4 ms·

> Sure, SHA1, scrypt or bcrypt with salt were already common back then, but it's an entirely different story than if they had used it today. Not an excuse, thi

by camus2 10y ago

> Sure, SHA1, scrypt or bcrypt with salt were already common back then, but it's an entirely different story than if they had used it today. Not an excuse, this is Yahoo, not a PHP shop in India doing some low budget contracting.They should have a top of the line security team enforcing the most recent secure practices. Furthermore I got no email from Yahoo telling me that my account may have been hacked. Both incompetent and irresponsible at the same time. By the way I did some PHP dev back in 2011. bcrypt hashing was already common practice. How can you come up with that argument in good faith ?

kuschku 10y ago
> How can you come up with that argument in good faith ? Let's say I've seen far worse in 2016, from companies storing far more sensitive data. Like a bank, with no 2FA support, emailing me my plaintext password after clicking "Password forgotten", in 2016. This story is problematic, but I'd be grateful if that bank would implement even the same stuff as Yahoo.
normaljoe 10y ago
> Furthermore I got no email from Yahoo telling me that my account may have been hacked Then your account was most likely not on the list of accounts compromised. > By the way I did some PHP dev back in 2011 Well Yahoo is a tad bit older then that, by about 17 years. This is not an excuse, but really comparing your 2011 coding to 1994.... Go ahead and boot up your old 486. I'll get back to you when this page loads up in an hour. :) Yahoo's code base is old and huge, like billions of lines huge. Yahoo's engineers have modernized it at a massively rapid pace. I'm not sure of current state, but when I left Yahoo finance was written in something like 10 languages including serving pages in C, cause that's all they had back then. Current tech is NodeJSish and others. They have their own hardened versions. But still migrating millions of lines of C to something other then C isn't a walk in the park.

by camus2 10y ago

kuschku 10y ago

> How can you come up with that argument in good faith ? Let's say I've seen far worse in 2016, from companies storing far more sensitive data. Like a bank, with no 2FA support, emailing me my plaintext password after clicking "Password forgotten", in 2016. This story is problematic, but I'd be grateful if that bank would implement even the same stuff as Yahoo.

normaljoe 10y ago

> Furthermore I got no email from Yahoo telling me that my account may have been hacked Then your account was most likely not on the list of accounts compromised. > By the way I did some PHP dev back in 2011 Well Yahoo is a tad bit older then that, by about 17 years. This is not an excuse, but really comparing your 2011 coding to 1994.... Go ahead and boot up your old 486. I'll get back to you when this page loads up in an hour. :) Yahoo's code base is old and huge, like billions of lines huge. Yahoo's engineers have modernized it at a massively rapid pace. I'm not sure of current state, but when I left Yahoo finance was written in something like 10 languages including serving pages in C, cause that's all they had back then. Current tech is NodeJSish and others. They have their own hardened versions. But still migrating millions of lines of C to something other then C isn't a walk in the park.