus another .5 billion.
  - elfchief 10y ago
    HIBP is still useful to me, at least, because it will let me find breaches for my entire domain, rather than just for specific email addresses. This is useful since I use a different email address per-site (username-somestring@domain), so just being able to search on my base email address on HEROIC isn't likely to turn much up...
guessmyname 10y ago
Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application/x-www-form-urlencoded; charset=UTF-8" \ -H "referer: https://heroic.com/email-security/" \ -H "x-requested-with: XMLHttpRequest" \ -H "origin: https://heroic.com" \ -H "authority: heroic.com" \ --data "action=heroic_scan_email" \ --data "data[email]=${EADDRESS}" \ --compressed --silent ) if command -v php &> /dev/null; then php -r "print(json_encode(unserialize(urldecode('${RESPONSE}'))));" fi PS: Using serialized data is a bad idea: https://www.owasp.org/index.php/PHP_Object_Injection https://www.owasp.org/index.php/PHP_Object_Injection

aaronkrolik 10y ago

How is it that 200M user accounts are worth only $1800?

idlewords 10y ago
It's Yahoo.
- JustSomeNobody 10y ago
  And 2012.
talmand 10y ago
Bah, I would have topped out at $50. The vast majority of accounts from a free email service would be worthless.

deleted 10y ago

[deleted]

beezle 10y ago

Anybody know what hash they use at yahoo for account passwords?

user731955373 10y ago
rot13
KMag 10y ago
You're likely under-estimating the amount of CPU time they're willing to throw at the problem. If you have to ask, the answer is "not strong enough for your password. Change your Yahoo password. Change all other passwords that were shared. Stop sharing passwords across sites." On the other hand, my LinkedIn password was 15 base-64 characters, poorly hashed with just SHA-1. As a rough ballpark, cracking it on average comes out to about 500 times all of the work that has ever been put into BitCoin mining. I still changed my password after the breach. Why not?
- Fej 10y ago
  So salted bcrypt isn't relatively safe?
  - KMag 10y ago
    It's safer than, say, unsalted MD4 (NTLM). However, the specifics of the hash only make a difference if your password is weak. As long as the hash is non-invertible, use passwords containing at least 96 bits of entropy, and you're fine. I use https://github.com/kmag/store_password_gpg https://github.com/kmag/store_password_gpg , which is a 200-line Python script I wrote a while ago to generate a random password and encrypt it using gpg. Any decent password manager should allow you to generate unique, random, per-site passwords.
throwawayyahoo2 10y ago
for the longest time, it was unsalted MD5. it may still be. very easy to crack with a rainbow table.

norea-armozel 10y ago

I think my only concern is what data I had attached to my Yahoo account (for Flickr) which I think they required me to tie to a phone number. So I guess that means I can expect people trying to abuse that phone number as a point of identification in identity theft attempts. Oh joy.

willow9886 10y ago

Yahoo's login experience has been horrible lately. This must be a contributing factor.

tunap 10y ago
Create a bookmark to your inbox when logged in. Next time you log-in, immediately click your inbox bookmark so you can skip all the irritating "give us your phone number or you will suffer greatly" pages. As for personal info, don't give it to them. Anyone who doesn't require it by law gets mis-info, this has served my privacy & security since the turn of the century. EVERYONE wants your phone number "for security" these days* , and yet, when they bungle their security yours goes out the window with a million+ others'. *Your phone number is marketing gold to those who believe they value your personal, identifiable data more than you do. edit: more asterisks, less italics
mod 10y ago
I had a terrible experience recently. It was so dumb I wrote a rant to a no-reply address they had sent me some options about. I logged in from my only computer, they presented my recovery email addresses with check boxes. I didn't read the prompt, but I selected the one I still use (one was so freaking old--a netzero address). It seemed to remove it from the list, which was the opposite of the behavior I'd expect. I literally didn't care enough to add it back. If I get locked out of my yahoo account...so? Anyway, then they sent me a "new device" email that said I should login from one of my normal devices. It was my normal device, I just hadn't logged in for maybe...years? Surely they can alter the logic to not say something so stupid.

realraghavgupta 10y ago

using 2 Factor Authentication comes handy in situations like this.

slg 10y ago
Not necessarily. 2FA only prevents access to the account, but passwords are both hard to decrypt and easy to change so I'm not too concerned about that. The real valuable data in this hack are the names, emails addresses, DOBs, telephone numbers, and security questions. Those things are very hard to change and would be very valuable data points for anyone trying to steal your identity or social engineer themselves in other accounts of yours.
- realraghavgupta 10y ago
  Yes, you are right. That's really valuable data for anyone impersonating someone. But its becoming more and more difficult which service to use that might protect the information. Hopefully in services like protonmail, everything is encrypted.

leesalminen 10y ago

I wonder how many dummy accounts from the mid-2000s of mine were included in that. I was born in 1990, and my insecure online behavior from 2000-2005 scare me. Hopefully HaveIBeenPwned gets their hands on this so I can scan for my teenage usernames.

JangleBarney 10y ago
Same here. I've gotta have at least 10 accounts from 1996-2002.

deleted 10y ago

[deleted]

St-Clock 10y ago

"encrypted or unencrypted security questions and answers" This is bad right? Like, worse than your hashed password and your mailing address. The only good thing is that if I ever implement security questions, I'll remember Yahoo! and how it could end up in the wrong hands.

nilved 10y ago
Don't implement security questions. Those are no good to begin with.
- graeme 10y ago
  Don't many sites require them?
  - sushid 10y ago
    Yes but the parent is telling you, as a developer, don't use them. Personally, I'll make up a fake answer (e.g. What's your favorite pizza topping? A:338192). Just make it something reasonably short as you might have to repeat it to a live customer service agent.
    - pbhjpbhj 10y ago
      "My fave pizza is colon backslash open-cursive-brace pipe ay eight dollar with cheese".
- satysin 10y ago
  You mean asking me my mother's maiden name or what school I went to isn't bullet proof?!
  - dhimes 10y ago
    The problem is that people give the right answers. Mother's maiden name? Mozilla. School? Mio Fit.

justinv 10y ago

"by what it believed was a "state-sponsored actor.""

patrickmn 10y ago
The de facto excuse to use when you get hacked these days. Who could possibly defend against an entire nation? And it's incredibly easy to "prove" that some Russian IP accessed your system at some point, therefore Putin is directly involved and no amount of security would've prevented him from getting in.
- dwightgunning 10y ago
  Would a hacker who claims unemployment benefits be considered state sponsored?
  - hood_syntax 10y ago
    Truly food for thought...
- rawnlq 10y ago
  Sidetracked: Can someone explain to me why there seem to be a culture of blackhat hacking from Russia? Do their CS degrees have mandatory advanced courses on how to exploit vulnerabilities for lulz? Not really even saying this in a mean way. Almost all top CS programs in the US have assignments on writing buffer overflow attacks and reverse engineering in their mandatory intro to systems course. But I don't seem to see them going off on their own to learn more sophisticated attacks and acutally using it in the real world. Why does russia seem to foster so many blackhats? Or is it just the proxies that are hosted there?
  - prodigal_erik 10y ago
    Maybe it's just that the avails of theft and fraud are not limited by prevailing wages in your area, so are relatively a better deal?
10y ago

Spydar007 10y ago

>Yahoo believes that information associated with at least 500 million user accounts was stolen That tops the HIBP list for the most stolen.[1] [1] https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites

nostromo 10y ago

"The data stolen may have included names, email addresses, telephone numbers, dates of birth and hashed passwords but may not have included unprotected passwords, payment card data or bank account information, the company said." What's the difference between "may have" and "may not have" in this context? It seems like they're saying anything could have been stolen.

TallGuyShort 10y ago
Or perhaps wasn't stolen, during the year that may or may not have been 2014. Sorry, ALLEGEDLY 2014.
rezashirazian 10y ago
It's lawyer talk. They don't want to say anything definitively in case they have to walk it back.
arcticfox 10y ago
That is an incredibly deceptive sentence. They should have listed everything under "may have", unless I'm misunderstanding because they used some convoluted English.
- hood_syntax 10y ago
  No, it's intentionally deceptive.
- Jarwain 10y ago
  The way I read it is that the stolen data has a relatively high probability of including the first set of things, but a relatively low probability of including the second set of things. They don't want to say definitively for whatever reason.
  - Bartweiss 10y ago
    I take it as "as far as we know, these weren't stolen, but don't sue us if we turn out to be wrong".

mtgx 10y ago

> We have confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor. GCHQ? Although GCHQ seems to have hacked them even earlier than that. https://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo https://www.theguardian.com/world/2014/feb/27/gchq-nsa-webca...

supergirl 10y ago

"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.

sickbeard 10y ago
all hacks have signatures.. usually the tools used by the hackers to compromise the system.
- talmand 10y ago
  That means nothing. If a hacker somehow managed to get tools previously used by a state doesn't mean the hacker now works for the state.
  - serf 10y ago
    didn't a cache of supposedly state-sponsored tools just get auctioned off by a group who (supposedly) compromised a machine which was under the ownership of one of the three-letter groups?[0] Seems to give more credence to the viewpoint that the tool doesn't indicate the perpetrator too easily. [0]:https://www.wired.com/2016/08/hackers-claim-auction-data-stolen-nsa-linked-spies/ https://www.wired.com/2016/08/hackers-claim-auction-data-sto...
    - evgen 10y ago
      If I hand you an F-16 and you use it to do damage that would indicate possible US air force involvement. If the F-16 that attacked me was preceded by advanced ECM, suppression of air defenses using stand-off munitions, and was performed in a particular precision attack pattern then US air force involvement would be much more likely. These signatures are not just about the tools, but the opsec and procedures that the hackers used to deploy the tools, how they moved laterally to the target, and how they exfiltrated the information. It is the whole package that identifies a real state-sponsored actor vs a freelancer with access to a bag of zero days.

geraldcombs 10y ago

I wonder what percentage of those 500 million accounts correspond to real human beings. Much of the spam on the sites I run come from what appear to be fake @yahoo.com accounts.

jap 10y ago

I wonder if "500M" is a silly way of saying all user account details were stolen.

zobzu 10y ago
"yes"

munk-a 10y ago

Does the incredible delay of this announcement count as being grossly negligent? Maybe they're trying to devalue their stock prior to the merger? Similar to what Caris did: http://www.law360.com/articles/684195/caris-employees-get-16-3m-after-co-sharply-devalued-stock http://www.law360.com/articles/684195/caris-employees-get-16...

bananabill 10y ago
Unfortunately probably not. All they have to say is that they weren't sure until now.

Alex3917 10y ago

This is where the phrase "adverse material fact" comes into play.

pavornyoh 10y ago

Can anyone elaborate as to why this is being announced two years later? Why now and not when it happened?

frandroid 10y ago
Because they didn't know it at the time?
brian-armstrong 10y ago
I believe a common reason for this is that they don't want to announce it until they're completely sure the breach is gone and that they have control of things again. Announcing that it happened and that it's ongoing forces them to either cease operations or face liability.
- malz 10y ago
  So covering up a known in-progress security breach is standard procedure? Instead of telling your users to change their passwords and so on? Personally, I demand criminal investigation and at least a $1000 fine per account breached.
  - dhimes 10y ago
    Yeah, that sucks because I have my business stuff with them (I know, I know). On the bright side I didn't receive an email so maybe they didn't get the biz accounts. Changed my pw anyway. And something's changed with their biz accounts anyway- it's been sold/rebranded or something and I'm not sure where the future lays... :[
  - brian-armstrong 10y ago
    I don't think they actually broke any laws. How do you expect them to be charged for your demands?
    - malz 10y ago
      You got me, they only broke the law in 47 states. http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx http://www.ncsl.org/research/telecommunications-and-informat...

nodesocket 10y ago

You'd think this would affect the stock price, but currently YHOO only trading down 8 cents (-0.18%). I honestly see this all the time. What sounds like really horrible news for a company, does not affect the price. Howerver, some random analyst or reporter who works at the Mercury Star Sun Inquirer writes a negative article or downgrade and the stock tanks. Doesn't make much sense.

TylerE 10y ago
Yahoo has zero value as a web property. What value there is on the name and the advertising side.
- nkozyra 10y ago
  To the parent comment's point, this is the sort of thing that should have a negative effect on brand/name.
- BinaryIdiot 10y ago
  > Yahoo has zero value as a web property What!? Surely you're being flippant. Alexa currently ranks Yahoo.com as #5 worldwide and in the United States. NUMBER 5! How anyone could think that has zero value makes no sense to me.
  - pcurve 10y ago
    Yeah I keep hearing the same thing, but obviously it's at least worth around what Verizon paid for it. I think it's actually worth more, but there is so much hate for the company and its management team.
    - ixtli 10y ago
      While the thing you're responding to is obviously idiotic it occurs to me that the sanity of the valuation of Yahoo! is not "obvious" at all. It's a result of the application of partially visible heuristics to determine the worth of things like users, views, "talent," and etc, all passed through back-room dealing at the executive level and bargaining behind closed doors. The reason I bother coming here to say this is that I think the idea that 4.8 billion dollars "makes sense" to an outsider is endemic of thinking that leads to a dangerous lack of regulation. In other words, I'd be careful not to assume that the left hand always knows what the right hand is doing in companies at this scale.

ianai 10y ago

Sometimes I play with the notion of a future without asymmetric information. If it is to be known it is known by all.

geofft 10y ago
The trouble is that confidentiality and integrity play against each other in useful ways. For instance, even if I have nothing private to say in my email, if you want to authenticate messages as coming from me, I need a private key to sign my email so that nobody else does. Even in a hypothetical future where, say, two employees in a company couldn't communicate privately without the entire rest of the company knowing (and I question whether that would be a good future), you still want the ability for one employee to communicate and certify the message as coming from them. Otherwise I could give myself bonuses. That requires some password or key known to me and only to me; that requires that cookies and other session state on my computer are only accessible to me.

sofaofthedamned 10y ago

Yahoo will survive this regardless of their 'state sponsored' hand waving or not. The day the same happens to Google or Facebook will be very different.

CodeMage 10y ago
Will it? Why? If anything, Google and Facebook seem to be more firmly entrenched in everyone's day-to-day lives and are more likely to get the "too big to fail" treatment.
- sofaofthedamned 10y ago
  It will be more newsworthy. Nothing to do with the impact. Though I do suspect Google and Facebook devote more resources these days to security than Yahoo.
- vegabook 10y ago
  Agreed. My sense is that if this happened to political heavyweights like Google or Facebook, we'd have serious diplomatic muscle on the case, as indeed we have already seen in the past with Google's China travails, or Obama's barely-hidden warnings to Europe about the antitrust fines.

inestyne 10y ago

The only reason they announced it was to avoid being guilty of an actual crime after being acquired and not announcing it before hand.

jonbarker 10y ago

Yahoo has recommended that users "check their accounts". What exactly would they be checking? Doesn't a compromised account look the same as an uncompromised account from a user perspective?

blowski 10y ago
Potentially, you could have weird locations signing in, emails you didn't send in your sent items. But yeah, seems unlikely that a 'state-sponsored attack' on this scale wouldn't be able to cover their tracks in the eyes of Yahoo Mail users.

soci 10y ago

Wait, Yahoo believes the data was stolen by a "state-sponsored actor"! If they have such evidence, why don't they explain so? To me it looks like a tactic to put the focus on the "noughty" government instead of themselves. Anyway, it will be an interesting read (if ever written) how Yahoo discovered they had been stolen and by who (what state?). Also, if "the state" is finally behind this, who will they prosecute till death? I bet it's the hacker :(

Lewisham 10y ago
a) Big US enterprises are under attack from state-sponsored actors on a daily basis, so it's not that weird. It's not like the NSA weren't caught with their hands in the cookie jar either. b) If you name the state you think is behind it, you better be ready for the diplomatic repercussions between the US government and the rogue state, as well as potentially stopping doing business in that state (see Google and China)
- soci 10y ago
  a) Can you point to an article were I can learn more about examples of big US corps being attacked by US sponsored actors? It's a quite interesting topic indeed.
  - jedberg 10y ago
    It's rarely written about, in part because the private companies don't want to share details. Buy a beer for someone who has worked security for a big firm and they can tell you all about it.
  - pquerna 10y ago
    Does NSA tapping Google's fiber count: http://www.bbc.com/news/world-us-canada-24751821 http://www.bbc.com/news/world-us-canada-24751821
  - peterkelly 10y ago
    NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i... We can assume that the US government is not the state-sponsored actor in the OP, because their attack has already been publicly known for some time. This one is probably China or Russia.

elorant 10y ago

There’s one thing I don’t understand with this “state sponsored actor”. Say you are an oppressive regime and you target activists who use yahoo mail to publish your dirty laundry. Why on earth would you hack half a billion accounts just to get access to a few dozen ones? Doesn’t make sense. You attract too much attention. A thing like that would never go unnoticed. If on the other hand you’ve found some exploit and target specific accounts which are numbered in the tens, say hundreds, you can easily get away with it. BTW, I don’t know if it’s coincidental but just yesterday I received a notification from Yahoo to disable access to Mail from third party apps.

pbosko 10y ago
Maybe you are NSA and you say "All your data are belong to US", as discovered by Snowden.
krallja 10y ago
The hack was probably "take a copy of the DB, decrypt our targets' password offline", not some sophisticated online attack.

smaili 10y ago

Anyone happen to know if this was the largest hack in history?

hundchenkatze 10y ago
Information is Beautiful has a bubble chart/graph[0] and here's the same data in Google spreadsheet format[1]. [0] http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ http://www.informationisbeautiful.net/visualizations/worlds-... [1] https://docs.google.com/spreadsheets/d/1Je-YUdnhjQJO_13r8iTeRxpU2pBKuV6RVRHoYCgiMfg/edit#gid=3 https://docs.google.com/spreadsheets/d/1Je-YUdnhjQJO_13r8iTe...

esaym 10y ago

Long live yahoo...oh well. I've never used them for email, I only had an account for yahoo IM, which they just killed. I have no use for them at all now.

eternalban 10y ago

local area askHN: what to do if one had an ancient account that was abandoned but has one's name on it? [p.s. forgot password, etc.]

mschoebel 10y ago

FWIW... I just logged in to my Yahoo Account and removed the security questions. Just to be sure. I had already changed my password a few months ago when first rumors of this came up. I'm pretty sure that the option to remove the security questions wasn't there back then.

finid 10y ago

System was hacked in "late 2014", but we only now found out about it in 2016. That's almost 2 years. Whoever the "state-sponsored" hacker is probably has lost interest in that access.

nradov 10y ago

It seems bizarre that Yahoo would use a post on tumblr.com to make such an important announcement. From what I've seen Tumblr has become mostly a wasteland of worthless garbage in the past few years and no one takes it seriously any more. Isn't this the sort of thing that ought to be on the yahoo.com home page from a PR crisis management standpoint?

scintill76 10y ago
If you don't know, they own Tumblr, so maybe it's a "dogfooding" practice.
- nradov 10y ago
  Yes I know that, but I would think that if this impacts yahoo.com then the announcement should be there rather than some seldom visited backwater.
ben_jones 10y ago
All press is good press?
bluesix 10y ago
Tumblr lost 65 million accounts "recently" too - maybe they're just reusing their "we've been hacked" account?

therealmarv 10y ago

MD5 for password hashing? Seriously? That was even 2014 waaaaaaay outdated.

sambe 10y ago

One of the more convoluted announcements I've seen. I have to be aware that yahoo officially communicates via tumblr.com, check two different announcement pages which may not yet be up (converting time zones). When I clicked one of them I had to find the notice "in my region" which had only one option (not my region) and linked to another (non-yahoo?) site with an image of a document. I can't imagine all 500M users will jump through these hoops and remember when they last changed their password.

thereisnogadi 10y ago

Wow. If you scroll up and look at the header, that's some very sexy UX. Good job, Yahoo!

mapletree 10y ago

I purchased my own credentials from the hackers just to make sure nobody else gets them. So much easier than coming up with another password.

xorgar831 10y ago

Yahoo won't let you enable two-factor auth with a Google Voice phone number. Oh well, time to delete my account. Here's the magic link: https://edit.yahoo.com/config/delete_user https://edit.yahoo.com/config/delete_user

Fej 10y ago

https://haveibeenpwned.com/ https://haveibeenpwned.com/ More relevant than ever.

halayli 10y ago

What evidence do they have that it's a state sponsored attack?

mey 10y ago

I found it rather perverse that the login and account recovery screens of Yahoo! have 3rd party ads running. Doesn't give me any confidence in their security (in addition to the breach).

sekasi 10y ago
You, sir, have just landed at an important topic that we're all too lax on. This third-party injected javascript into otherwise 'trusted' pages is a real serious issue. Besides the 'kill all ads' talk which isn't very helpful, there really needs to be some serious conversation about how this particular issue with the internet is addressed.

backtoyoujim 10y ago

I should have never created that rocketmail account.

chris_wot 10y ago

Will this be reported to the Australian Privacy Commisioner? I'm assuming it affected Yahoo Australia.

itsnotlupus 10y ago

The timeline seems close to that HN item: https://news.ycombinator.com/item?id=8416393 https://news.ycombinator.com/item?id=8416393 (dead link, cache at http://archive.is/PpCth http://archive.is/PpCth ) It could be entirely unrelated.

slicktux 10y ago

Interestingly my account is not part of the compromise and my friends are; I can confirm this because they received a message about the compromise and I did not. . .I asked them how long they've had their accounts and they said for about a year; where as I have had my account for about 5 years. Interesting no?

deleted 10y ago
[deleted]

shruubi 10y ago

It's obviously so important that they posted it to Tumblr instead of on the yahoo website itself...

badthingfactory 10y ago

I have an account that was definitely compromised. I had completely forgotten this account existed and never used it to sign up for anything else. I was rather surprised when I realized someone had that email and password.

Fuzzwah 10y ago

"We are recommending that all users who haven’t changed their passwords since 2014 do so." And then don't include an easy link to where users can do that? Great work yahoo. I found my way to http://profile.yahoo.com http://profile.yahoo.com but apparently from my machine at an AU University: "profile.yahoo.com’s server DNS address could not be found"

tzakrajs 10y ago

Yet another "state actor hit us with 0days" statement.

luckydata 10y ago

why don't they die already?

ashitlerferad 10y ago

Interesting that they are moving beyond passphrase authentication towards an "Account Key". I wonder how that works...

yAnonymous 10y ago

Is it possible that certain companies leave their user data open for attacks to illegally share it with third parties? At this point, it should at least be considered. There's obviously quite a bit of incompetence at Yahoo, but still...

bpyne 10y ago

Oddly, I changed the password for 2 Yahoo accounts only a month ago. I have to wonder if Yahoo filtered for people who recently changed passwords before designating me as a person who might be affected.

DeAndre222 10y ago

Do you need a professional hacker for hire? or help in to retrieve accounts that have been taken by hackers, Contact us at 1dataexit@gmail.com or reach us t +1 480 439 6115.

DeAndre222 10y ago

Do you need a professional hacker for hire? or help in to retrieve accounts that have been taken by hackers, Contact us at 1dataexit@gmail.com or reach us t +1 480 439 6115.