25 ms·
Defending Against Hackers Took a Back Seat at Yahoo, Insiders Say
- sidcool 10y agoThings are not going so well for Marissa. She's a technical person and should have known better.
- geodel 10y agoI think she is financial wellness person and she is doing rather well for herself.
- sidcool 10y agoI think that beyond a certain level of financial success, it's the reputation and power that matters more. Marissa will never have to worry about money in her life. But power and reputation are ephemeral. Doesn't take much to ruin them.
- CalChris 10y agoAgreed. It explains Carly Fiorina as well. CF has sufficient money. She will never have the power+prestige she enjoyed as HP CEO. I don't think CF, MM or the Ponytail, Jonathan Schwartz will work again.
- jkot 10y agoFor $0.5B you can buy some reputation :-)
- SilasX 10y agoConcretely, though, what consequence does this have in that respect? Is there a marginal party she's not going to get invited to because of the loss of rep from this breach? Is there an introduction she's not going to get? Is there someone who matters to her who will deprive her personally (i.e. not Yahoo) of something due to having remembered this event?
- yuhong 10y agoI think she was formerly of Google too.
- drzaiusapelord 10y agoThis is incredible. Hiding a breach like this is bad enough but to not even forcing password resets should be criminal. I think we're living in an age where information security is still in the cowboy stage of things. I think we're due for some tough regulations here. Clearly businesses do not have our interests in mind and in these cases our interest will conflict with theirs.
- OedipusRex 10y agoRegulations would be impossible to enforce. You can write up as many laws as you want but trying to enforce security constraints on new websites alone is an impossible task.
- lets-tryagain 10y agoBut this is how most regulation enforcement works...notorious and high-profile cases scare most into compliance...like tax audits.
- bkjsbkjdnf 10y ago> trying to enforce security constraints on new websites alone is an impossible task. Why 'new websites alone'? Enforcing security standards on new/small websites would be harder than on large ones, and the large ones are more important. There are already many cyber-security related laws that are in place and more-or-less enforced. Having these laws makes large companies invest money into at least attempting to follow them for fear of legal repercussions.
- OedipusRex 10y agoWho would enforce it on any website? The US government, or W3C, or IANA? Everyone talks about a free and open web and no one wants someone poking around behind the scenes. I don't trust anyone to enforce password rules for fear of exploitation. The user is responsible for their password security and it should stop there. That being said, Yahoo should have force reset passwords.
- chollida1 10y agoI wrote a few days ago about how easy it is to compromise your ethics when trying to save a company. The problem is that once you compromise once, its very easy to do it again. https://news.ycombinator.com/item?id=12557163 https://news.ycombinator.com/item?id=12557163 The problem is, it's way too easy to look past the action you are taking because you can talk yourself into believing its for the greater good. And this is a huge ethical breach by Mayer, if she did this way back then, it's pretty reasonable to assume there are some more skeleton's hiding in the closet. I don't really think I'd be wanting to give Verizon a reason to reconsider the takeover......
- nordsieck 10y agoYou might be interested in the research on "normalization of deviance". Most of the solid research in in safety critical operations like aerospace, however plenty of people have made parallels to other industries.
- luso_brazilian 10y agoFrom the article: > The "Paranoids," the internal name for Yahoo’s security team, often clashed with other parts of the business over security costs. And their requests were often overridden because of concerns that the inconvenience of added protection would make people stop using the company’s products. That's the best summary of the problem for the industry as a whole, not only tech but any industry where failures are uncommon but with grave consequences. A quote from Fight Club that illustrates that problem: > Narrator: A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? > Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. > If X is less than the cost of a recall, we don't do one. That's the current mindset of the technological world, estimating whether the cost of atoning for the problem is lower than the cost of securing the systems.
- CaptSpify 10y agoAnd that's why, if the problem was obvious/known, we need to fine companies enough that x becomes way bigger than a recall.
- throwawayReply 10y agoIf you make cost X so high that X is an existential risk, people/companies will chance it because security isn't binary and "Either way we're fucked if we get a breach". So then companies just never disclose.
- imagist 10y agoThat's true, but a company can only play that game so many times before it catches up to them. "Never disclose" isn't a workable policy because eventually someone will leak the data. It's also worth noting that you're talking about a hypothetical, but there are real life examples of this sort of security working despite your claim that it won't work. I've worked for HIPAA-regulated companies. It's certainly difficult to meet their requirements, but it's not impossible, and the regulations do have a real impact on the security of the data. I'm also not convinced that security isn't a binary. You're either secure or your not, and you're only as secure as the weakest link in your system: that seems pretty binary to me. A more accurate statement might be that perfect security is prohibitively expensive in many cases. But in many of those cases, data is actually not needed, and is collected because business wants visibility into users, even if that means compromising user security. This divides companies into three camps: 1. Companies where security is cost-effective. 2. Companies where security is cost-prohibitive, but which don't need to collect data. 3. Companies where security is cost-prohibitive, but which need to collect data. I'd posit that the vast majority of companies are in categories 1 and 2, and that it would be a net benefit to people if all companies in category 3 stopped existing.
- y_u_no_rust 10y agowhy do such stupid people have so much fucking money
- informatimago 10y agoCan anybody cite a single one good decision Marissa Mayer took? Honestly?!
- ojbyrne 10y agoThere were probably lots of good decisions made when she negotiated her compensation.
- aikah 10y agoGood depends on the perspective. She made a bunch of people fairly rich by buying their apps, even useless ones.
- a3n 10y agoI think the logo looks great.
- mtgx 10y agoWhen she said she might go to prison if she defied the NSA? http://nypost.com/2013/09/12/yahoo-ceo-marissa-mayer-feared-jail-traitor-label-over-nsa-scandal/ http://nypost.com/2013/09/12/yahoo-ceo-marissa-mayer-feared-... Wait no...that was a terrible one, too. Okay, I got nothing.
- geodel 10y agoLeaving Google?
- rdiddly 10y agoI think she's secretly a double agent of Google, still on the Google payroll.
- __jal 10y agoThe iron cliches: - Security is a process, not a product. - You always pay for security. Up front, after the compromise, or both, if you're unlucky or bad at your job.
- at-fates-hands 10y agoIts the same issue since Grog tried to hide the first rock from Og: The “Paranoids,” the internal name for Yahoo’s security team, often clashed with other parts of the business over security costs. And their requests were often overridden because of concerns that the inconvenience of added protection would make people stop using the company’s products. Infosec is never easy, and part of making things secure is that you give up conveniences for peace of mind. It's 2016 and I'm still a but surprised that people willingly open themselves and their data to hackers in lieu of stock holders and customer retention. It's unreal when you stop and think about it.
- CaptainZapp 10y agoIt's the same problem compliance departments at financial institutions face. Compliance, by definition is bad for business. They will, after all, try to crack down on doing business with criminals, shady oligarchs or - dodgy dictators, which can be highly profitable. In the end, though, the best working banks are those where compliance has real teeth.
- blakesterz 10y ago>>"...said the company spent $10 million on encryption technology in early 2014..." What does that mean, exactly? Is it really possible to spend $10 million on encryption or is that some kind of marketing spin on things? I'm genuinely curious about this.
- dsr_ 10y agoYou can spend $10 million on any project by putting a team of 30 engineers at 150K each on it and letting them buy and deploy 1000 IPsec gateways or SSL accelerators or what have you at a cost of $5500 each including a 15% maintenance contract and internal hosting costs.
- Naritai 10y agoI would guess that the bulk of the costs is installing the processing power that enables the encryption.
- blakesterz 10y agoAh, I just reread that article and now I see: "The current and former employees say he inspired a small team of young engineers to develop more secure code, improve the company’s defenses — including encrypting traffic between Yahoo’s data centers" So that makes more sense now, I guess it's possible to spend that much on "encryption". People and processing power are expensive I suppose.
- Naritai 10y agoThey really are!
- walshemj 10y agoAnd the cost of the people to implement and run the IDS etc $10 mill doesn't go that far in terms of hardware and FTE's.
- droopybuns 10y agoMaybe they bought 250 HSMs.
- w1ntermute 10y ago> when it came time to commit meaningful dollars to improve Yahoo’s security infrastructure, Ms. Mayer repeatedly clashed with Mr. Stamos, according to the current and former employees. She denied Yahoo’s security team financial resources and put off proactive security defenses, including intrusion-detection mechanisms for Yahoo’s production systems. So there was enough money to throw a $7M Great Gatsby-themed holiday party[0,1], but not enough to implement proper security measures? Pathetic. She's nothing more than a skilled self-promoter who was lucky enough to join the right company at the beginning of her career. 0: http://www.dailymail.co.uk/news/article-3362885/Struggling-Yahoo-CEO-Marissa-Mayer-fire-7MILLION-Gatsby-themed-holiday-party-sat-pure-white-throne-posing-photos-employees.html http://www.dailymail.co.uk/news/article-3362885/Struggling-Y... 1: http://www.businessinsider.com/yahoo-ceo-marissa-mayer-blows-millions-on-parties-and-sponsorships-says-eric-jackson-2015-12 http://www.businessinsider.com/yahoo-ceo-marissa-mayer-blows...
- ryandrake 10y ago> She's nothing more than a skilled self-promoter who was lucky enough to join the right company at the beginning of her career. I'd argue that most Silicon Valley Success Stories boil down to "lucked into the right company early in career".
- misiti3780 10y agowow - that presentation is paints a pretty bad picture on her.
- praneshp 10y agoI agree with the "self-promoter" characterization (and support the other reply that most CEOs of such companies are so). However, the $7m figure for the holiday party is incorrect. I was at Yahoo then, and we were shown some numbers about the true cost. I was still angry that they spent even a cent on a party in December, then laid off a lot of people in February, cut people working on open source projects, and weren't funding any conference trips even at that point. All of those are more important to me than parties, but the Y! holiday party was well loved by many people there.
- dang 10y ago
- natch 10y agoIf this is true it taints Marissa and any business that hires her in the future, because it's hard to think of a more stark example of putting the interests of the user last.
- MrPatan 10y agoDid she put the interests of the _customers_ last or first, though?
- CaptainZapp 10y ago“At Yahoo, we have a deep understanding of the threats facing our users and continuously strive to stay ahead of these threats to keep our users and our platforms secure,” Why do I always get the almost unresistable urge to yell at my flat screen whenever a corporate spokesdrone opens his or her mouth? Is the ability to talk plattitude-gibberish a requirement for such a job?
- radarsat1 10y ago> Is the ability to talk plattitude-gibberish a requirement for such a job? Literally, yes?
- saintwind 10y agoThat is their job, bruh.
- engi_nerd 10y agoYes, it is, as I'm sure you know. Such nonsense talk is difficult to latch onto and attack precisely because it has the air of substance while actually saying nothing.
- tmd83 10y agoIt reminds me of the scene from Foundation when analysis of a politicians multi day stay and conversation amounted to no words. He had literally said nothing.
- chris_wot 10y agoIt's a deep understanding alright. They deeply understand that their security is utterly inadequate so they have to strive extra hard to try to secure their services. It appears they've been striving so hard they have given themselves a collective security haemorrhoid.
- dagw 10y agoIs the ability to talk plattitude-gibberish a requirement for such a job? It's not just a requirement, it is their job. How would you re-phrase that sentence in a way that A) isn't an actual lie, B) doesn't admit to any wrong-doing, C) keeps your customers calm and D) keeps your shareholder calm.
- chenster 10y agoHow did they know it's the "Chinese military hackers" who's behind the attack?
- geekamongus 10y agoBecause the Russian hacker blame game is passe.
- wglb 10y agoReading between the lines, it is the same attack that hit google way back when. Google disclosed it, and disclosed that 20 other companies were affected, and none of the other companies came forward.
- rudolf0 10y agoQuite plausible, but what evidence is there to support that?
- wglb 10y agoI don't have any other than there were 20 other companies who were not named at the time, Google was hacked by chinese military, now Yahoo claims china. Deduction on my part, but no further evidence than that.
- rudolf0 10y agoSure, but China has also (allegedly) been responsible for many other breaches unrelated to the Google incident.
- StavrosK 10y agoCan I just inject some perspective and say that the question would (should?) have gone something like this?: "So we got 500 million passwords stolen. We're using bcrypt with an adequate number of rounds, so we only anticipate 1000 of those passwords ever being broken. Should we issue a mass reset?" It's never black and white, you have to weigh things against each other.
- Bartweiss 10y agoDidn't the breach disclosure say "most" passwords were hashed with bcrypt? Obviously I don't know what everyone else got, but it can't have been better or they'd have said so... I don't mean to detract from your point, good prevention beats reactionary resets. It just raised my eyebrows at the time as a strange weasel word in a claim that users were safe.
- captn3m0 10y agoThe users table would surely contain more things than just usernames and bcrypt-hashed passwords.
- Bartweiss 10y agoSure, and even if the passwords stay secure this is bad for users. But I'm specifically reacting to "hashed passwords (the vast majority with bcrypt)". That's the sort of thing that's usually code for "except the ones which are horribly secured and will be compromised in a week".
- StavrosK 10y agoNow that you mention it, I remember that too. Seems weird, I don't know why you'd have some passwords hashed in other ways. Even if you've migrated, why not migrate everyone at once?
- astrange 10y agoYou need the user to login once to get their raw password to rehash it. Unless you like rewrapping old hashes in every new one as it comes along.
- arviewer 10y agoMarketing by deception... It's postponing the inevitable.
- gist 10y ago> Google hired hundreds of security engineers with six-figure signing bonuses Who left jobs working at other places and in theory left them more vulnerable and drove up the costs for hiring as well.
- robertelder 10y agoIf Yahoo had indeed positively identified the breach to have originated from a 'state-sponsored actor', it is possible that their thinking was something along the lines of "Resetting the passwords wouldn't help us much anyway against someone with so many resources." Of course, I'm just speculating based on what I see in news reports. Perhaps the 'state-sponsored' actor was just PR spin to save face? I really just don't know what to think.
- jgrahamc 10y agoReferring to the infosec team as "paranoids" is a really bad idea. I have our infosec team report into me and they terrify me on a regular basis but they are not paranoid. They worry, the poke around, they find stuff and they fix it.
- tptacek 10y agoThat's the name the infosec team chose for itself something like a dozen years ago.
- idlewords 10y agoIt's humor.
- mtmail 10y agoThe team calls themselves "paranoids" since at least 1999. I worked with them and have only praise. "We try to be somewhat lighthearted about security," [head of department] said. "As important as it is, I also think it helps adoption if it is not too serious." http://www.zdnet.com/article/at-yahoo-it-pays-to-be-paranoid/ http://www.zdnet.com/article/at-yahoo-it-pays-to-be-paranoid...
- vibrio 10y agoa wise board member once said "Congratulations, on [good Product launch]. The optimists in your team were right. But you should remember, it's clear that the pessimists on the team are the ones that made it so."
- wglb 10y agoI disagree. I know one of the former members, and I can assure that his peers in development think very highly of him. It was upper management that did not want to do foot the bill. And reluctance to be paranoid is a virtue that we all should have, not just the security team.
- crudbug 10y agoInteresting how internal politics works. Breach news coming right after aquisition. Blame the new owner.
- omouse 10y agoCannot wait for the class-action suit, I wonder if everyone across the world can join if it's based in the U.S. or if they would need to create class-action suits in their home country.
- darklajid 10y agoFunny timing. My in-laws (both 70+) just had to change their passwords (both using @yahoo.de email addresses) and my mother in law probably botched it / managed to type the wrong thing twice or something. Password reset requires 2 security questions (ugh - already ugly) and while she's 100% certain that she knows the answer to both the second one isn't accepted - probably another spelling issue (think St. Marlo vs. St Marlo vs. Saint Marlo vs. Sankt Marlo vs ..). All of this is her fault, not yahoo's. But now she's stuck. There are no ways to contact support, at all, and by now her 'resolve this problem' links already contain a "In rare cases like these, we suggest creating a new account" line. Anecdotal moral of the story: Yahoo has no customer support at all. Migrate your elder family members away while you still can. :)
- yuhong 10y agoI managed to contact support myself to regain access to an Yahoo account. I remember Yahoo customer support being on Twitter to deal with these kinds of issues.
- herge 10y agoI would say the moral of the story is you get what you pay for.
- coldcode 10y agoYet who would pay for email; not sure there even an option.
- schoen 10y agoFastmail?
- darklajid 10y agoThere's a paid option I think (I wouldn't consider that for myself, but stumbled upon it while searching for a way to solve this issue). But I'd also argue that a) you're paying, if someone offers a free service that is shoving ads in your face all the time, tries to hijack your home page and lures you to install browser toolbars and whatnot. It isn't free, you generate revenue. b) no service, free or not, should cause you to lose access to your data. While you might mumble "Backups! You should have those" that .. isn't exactly a decent reaction or something to tell a 70+ person either. Plus, the email address is an online identity. Tied into other services (password recovery there is now broken). Causing loss of future data, backups or not. If you provide a service like that, you should provide excellent ways to regain access to that in my world. c) I'd probably (well, not me. I'd make her..) pay for a ticket. Given the option..
- jrochkind1 10y agoI haven't even read the article, but based on headline I'd say "AND 99% of ALL companies EVERYWHERE." The headline makes it seem like this is an unusual thing. Nothing is secure, anywhere. A few companies actually prioritize it. Very few. And I truly think the economy could not bear the cost if everyone actually tried to prioritize security above all else.
- rdiddly 10y ago"Mr. Bonforte said he resisted the request because it would have hurt Yahoo’s ability to index and search message data to provide new user services. 'I’m not particularly thrilled with building an apartment building which has the biggest bars on every window,' he said." How about an apartment building where everybody's shit keeps gets stolen then? Everybody tries like hell to move out, and the only tenants left are those with no place else to go. Which on the internet is nobody.
- deleted 10y ago[deleted]
- tptacek 10y agoI am not sure what end-to-end encryption would have done to defend Yahoo's users against the entity that broke in and hoovered up its databases. Similarly: the password reset situation is sad (understandable --- it would have cost them millions of users at a point where their declining user base was being carefully watched by the market --- but infuriating) but again, what difference would it have made with respect to the most recent breach? There are just a few companies in the whole world who both run tens of thousands of servers and are equipped to go head to head with serious attackers. Yahoo isn't one of them. Has it ever been? No.
- dsacco 10y agoIn the interest of discussion, would you be up for naming those companies, in your opinion?
- utefan001 10y agoI just returned from DerbyCon. An amazing security conference that covers both attack and defense. All talks are on youtube. Here is a good summary of the powershell talks. Really good stuff. https://blogs.msdn.microsoft.com/powershell/2016/09/27/powershell-security-at-derbycon/ https://blogs.msdn.microsoft.com/powershell/2016/09/27/power...
- intrasight 10y agoCompanies should have a Chief Risk Officer who have a big component of their bonus based upon the success of their risk management strategies.
- erikb 10y agoReality check: Security (especially IT security) takes a back seat in 90% of businesses. The only exceptions are corps who gain significant power over govs and users by being secure (I think Google and Facebook here), and when regulations require a corp to do some kind of security fundamentals then these are applied as necessary to avoid fines.
- aswanson 10y agoDoes Twitter seem to take security seriously?
- CrankyBear 10y agoI never would have guessed!
- topspin 10y agoThat begs the question; what was in the front seat? Has Yahoo achieved anything of note since the 90's?
- tn13 10y agoThe way Yahoo! has been running I think their front seat is completely empty.
- droopybuns 10y agoPerlroth is gawker themed Krebs wannabe. Everyone involved in this story should be ashamed for helping fuel an unsourced article that is purely CYA for the former security team. Shame.
- apeace 10y agoI can relate to a company not putting value on security, or thinking the cost of securing systems may be higher than the cost of getting hacked. I once worked for a company where I inherited a RESTful API. It stored the company's core data, including private customer information. It had no authentication, completely open for anyone on the internet to read or update any of our data. I alerted my manager about this and that made its way to the highest levels of the company. The decision was to create a backlog item. It took about a year before we got to it. The reason we ended up finally fixing it was because we were contacted by a security researcher one day. He said he had found a vulnerability in our system, but wouldn't tell us what it was until we disclosed our bug-bounty terms (basically promising to pay him if he had found a real vulnerability). If we wouldn't do this, he was going to write a blog post about it. My manager used some delay tactics to buy us some time, while we spent the next 24 hours slapping a bandaid on the API. Once we had fixed it and agreed to pay the researcher, he disclosed his vulnerability and it had nothing to do with our API. It was a minor XSS that couldn't leak any sensitive information.
- pg_is_a_butt 10y agothere is no "minor XSS"... it either was XSS or it wasn't. and just because XSS couldn't directly leak any info doesn't mean it couldn't be used on a bigger scale to leak all the same info from individual users who had access to subsets of data that could be aggregated. you're all idiots.
- robk 10y agoThat sounds a lot like blackmail
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- dumbfounder 10y agoNewsflash: struggling company doesn't spend time and effort on things that don't directly make them money.
- b1gtuna 10y agoGoogle hired hundreds of security experts with 6 figure bonus... Is this kind of bonus norm in the Valley?
- wiremine 10y agoI'm not a big fan of regulation, but it feels like there is very little _internal_ motivation for a place like Yahoo to take security seriously. Not sure what the solution is, but unless there is a financial reason to create, I don't think we'll see much change.
- tracker1 10y agoI stopped using Yahoo the first time I setup an account for a friend and they were already on Yahoo's spam email reseller list faster than I could disable the opt-out setting. There was spam waiting in the inbox on an email account less than 5 minutes old. I appreciate some of what they've done for the larger community, but decisions like that which make users take such a distant backseat to the bottom line make me not want to be a yahoo user ever again.
- bwb 10y agoKeep in mind shit like this is what happens when people get fired and blame management, rumors & shit get started like this. We don't know the real story.
- tlogan 10y agoIf Yahoo end up being successful like, for example, Slack or Dropbox these security issues will not be at all discussed here. I did not see any outrage when Slack security issues back in May 2105 [1]: majority of people were saying "but it is great software". Dropbox the same. So Yahoo did a similar bet as all other companies (focus on features - we will fix security latter) but they lost that bet. [1] http://www.makeuseof.com/tag/slack-hack-need-know-collaboration-tool-security-breach/ http://www.makeuseof.com/tag/slack-hack-need-know-collaborat...
- amelius 10y agoSee also: https://news.ycombinator.com/item?id=12563798 https://news.ycombinator.com/item?id=12563798 Quote: > Whenever mega-hacks like the Yahoo! fiasco hit the news, inevitably the question gets asked as to why the IT security systems weren't good enough. The answer could be that it's not in a company's financial interest to be secure.
- mathattack 10y agoGoogle hired hundreds of security engineers with six-figure signing bonuses, invested hundreds of millions of dollars in security infrastructure and adopted a new internal motto, “Never again,” to signal that it would never again allow anyone — be they spies or criminals — to hack into Google customers’ accounts. Wow! Security starts at the top!
- deleted 10y ago[deleted]
- GirlsCanCode 10y agoMarissa is so completely incompetent. We all know how and why she got the position. It's a shame that she'll profit from her failures and continue unscathed.