4 ms·

There are likely to be a lot of identity systems using the password in the database, all of which have been coded to look for an MD5 hash, not a salted hash. Th

There are likely to be a lot of identity systems using the password in the database, all of which have been coded to look for an MD5 hash, not a salted hash. This means code in a number of applications have to be updated at the same time. The typical way around this is to create your new destination column (e.g. sha256 with salt), and progressively have applications reference this column rather than the MD5 unsalted column. It's a huge amount of work, and if the applications were made in 1990's, the code is likely legacy. If Yahoo are doing regular code security reviews, this will likely have been put in the pile of "we need to fix, but it's too costly to do".

flukus 10y ago
> It's a huge amount of work, and if the applications were made in 1990's, the code is likely legacy. Which begs the question, can legacy code survive in an international network?
- haser_au 10y ago
  That's the right question to ask. The answer is no, because new security vulnerabilities are disclosed every hour. A large organisation will implement layered security (otherwise known as layers of the onion) to prevent this type of attack. This means; more secure passwords to access the password database, fewer people with access, rotation of access passwords, auditing of backup storage and encryption, etc etc. Clearly Yahoo's layers of security were all broken to allow this type of theft.
pbhjpbhj 10y ago
>It's a huge amount of work // Really? Moving from doing md5(password) to bcrypt(password,salt)? I see organisations make things hard and legacy code-base, yadda, yadda but surely if Yahoo couldn't do this then they couldn't manage scratching their own butt; it really seems like quite a small change in the scheme of things. Like one senior engineer, one afternoon of work (then testing, etc., OK, sure) ... ?
- haser_au 10y ago
  "It Takes 6 Days to Change 1 Line of Code" https://news.ycombinator.com/item?id=13119138 https://news.ycombinator.com/item?id=13119138 I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation. Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to log on, verify their password, and store it in the new hash algorithm (given some users rarely log on, this could take over 12 months to complete 80% of users).
  - flukus 10y ago
    Yes it could take months or years to complete the process, but they've had at least a decade. Even if it never completes (abandoned accounts), it would still have saved most active accounts from being breached.
    - haser_au 10y ago
      100% agree. Yahoo should have started the process a long time ago. I was just replying to the comment it could be completed in an afternoon.
  - pbhjpbhj 10y ago
    You're right on the first count. It wasn't sarcasm, it was a question. On the storing of hashes though the standard protocol has been to pass the hash in as if it were a password.
- deleted 10y ago
  [deleted]

flukus 10y ago

> It's a huge amount of work, and if the applications were made in 1990's, the code is likely legacy. Which begs the question, can legacy code survive in an international network?

haser_au 10y ago
That's the right question to ask. The answer is no, because new security vulnerabilities are disclosed every hour. A large organisation will implement layered security (otherwise known as layers of the onion) to prevent this type of attack. This means; more secure passwords to access the password database, fewer people with access, rotation of access passwords, auditing of backup storage and encryption, etc etc. Clearly Yahoo's layers of security were all broken to allow this type of theft.

pbhjpbhj 10y ago

>It's a huge amount of work // Really? Moving from doing md5(password) to bcrypt(password,salt)? I see organisations make things hard and legacy code-base, yadda, yadda but surely if Yahoo couldn't do this then they couldn't manage scratching their own butt; it really seems like quite a small change in the scheme of things. Like one senior engineer, one afternoon of work (then testing, etc., OK, sure) ... ?

haser_au 10y ago
"It Takes 6 Days to Change 1 Line of Code" https://news.ycombinator.com/item?id=13119138 https://news.ycombinator.com/item?id=13119138 I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation. Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to log on, verify their password, and store it in the new hash algorithm (given some users rarely log on, this could take over 12 months to complete 80% of users).
- flukus 10y ago
  Yes it could take months or years to complete the process, but they've had at least a decade. Even if it never completes (abandoned accounts), it would still have saved most active accounts from being breached.
  - haser_au 10y ago
    100% agree. Yahoo should have started the process a long time ago. I was just replying to the comment it could be completed in an afternoon.
- pbhjpbhj 10y ago
  You're right on the first count. It wasn't sarcasm, it was a question. On the storing of hashes though the standard protocol has been to pass the hash in as if it were a password.
deleted 10y ago
[deleted]