25 ms·

Yahoo discloses hack of 1B accounts

• ilarum 10y ago
  In case you are looking for the important information, it seems to be MD5 hash without salt.
  • chillydawg 10y ago
    Bloody hell. Sloppy and incompetent.
    • kuschku 10y ago
      [deleted]
      • scrollaway 10y ago
        It's really not. Unsalted MD5 has been shameful for a long, long time.
        • pluma 10y ago
          As a data point: when I was a teenage code monkey in 2004 writing PHP I already understood that unsalted MD5 is unsafe. According to Wikipedia: * 2004 it became possible to find MD5 collisions at a rate of one per hour on a cluster * 2005 it became possible to do this within "a few hours" on a consumer laptop * 2006 it became possible to do this within one minute * nowadays it's possible to do this "within seconds" Plus, as others have mentioned, it's now possible to find collisions instantly by using widely available rainbow tables, e.g. https://md5db.net/decrypt https://md5db.net/decrypt
          • yuhong 10y ago
            MD5 collisions are probably not important for passwords.
            • funnyfacts365 10y ago
              Care to explain? The hashes are what is compared so it seems it's important.
              • duskwuff 10y ago
                The existence of crafted collisions -- being able to create a pair of M1 and M2 such that MD5(M1) = MD5(M2) -- is primarily relevant to situations where MD5 is being used as a signature algorithm, such as in certificate issuance. In these applications, being able to generate a pair of documents with the same hash is catastrophic. Being able to generate a pair of passwords that are treated as equal, on the other hand, is useless from a security perspective. It's a neat party trick, but it's not dangerous. Now, if there were a preimage attack -- being able to take MD5(M1) and come up with a M2 such that MD5(M2) = MD5(M1) -- that'd be a much bigger deal, and it'd break MD5 password hashing wide open. But nobody's done that yet.
                • rev_bird 10y ago
                  I'm a total greenhorn when it comes to cryptography, but the difference between these two situations was totally lost on me until I read this comment. When I see, "It's easy to create MD5 collisions," my first thought is, "If you give me a hash, it's easy to find a string that results in an identical hash." If I'm understanding this right, that would be a "preimage attack," and would be bad for all the reasons being discussed in this thread. However, it seems like "It's easy to create MD5 collisions," at least as it is true today, actually means something different: That, given a string, it's easy to find a second string that shares the same hash. If that's the case, I have two questions: * I am totally lost as to how these are different scenarios. There's no difference I can see between "Here's string A" and "here's the hash of string A," if the goal is to find a "string B" that shares the hash. Are these "crafted collisions" generated by modifying string A and string B, until a collision pops out? * If that's the case... what's everyone freaking out about? Why were people saying MD5 is unsafe 20 years ago, if even now, we can't achieve a preimage attack that can get you into an account based on the valid password's hash? Yahoo could have printed these hashes out and hung them up on posters in the mall and no one would have been able to get into accounts from it. There are dozens of comments lamenting how stupid this was, but... it seems like there's no actual problem?
          • Buge 10y ago
            That website does not find collisions. It uses rainbow tables (or some other type of table) to crack passwords that it already knows. Collisions are irrelevant for password cracking.
      • chillydawg 10y ago
        No, sorry. They're borderline criminally negligent. When you have 1bn passwords stored in raw md5, a decade after the first rainbow tables were published, then you don't deserve anyone's business or your freedom.
        • kuschku 10y ago
          Sure, it's borderline negligent. But it's already a godsend compared to what many banks do, storing passwords in plaintext, sending reset passwords via plaintext email, requiring 4-8 character passwords that can only contain digits and a limited set of characters, etc. I'd be more than happy if any bank would follow Yahoo!'s password standards.
          • Kadin 10y ago
            Most banks don't have a billion customers. (There are probably a few that do, but not many.)
      • camus2 10y ago
        > Sure, SHA1, scrypt or bcrypt with salt were already common back then, but it's an entirely different story than if they had used it today. Not an excuse, this is Yahoo, not a PHP shop in India doing some low budget contracting.They should have a top of the line security team enforcing the most recent secure practices. Furthermore I got no email from Yahoo telling me that my account may have been hacked. Both incompetent and irresponsible at the same time. By the way I did some PHP dev back in 2011. bcrypt hashing was already common practice. How can you come up with that argument in good faith ?
        • kuschku 10y ago
          > How can you come up with that argument in good faith ? Let's say I've seen far worse in 2016, from companies storing far more sensitive data. Like a bank, with no 2FA support, emailing me my plaintext password after clicking "Password forgotten", in 2016. This story is problematic, but I'd be grateful if that bank would implement even the same stuff as Yahoo.
        • normaljoe 10y ago
          > Furthermore I got no email from Yahoo telling me that my account may have been hacked Then your account was most likely not on the list of accounts compromised. > By the way I did some PHP dev back in 2011 Well Yahoo is a tad bit older then that, by about 17 years. This is not an excuse, but really comparing your 2011 coding to 1994.... Go ahead and boot up your old 486. I'll get back to you when this page loads up in an hour. :) Yahoo's code base is old and huge, like billions of lines huge. Yahoo's engineers have modernized it at a massively rapid pace. I'm not sure of current state, but when I left Yahoo finance was written in something like 10 languages including serving pages in C, cause that's all they had back then. Current tech is NodeJSish and others. They have their own hardened versions. But still migrating millions of lines of C to something other then C isn't a walk in the park.
    • mtgx 10y ago
      Also malicious (allowing NSA to search through everyone's emails).
      • bpicolo 10y ago
        Current law seems to dictate that if the NSA wants that, it's what they're getting. Blame the government.
        • deleted 10y ago
          [deleted]
      • iopq 10y ago
        They actually fought in court about it, so I commend them for it
    • dopamean 10y ago
      I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.
      • bpicolo 10y ago
        I doubt that decision was made in the last decade. It's surely just something that's been around for a long time and was never upgraded. Still neglectful, but I sincerely doubt it was just a recent engineer's bad decision-making.
      • stanleydrew 10y ago
        Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade. It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.
        • cm2187 10y ago
          But it's not like if we didn't have a pretty much continuous stream of major data leaks for the past 5 years. Surely yahoo engineers occasionally open a newspaper...
          • Endy 10y ago
            From everything I've read, the engineers did. The problem was that the security team had to go head-to-head with the budget team. And unfortunately, the budget team won - since the upper levels didn't feel that the IT security salaries were a necessary expenditure. And beyond that, there was concern that making people actually change their passwords regularly and requiring anything like security in said passwords was going to discourage users from using Yahoo and send them over to GMail. Unfortunately... that argument wasn't wrong.
            • 10y ago
    • MorePowerToYou 10y ago
      I think the organization as a whole is just indifferent. Does this breach really matter to Yahoo's bottom line? They were already sold to Verizon. Most of the active users probably won't read this news. It's sad to say, but I think Yahoo as a whole just doesn't care about their users.
• harigov 10y ago
  I hope they stopped depending upon those security questions if that is part of the leak. On a side note, this seems like a great time to be an abuser. One can collect so much information about users - they may actually have more data than any govt in the world.
  • NoPiece 10y ago
    I hope everyone stops relying on security questions!
    • jonathantm 10y ago
      What is your mother's maiden name? T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl
      • moo360 10y ago
        Of the Greenwich T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl's ?
        • rezashirazian 10y ago
          I laughed too hard at this.
      • Klathmon 10y ago
        Which only works until you call in asking for a password reset and when they ask you the question you just say "I just hit the keyboard a bunch".
        • mikestew 10y ago
          No, I pull up the answer out of 1Password and read it off to them.
          • 10y ago
• netrap 10y ago
  I guess this is the final nail in the coffin...
• draw_down 10y ago
  I thought "didn't they already announce this recently?" Nope, that was a different one. Boy oh boy.
  • freddyc 10y ago
    My thoughts too. I was "yawn .... holy hell another billion accounts". It will be interesting to see where Verizon lands on this.
• fname 10y ago
  Maybe that can get Verizon another $1B discount.
  • mtgx 10y ago
    I'm hoping Verizon kills the deal. It would send a powerful message (unintentional on Verizon's part, but irrelevant) that a major data breach + installing NSA's rootkit on your servers could one day cost you billions of dollars, as well as give you a forever tainted reputation. https://motherboard.vice.com/read/yahoo-government-email-scanner-was-actually-a-secret-hacking-tool https://motherboard.vice.com/read/yahoo-government-email-sca...
• platinumrad 10y ago
  Plain md5 again. Nice.
• anton_tarasenko 10y ago
  Yahoo's press release with details: http://www.businesswire.com/news/home/20161214006239/en/Important-Security-Information-Yahoo-Users http://www.businesswire.com/news/home/20161214006239/en/Impo...
  • rbcgerard 10y ago
    LOL this is rich: "...identified data security issues concerning certain Yahoo user accounts." Certain...more like all up to that point?
    • Endy 10y ago
      Not by several orders of magnitude.
      • mypalmike 10y ago
        Are you saying yahoo has... trillions of users?
        • Endy 10y ago
          Trillions of accounts, based on reputable sources. Users and accounts are different.
          • tlb 10y ago
            [citation needed]
• alyandon 10y ago
  "Separately, we previously disclosed that our outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies." So that exactly explains how my Yahoo account was used to send spam despite having a password that can't be reasonably brute forced (despite them using MD5). :-/
  • ubercore 10y ago
    What do you mean by a password that can't be reasonably brute forced? EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.
    • agf 10y ago
      If it's a password so long and complex it wouldn't be in any rainbow table computable in reasonable time. While MD5 can be computed quickly, there is still a limit to how many you can compute -- and there are an infinite number of possible passwords if they aren't length limited.
      • manarth 10y ago
        Rainbow tables are attacks against secure algorithms. MD5 is recognised as an insecure algorithm: given a known hash, there are multiple possible passwords that would resolve to the same hash, therefore appearing to be the correct password. With MD5, it's not necessary to compute an infinite number of possible passwords, and it is possible that, given a particular hash, a collision can be found within a reasonable time.
        • SamBam 10y ago
          What you're describing is the same for every having algorithm in existence. All hashes can represent multiple (indeed, infinite) passwords. So they all have collisions. This is because all hashes are fixed-length, and so finite, while the possible inputs are infinite. This isn't the reason that MD5 is weaker than other algorithms.
• niftich 10y ago
  > August 2013 > hashed passwords (using MD5) I don't even know what to say. > investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies How is this possible? Aren't most auth cookies just a session ID that can be used to look up a server-side session? Did they not use random, unpredictable, non-sequential session IDs?
  • xanadohnt 10y ago
    Web tokens, for example, don't necessarily include just a session ID. Some include the full session details within its payload. This can be quite useful, actually, because it offloads session-lookup onto the client.
    • camus2 10y ago
      How do you invalidate a JWT server-side without the user interacting with the server ?
      • perlin 10y ago
        With JSON web tokens (JWT), the client or server must know the secret key used to sign the token in order to validate it, but anyone can view its payload.
      • bpicolo 10y ago
        Could do it if you knew the JWT token text in theory?
      • Alex3917 10y ago
        Each JWT has an issued at date, so you just need to reject all tokens issued before that time. In addition to invalidating all tokens if there is a breach, each user account can have its own datefield to invalidate all the tokens for that account if a user changes their password or whatever.
      • 10y ago
• ben174 10y ago
  This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.
  • serf 10y ago
    honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?
    • ben174 10y ago
      Back in 2013 I wasn't using the password generator feature for some reason. I was just using it as a vault for my memorized passwords. A bit silly I realize and now generate passwords.
    • deleted 10y ago
      [deleted]
    • fencepost 10y ago
      In my case, it's because I still have some very old accounts in there. Accounts that predate not only this password manager (LastPass) but the previous one (KeePass) and which in fact go all the way back to something that started with "Yet Another (YA)" back on a Palm device. I really ought to go through and do some janitorial work in there, but some of those are for sites that actually still exist and for which those logins are likely still valid. I don't care enough about them to go log in on each and change passwords, but I also don't want to simply delete them and leave yet another orphaned account.
      • golf1052 10y ago
        I recently did this after I found a password manager that works with the devices I use. Took me a few hours to remember and track down all the accounts I use. Managed to get close to 70 accounts and even then I missed some. I think it was worth it though.
• hbosch 10y ago
  So, the scuttlebutt last time was that they disclosed the hack due to a potential Verizon buyout forcing their hand. Seems as though this could be the same thing, generally speaking. Can anyone enlighten me as to how Verizon compels Yahoo to disclose this information? Or rather, how does Verizon know about these intrusions, if they do?
  • rqebmm 10y ago
    It's most likely just part of the due-diligence required for the merger. Yahoo brass probably decided that publicizing this information wasn't worth the PR hit, and so they buried it, but Verizon doesn't want to take on the risk of a potential lawsuit, so their lawyers required Yahoo to disclose it if they want the deal to go through.
  • fencepost 10y ago
    I believe in this case Yahoo wasn't previously aware of the hack - they were notified by law enforcement, which presumably found a file of the information somewhere during an investigation. There was enough info to let them ID a time period, but nothing that lets them know the who/how of the breach.
  • mobilefriendly 10y ago
    Some states like CA have a legal requirement to notify in the event of a breach, so hiding this event is illegal.
    • manarth 10y ago
      The article is from Yahoo, it's a notification from Yahoo, announced by their head of security. They're not hiding the event.
      • empath75 10y ago
        Seems like they hid it for a few years.
• ausjke 10y ago
  I'm speechless. More and more are migrating to cloud these days, I expect more and more epidemic leakage will come. I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is dying from what I read)...
  • swiley 10y ago
    Me and a number of my freinds in clubs at my university use it whenever we need to send secrets to eachother, but everything else is done in clear text.
  • cm2187 10y ago
    The complexity isn't that much of a problem. Windows server + smartermail has a nice UI all the way. The problem is cost. [edit] by the way I wonder how useful would be a tutorial "for dummies" of how to set up your own mail server from scratch. I assume that users who would be happy to pay for their own server but feel it is too complicated would likely be windows users, i.e. wouldn't mind having to pay for a license and would like to use an environment with a relatively exhaustive UI. I'll give it a try.
    • tweakserver 10y ago
      SmarterMail have both perpetual + monthly lease licensing options. Leasing of SmarterMail Pro 250 Mailboxes was as low as $15/mo. Overall SmarterMail have a easy installation and all the management is via the web interface. if you are looking for a perpetual license, grab the 46% discount that's going to end by 31/12/2016 from https://www.tweakservers.com/mail-servers/smartermail/ https://www.tweakservers.com/mail-servers/smartermail/
  • cimi_ 10y ago
    > PGP is dying from what I read... Can you please provide some references for this? What are the alternatives?
• camus2 10y ago
  Notice that this is yet ANOTHER hack, not the one HN was talking about a few month ago. also notice they were still using MD5 passwords AND without salts ... None of these hacks have been disclosed directly to their users, I never got an email saying I may have been hacked and I should reset my password, irresponsible.
  • LeoPanthera 10y ago
    This "new" one happened before the previously disclosed hack.
• ponco 10y ago
  I almost hope the data is made somewhat public so Troy / https://haveibeenpwned.com/ https://haveibeenpwned.com/ can get a hold of it and provide the public with reassurance.
  • loader 10y ago
    That was my first thought. I used to have a Yahoo email and I'm assuming at this point (multiple hacks), it's out in the wild.
    • golf1052 10y ago
      I used to as well but if you still can access it you should delete it: https://help.yahoo.com/kb/account/close-yahoo-account-sln2044.html https://help.yahoo.com/kb/account/close-yahoo-account-sln204...
  • inopinatus 10y ago
    By now I suspect you can simplify it down to just matching on the RHS for any domain registered to Yahoo.
    • longwave 10y ago
      A number of ISPs have used Yahoo to provide mail services in the past, so it's probably not quite as straightforward as that.
      • manarth 10y ago
        And not just small ISPs, but major ISPs, such as BT (with 32% of the broadband market-share in the UK).
• mkhpalm 10y ago
  Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.
  • JustSomeNobody 10y ago
    But that's where all my junk mail goes...
    • intopieces 10y ago
      I recently decided that if I don't trust the company not to send me spam, I don't need to avail myself of their services. It might not be possible for everyone, but it's made my life a lot simpler.
      • manarth 10y ago
        I don't trust any company to not send me spam. Even if they don't do it today, they may get bought-out, hacked, or otherwise lose control of the data. Even if everything suggests that they won't spam me, I'm not entirely convinced. Even if they're the most upstanding company on the planet, I'm still not convinced. Based on past experience, you understand.
        • intopieces 10y ago
          Well, I still have a spam filter algorithm. But I'm overall done balancing multiple personal email accounts because of the liability involved. If it gets hacked (and it's one I don't ever check), will I notice? It seems unwise to have extra email accounts open, potentially with my personal data and associated with my identity online. It's also a matter of attention: I have a limited amount of it, and tracking multiple email accounts and managing a spam account isn't worthy of it.
  • camus2 10y ago
    Is it possible to extract all emails+contacts from yahoo without paying ? furthermore my paypal account is linked to yahoo.
• JustSomeNobody 10y ago
  What value does Yahoo have for Verizon now, the brand is so tainted?
  • nly 10y ago
    I'm not sure Average Joe really associates these hacks with incompetence or negligence. Those nasty hackers are making victims of poor Yahoo.
    • BipolarElsa 10y ago
      Average joe won't even know what happened let alone care about it. A small minority of hackers care/know how shitty Yahoo! is, and that's about it.
    • elaineo 10y ago
      That's why Yahoo made the point of blaming a "state-sponsored actor". You would expect a giant tech company to be able to defend itself against random hackers, but what if it was the government of Russia?? That's why Sony Pictures blamed North Korea for what was, in the opinions of security experts, the work of an insider.
• AdmiralAsshat 10y ago
  Well on the upside, if you changed your password as a result of the hack from a few months ago, you should theoretically be safe against this one which happened in 2013. Those security questions, on the other hand, are still fair targets.
  • SomeCallMeTim 10y ago
    I had a Yahoo account entirely to use a Yahoo email list; I used to have it for Yahoo chat, but I haven't used that in years. So I ignored the hack a few months ago. I also never got notified that I was vulnerable. Just now I tried to log in to see if my password had been invalidated. Nope. It was my old insecure "pattern-based" password (myprefixYAHOO) that I use nowhere any more. Probably short enough to have brute forced with MD5 in a few minutes at most. And yet...no spam sent from my account. No spam in my account (except some kind of announcement from "Aabaco, the new name of Yahoo Small Business" from a year ago. Just some of the mail from the email list that petered out over two years ago as the list transitioned into a Meetup group. So I guess Yahoo either has considerably more than 1B users, or there were simply so many compromised accounts that they didn't bother trying to use all of them to send spam. Changed the password just now to something secure "just because", but it's hard to care.
    • Endy 10y ago
      It's more that there's more then 1B accounts out there - remember that this isn't just "yahoo.com" that got affected, it's Yahoo, YMail, RocketMail, yahoo.co.jp (a HUGE community btw), and several others which all fall under the "Yahoo accounts" umbrella. Not every account was hacked by any means; terrifyingly, the number of accounts isn't nearly what you'd expect as a percentage of "Yahoo accounts".
      • jsjohnst 10y ago
        Yahoo! Japan is separate from Yahoo! "worldwide". They actually run separate parallel infrastructure for many things, so I highly doubt YJP was part of the one billion accounts.
      • 10y ago
• carbocation 10y ago
  I cannot tell from this disclosure -- have they updated their algorithm beyond MD5 at this point?
  • astrodust 10y ago
    Maybe they're using double MD5 with a salt of "$uper$ecure".
• dom0 10y ago
  By now it's probably easier if Yahoo just published the (short) list of services that weren't owned through-and-through right under their noses, and notify users unaffected by any breach (0 rows returned).
• dfar1 10y ago
  What a hot mess. I am glad I mostly ignored their services over the years.
• hvo 10y ago
  MD5 in 2016?.I hope yahoo can save itself and tech community all this embarrassment by just going out of business one and for all.Folks at the helm of affairs at yahoo are incompetent. And it is about time government started to persecute incompetent CEO.
  • bobbles 10y ago
    It occurred in 2013
    • johansch 10y ago
      ..and it took them three years to find and report it?
      • Endy 10y ago
        More likely report than find. From what I've seen of their current disclosure policies, and what execs have written on Y!Answers and such, they find the problem, they figure out who did it and how, and then after they've figured out how to fix it, they alert the userbase and the public - in that order. Also, please do remember that we're getting into a different leadership team now at Yahoo; previously they were absolutely convinced that disclosure and alarmism were one and the same - and that any perceived weakness in the Yahoo Mail product would drive people to GMail.
        • johansch 10y ago
          The intrusion happened more than a year after Marissa Mayer became CEO of Yahoo.
    • pluma 10y ago
      Unsalted MD5 has been demonstrated to be vulnerable to collisions since 2005. Rainbow tables existed way before 2013. There's no excuse for a tech company of this size.
      • 10y ago
• icpmacdo 10y ago
  When are the mutlibillion dollar lawsuits that cause these idiots to get it together with security
  • eric_h 10y ago
    Likely obviated by their EULA
  • elaineo 10y ago
    Unfortunately, lawsuits are rare unless a user can demonstrate that the hack led to measurable harm.
• DougN7 10y ago
  This occurred in 2013.
• SixSigma 10y ago
  Let's not forget that high ranking officials in the US govt. used Yahoo to send classified information to print at home.
• jasonmp85 10y ago
  Anyone up for trying to get a corporate death penalty law on the books?
  • djsumdog 10y ago
    We should at least be able to execute them in Texas.
• taurath 10y ago
  Its scary to think about the consequences if the only reason Yahoo knew they got hacked was that they are more, and not less competent at security. Do you think the security team {insert retailer, other nontech company with a login screen here} is somehow MORE competent?
• sciurus 10y ago
  This is being discussed at https://news.ycombinator.com/item?id=13180101 https://news.ycombinator.com/item?id=13180101
• phantom_oracle 10y ago
  there's a couple of things that these major providers getting pwned teaches you: 1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays) 2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it) 3) the price of ads/convenience is no longer worth it. I'm assuming at least a sizable minority of internet users are using ad-blockers these days. They can't get your eyeballs, so they package and sell your data. Granted, you can probably now get the same (raw) data on the black market by paying a fraction in bitcoin and you'll get to see those billions of emails telling people someone attacked their farm in farmville from 2009 Lastly (and I really hope this happens), Yahoo implodes/collapses (cause the average Joe won't migrate willingly) and leaves a vacuum for their 500+ million email users. Hopefully the smaller providers (Proton, Migadu, Posteo, Tuta, etc.) get at least 10% of these users and the email-cartel is broken (somewhat).
  • Endy 10y ago
    If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho. I hate Google's mail interface, I hate the way they make 'conversations' out of discrete emails, and I especially hate their lack of folders. I use GMail begrudgingly at work, and only when necessary, and every time, I look at it and go, "what dipshit ever thought this was a functional way to deal with email?" As a dedicated Windows user, I'm more likely to use iCloud than GMail if Yahoo goes down; but I doubt that. I like Yahoo email as a user. Yes, they've made mistakes, and I accept that. I'd prefer their mistakes over Google's superiority complex.
    • eric_h 10y ago
      > I hate Google's mail interface Their IMAP interface is both standards compliant and fully functional. I'm not terribly fond of the Gmail web/native apps either, so I just don't use them (though I do occasionally hop on the web app when my client isn't searching the email as effectively as google does). With 2FA it can be a bit more work adding devices, but it's not a deal breaker for me.
• reiichiroh 10y ago
  This is the same Yahoo that wants us to switch to a LESS secure password-less Yahoo Key?
• cmurf 10y ago
  OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific companies rather than entire technologies. And so on. So how are these externalities dealt with where there is no such thing as insurance for this type of breach? There's no way to put the toothpaste (my private information in the form of answers to personal "security questions") back into the tube (only my brain or nearby sphere of influence). And this goes along with IoT devices that aren't having their known exploits patched by their manufacturers. Similar problem different details. So without broad laws that say this is wrong and here is a mechanism to attach a tangible cost to this information so a proper risk assessment is done, I imagine we keep seeing this happen with essentially no punishment beyond what Yahoo already is getting punished for.
  • droopyEyelids 10y ago
    You're demanding accountability from insane people. I learned long ago, never to wrestle with a pig. You get dirty, and besides, the pig likes it. Read more at: https://www.brainyquote.com/quotes/quotes/g/georgebern137450.html https://www.brainyquote.com/quotes/quotes/g/georgebern137450...
    • dmix 10y ago
      Ironically, you're quoting George Bernard Shaw who believed in eugenics, anti-vaccination, and "expressed admiration for both Mussolini and Stalin". I'd be sufficiently curious to find a single person who fits the profile of the ideologue the OP is referring to. I'm afraid such a person doesn't exist.
  • Canada 10y ago
    > including no lawsuits Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.
• zmmmmm 10y ago
  Sorry, there's no shielding Marrisa Mayer from this. Yes, she had only been there a year or so. But that's long enough she should have been on top of security. Yes, she's just killing time until she leaves now anyway. But, the symbolic statement is still important - she should resign.
  • Girlang 10y ago
    This is bad for Women tech CEOs in general. None of them seem very good.
  • rckclmbr 10y ago
    > Yes, she had only been there a year or so Uh, it's been 4 years... I know, time flies.
    • kej 10y ago
      GP means that she had only been there a year or so when the leak happend.
• nkkollaw 10y ago
  It's amazing that they're telling users to change their password/security questions 3 years after the hack.
• dingbat 10y ago
  security is important, but lets not forget the strides theyve made in making meaningful connections with their audience via collaborative relationships with powerful leaders such as Katie Couric
• jwatte 10y ago
  nelson_ha_ha.gif
• kajecounterhack 10y ago
  Related: former Yahoo security engineer talks about a backdoor Yahoo installed for the NSA to read private emails...behind their security teams' backs... https://diracdeltas.github.io/blog/surveillance https://diracdeltas.github.io/blog/surveillance
• CodinM 10y ago
  RIP
• Arubis 10y ago
  Fittingly, attempting to change my password to a 32-character random string generated by 1Password returns an error that the password "cannot contain my email or username", regardless of the contents of that random string (I tried several). It does, however, _happily_ accept `passwordpassword` and cheerily move along to confirming that my recovery email account from 2003 is still valid.
  • duaneb 10y ago
    Gonna guess that's a bad message for a password length violation or something else. Not that it's much better. Is it so hard to allow 50 character passwords?
    • bagacrap 10y ago
      I'm guessing it detected an @ symbol?
      • divanvisagie 10y ago
        has anyone tried password@password ?
    • AsyncAwait 10y ago
      if the password is stored properly, (i.e. bcrypt), the number of characters shouldn't matter at all, be it 50 or 5000.
      • deleted 10y ago
        [deleted]
      • drodgers 10y ago
        If the password is stored properly, (i.e. bcrypt) then there does need to be some length limit or it becomes too easy to DoS a service by sending it hundreds of megabytes of password to bcrypt. There's no reason for that length limit to be less than 100 characters though.
• uptown 10y ago
  When credit cards are compromised, the responsible party is usually responsible for providing identity theft protection. Why not tech firms that seek to store sensitive personal information? Maybe it'd scale back the desire for every firm to collect as much personal info as you'll provide them.
  • ajmurmann 10y ago
    I generally like this idea, but wonder if it would result in even fewer disclosures.
  • djsumdog 10y ago
    To be fair, that identity theft protection is lip service/worthless bullshit.
    • shawn-furyan 10y ago
      True, however, it does put SOME price on data collection, rather than leaving it in the realm of pure externality. The deterrent of cost is the benefit, not the protection itself. On the other hand, adding a price may embolden deep pocketed organizations to 'pay to absolve' for losing data to hackers on an ad hoc basis as a cheaper alternative to strong security and limiting data collection scope. In that case, the impotence of ID theft protection hurts a lot more.
• CiPHPerCoder 10y ago
  If anyone else has screwed up and used MD5 for passwords and doesn't know a good way to migrate towards something secure: https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016#legacy-hashes https://paragonie.com/blog/2016/02/how-safely-store-password...
• hacker_9 10y ago
  sigh this is really shitty news. In a time when governments are deciding more invasive surveillance is in everyone's best interest too, it's probably never been more profitable to be a hacker.
• deleted 10y ago
  [deleted]
• MarkMc 10y ago
  So when did Yahoo stop using MD5 as the password hash? 2014?
  • manarth 10y ago
    Have they stopped? ;-)
• LargeCompanies 10y ago
  They can have 17 years of junk mail as that's all I ever used yahoo for
• nsxwolf 10y ago
  What good is requiring you to change your password on the next login? How do they know it's not just being re-compromised? There are a lot of accounts that are orphaned, but the contents are exposed and still a threat to the original owners. Why not just lock the accounts?
• sqldba 10y ago
  Technically; no. Bureacratically; maybe. Given the skill and self direction of offshore workers; impossibly.
  • jrockway 10y ago
    You've somehow managed to turn a bug report into a soundboard for your racist insecurities. Impressive. In a sad way.
    • 234dd57d2c8db 10y ago
      ... "offshore workers" are not a race. You realize offshore workers could be the same race as the person posting right?
      • Helmet 10y ago
        Given the context, you know damn well what he means - it's coded speech and I refuse to believe that you're that naive.
        • deleted 10y ago
          [deleted]
        • knieveltech 10y ago
          You claim to be able to accurately discern intent from plaintext on the internet? If true you're wasted anywhere outside the justice system.
      • mlangdon 10y ago
        This is technically true, which is the best kind of true. Swap in nationalist, chauvinist. It's utterly clear what was meant by racism above, in spite of your semantics.
        • WillPostForFood 10y ago
          Yes we understand, racist is the liberal catch all for anyone you disagree with. The problem is that it dilutes the value of the word, so when someone deserves to be called racist, it people don't know if they really are racist, or are just opposed to outsourcing jobs.
• anigbrowl 10y ago
  It baffles me that Yahoo continues to live an independent existence. It's like a Terminator that never had a clear mission and now just wanders around randomly banging into things.
• swehner 10y ago
  Easier to list who was not affected??!!
• GoodieBear 10y ago
  This Yahoo company seems pretty cavalier.
• jlgaddis 10y ago
  I just attempted to log in to an old @yahoo.com account that I haven't used in probably five years or more. On the login screen, there was a short notice about this breach (with a link to more details), and after logging in I was prompted to create a new password, and update recovery emails / phone numbers. That doesn't negate any of this shit that happened, obviously, but maybe they're at least gonna try to make things better (we can hope, anyways).
• tomc1985 10y ago
  For the longest time my yahoo account (which I had not checked on in many years) reported at least a dozen open sessions originating from IPs in Russia and Eastern Europe, and unlike my legit sessions I was unable to kill them in the control panel (the site would bug out) So yeah, Yahoo's been hacked. Duh... Finance and Flickr are about all Yahoo is good for any more, and I think my portfolio page loads (instead of 404'ing) maybe 1/2 the time I request it... (God I really hope they dont mess with flickr though...)
  • brennen 10y ago
    I'm really not sure how they could do flickr more damage than they already have.
• AndrewMock 10y ago
  Being a Fortune 500 CISO must be so easy. Corporate expectations are evidently low enough that you probably don't have to show up for work.
• myared 10y ago
  One day, this will be Google announcing they've had a breach of this size. Not looking forward to that day.
  • d0lph 10y ago
    At the very least they probably wouldn't be using md5.
• drelihan 10y ago
  How does yahoo have a billion accounts???
• EGreg 10y ago
  I didn't know Yahoo had 1B accounts. Most must not be active, otherwise how could they be so small financially compared to Facebook and Google?
• wapz 10y ago
  I logged into my yahoo email in chrome in an incognito tab and it logged into someone else's account. This was probably in 2014 (it could have been in 2013). I wonder if this was related at all.
  • danielweber 10y ago
    What's likely is that two people were logging in at once and they ended up with the same credential because someone didn't realize that a servlet is a singleton.
    • wapz 10y ago
      Thanks. I posted to reddit asking what happened but no one ever answered. I thought it had to do with someone leeching my wifi or something causing some "saved data" from IP or something crazy like that. The other user was also living in Japan (I sent him an email on his own account telling him what happened but didn't stick around to see what happened). No, I didn't read his emails but when I looked at "new" expecting mine I saw a few emails about something in Fukuoka Japan (probably where he is or close to where he is).
• cdevs 10y ago
  Security question : mothers maiden name?answer: 1q&#*v83%?ghd53 Date of birth : 01/01/2011
  • normaljoe 10y ago
    Using a random answer doesn't help against an attack it the security questions are stored in plain text. I'm not saying storing security questions as a hash is any better practice since these questions just need to go away. I am saying that most likely they aren't stored as hashes so a phone operator can query you hence random is only as good as something like BarkBarkRuffRuff for a maiden name.
    • qntty 10y ago
      I think the point is not to reuse these common security question answers between sites
• automatwon 10y ago
  1 billion accounts. I'm curious: Has there been a bigger data breach, in terms of user volume?
• wdr1 10y ago
  If you collect user PII & get hacked, you should be obligated to pay for the damages. Specifically, covering the user for identify theft monitoring for 10-15 years.
• disposablezero 10y ago
  Yahoo - AOL email for grandparents, owned by Verizon, destined to be maintained by Taos.
• dimino 10y ago
  I thought we knew about this already, is there more info than before?
  • dingdongding 10y ago
    This is a separate breach
• intralizee 10y ago
  I don't know why anyone would still be using Yahoo as their email provider at this point.
  • makr17 10y ago
    I don't use the account, but I was required to create one in order to get internet connectivity at home via AT&T...
• witty_username 10y ago
  Anybody getting "NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED"? Chrome says "The server presented a certificate that was not publicly disclosed using the Certificate Transparency policy. This is a requirement for some certificates, to ensure that they are trustworthy and protect against attackers." Probably my Chrome version is too old I guess? (probably not, it's 53 which is only a little behind the latest).
  • lorenzhs 10y ago
    Your Chrome version is indeed to old. There's an issue with Symantec certificates and Certificate Transparency in Chrome 53. Just update it.
• _navaneethan 10y ago
  "We analyzed this data with the assistance of outside forensic experts and found that it appears to be Yahoo user data" How the forensic experts could have analysed? based on the log data? my another question is, just assume if yahoo is trying to dump the experts, can it be possible? or else, still the experts be experts to make sense out of it?
  • aboru 10y ago
    Is this english?
• copser 10y ago
  Wait, according to this, """ Based on further analysis of this data by the forensic experts, we believe an unauthorized third party, in August 2013, stole data associated with more than one billion user accounts. We have not been able to identify the intrusion associated with this theft. We believe this incident is likely distinct from the incident we disclosed on September 22, 2016. """ this incident occurred in 2013 and 2016, or they needed three year to figure this hack out. How is this possible?
• kumarski 10y ago
  Sales and marketing automation companies just got a huge boost in their capability to do SMTP validation. Time to go check HANSA on the onion.
• kstrauser 10y ago
  DO NOT delete your Yahoo account! In their disclaimer when you delete it, they state: > "[...] we may allow other users to sign up for and use your current Yahoo! ID and profile names after your account has been deleted" Bummer if you forget that it was the password reset email for your Facebook account, huh? Instead of deleting your account, purge it of all data: https://honeypot.net/purge-your-yahoo-account/ https://honeypot.net/purge-your-yahoo-account/
  • ProbabilityMoon 10y ago
    I just deleted all data from my account and set an automatic responder stating that, due to security concerns, I no longer use that account. I created my Y! account in 1998, it's a shame it has come to this. There were a lot of memories I had to purge along with my account (even though I had a different main account in the last decade). Shame!
  • 2sk21 10y ago
    This is a terrible policy. Do other email providers have a similar policy?
    • mkj 10y ago
      Probably not that terrible if they only do it for accounts that were created and never used. Like all the good GitHub usernames that seem to be abandoned.
      • hobarrera 10y ago
        GitHub usernames and emails are very different things. You don't get password reminders sent to your github profile, but you can get those via email. BTW, no, most email providers never allow the reuse of close account names.
    • kstrauser 10y ago
      Microsoft seems to, although I can't find a specific statement from them confirming it: http://windowsitpro.com/blog/recycled-email-addresses-and-outlook-nicknames http://windowsitpro.com/blog/recycled-email-addresses-and-ou...
• myf01d 10y ago
  > MD5 hash JUST
• WA 10y ago
  Nobody in here mentioned it: phone numbers were leaked, too. Which I consider even worse. I wanted to sign up for Flickr, but the Yahoo login requirement was a big turnoff, because it requires a phone number. This nagged me so much that I never did it. Turns out: right decision. Because my 8 year old phone number isn't target of spam yet.
  • newscracker 10y ago
    Phone number being a requirement for signup is bad. There are providers who mandate a valid phone, which they verify through SMS or call, even for paid accounts and services (not just for the payment processing step). Whenever possible, I avoid signing up for such services.
• iamrobinhood123 10y ago
  Everything will come to light. All our info is being stored somewhere. One day, people who know you will be able to easily search a database of all your information for specific things.
• serashioda 10y ago
  Thank goodness I use gmail?
• jondubois 10y ago
  I'm using Yahoo mail and when I logged in, they gave me a link to their security notice. About 'Hashed passwords', it says: "At the time of the August 2013 incident, we used MD5 to hash passwords. We began upgrading our password protection to bcrypt in the summer of 2013. Bcrypt is a password hashing mechanism that incorporates security features, including salting and multiple rounds of computation, to provide advanced protection against password cracking." WOW. So basically they did not even salt their passwords until 3 years ago! I knew about the importance of salting password hashes since I was like 17 years old and this mega billion-dollar corporation did not. Also, they claim: "Hashing is a one-way mathematical function that converts an original string of data into a seemingly random string of characters. As such, passwords that have been hashed can’t be reversed into the original plain text password." Which in the case of MD5 is a deceptive claim; even a basic dictionary attack could probably reverse at least 50% of all their accounts' MD5-hashed password (assuming most people use one-word passwords with maybe a few digits at the end).
  • d33 10y ago
    It's one thing to know it and the other to deploy it. You don't know how messed up their system might be - it might actually be a very difficult change if it's tied to other components with some crazy kludges. Looks like they didn't prioritize them well enough. And if you're looking for an example of a company that's way too afraid of changing anything in their system because it's too much of a mess, consider PayPal an example...
• edem 10y ago
  Is this __another__ 1 B users or the previous one which was already posted?
• mianaezat 10y ago
  Stay at home mom Kelly Richards from New York after resigning from her full time job managed to average from $6000-$8000 a month from freelancing at home… This is how she done ,,,,,,,,,,,,,,, http://www.ebiz3.com http://www.ebiz3.com
• barking 10y ago
  I'd forgotten my yahoo password but wanted to change it. They sent a code to my phone and I was able to do that. Then I tried to set up 2 factor authentication but I am unable to do it. It keeps rejecting the same phone number as being either invalid or not recognised as a contact, no matter which format I choose to enter it. I've dropped the interational prefix, added it, added and dropped the plus sign, added and dropped the 0 after the international prefix etc etc. I'd dump yahoo altogether except it's the email for my paypal for over a decade and i can't change that.
  • Tepix 10y ago
    I've changed my paypal email twice in the past already when I started getting too much spam. Regarding 2FA at Yahoo!, I've also had issues... SMS stopped arriving altogether and I had to disable it.
    • barking 10y ago
      Paypal says I can't change it because it's my primary email address. I prefer using authenticator anyway rather than sms 2fa and yahoo don't offer that it seems
      • slig 10y ago
        Maybe you have to add a new email to your paypal account, then change it to be the primary and then delete the old one.
        • barking 10y ago
          You're right! Thanks very much.
• deleted 10y ago
  [deleted]
• overgard 10y ago
  "passwords hashed with MD5" Jesus seriously?
• szul 10y ago
  MD5 hash? Jesus...
• forf 10y ago
  Oh no! All of those free offers could be stolen from me!
• djhworld 10y ago
  Yahoo is so frustrating I got the email this morning regarding the hack, I've not used Yahoo for a long, long, long time, so figured I would go and delete my account. So I log in, password in 1password is incorrect, no big deal I go to reset it. They send me an email, I reset the password then go through the account deletion process. It tells me my account is "deactivated" and will be deleted in 90 days ...Once that was done I just so happened to look through my emails to see what Yahoo had sent me in the past and I saw that I had undergone the exact same procedure (deleting my Yahoo account, presumably after news about another hack) about 3 months ago but completely forgotten about it. So what I must have done today was relogged into my 'deactivated' account that I 'deactivated' back in September, which caused it to become active again, then issued a 'deactivate' request again, so now I have to wait ANOTHER 90 days for it to be deleted. I've made a note of this fact this time to avoid relogging into Yahoo again...
  • mtgx 10y ago
    Yes, that's worse than Facebook, which does the same thing, but for 30 days.
  • keehun 10y ago
    If your account name is related to identifiable to you in any way and could potentially be used to spoof your identity, you shouldn't delete it because Yahoo will let a new user take your account's address.
• voltagex_ 10y ago
  What alternatives to Flickr do I have? I think I pay $25/US/year at the moment.
• jupp0r 10y ago
  What happened that made them disclose this > 3 years later?
• somewords 10y ago
  FYI - the tumblr link for the notice redirected me to a "You have viruses installed on your computer" site. Hacker News just got phished.
• rakibtg 10y ago
  While i was new to programming and i read some articles about why not to store password in clean text, a google was enough to taught me about blowfish algorithm and the concepts of higher costs hashing benefits! Well my life first program was more secure then Yahoo i guess, storing password in MD5 too bad Yahoo...
  • blauditore 10y ago
    Your life first program was about hashing passwords? Mine was about printing "hello world".
• adam12 10y ago
  First thing I did was control-F "sorry", "apolo", "inconv". nothing
• blauditore 10y ago
  In the context of (unsalted) MD5 passwords: If they have a large legacy base of MD5 hashed ones, how would one "move" those to a stronger hash function? I can imagine something like re-hashing the existing one with a better algorithm and some salt, and storing new ones solely using the new algorithm + salt. But that introduces some additional complexity because every hash needs information about how it was hashed (MD5 + X vs. just X). Is there an established best practice for this?
  • syncsynchalt 10y ago
    Yes, there is. The one I prefer, which you've mostly laid out, is: new passwords are entered as bcrypt(pw) and then stored as "B-$result", old passwords are re-hashed as bcrypt(hash) = bcrypt(md5(pw)) and stored as "M-$result", then your auth function works as follows: def auth(user, pw): hash = get_hash(user) if hash starts with "B-": return hash == bcrypt(pw) else if hash starts with "M-": return hash == bcrypt(md5(pw)) else: # remove this once you've rehashed your entire database return hash == md5(pw) The naïve solution is to skip the "B-"/"M-"/"" annotation but if you do that you've introduced a situation where attackers can login to old passwords using md5 leaked from another source.
    • HappyTypist 10y ago
      The other solution (that Yahoo used) is use bcrypt(md5(password)) which allows them to rehash all existing passwords without logging in.
      • blauditore 10y ago
        I think that's what he described, plus adding a prefix in order to indicate it's been re-hashed.
        • syncsynchalt 10y ago
          That's exactly right, thank you!
• fluxcap 10y ago
  This just proves that Silicon Valley is full of geniuses. I mean, look at how cleverly Yahoo kept it a secret for so long! Well, at least the Valley's rapacious landlords got paid.
• prirun 10y ago
  Alternate (and to me, more believable) explanation: this is a great way to get all of Yahoo's inactive users to sign in, bump the "active in the last year" user count, and goose the company's valuation.
• cpplinuxdude 10y ago
  What's I dislike the most about this situation is that I cannot even shut down my yahoo email account, as it could be re-created by someone else, i.e hijacked. It's also terrible that such bad password policies are being pushed onto users, yet no guarantee of security is associated with them.
• adultSwim 10y ago
  When did they know?