16 ms·
Yahoo Triples Estimate of Breached Accounts to 3B
- dcgudeman 9y agoA spokesman for Oath, the new name of Verizon’s Yahoo unit, said the company determined last week that the break-in was much worse than thought, after it received new information from outside the company. Can they claw back money from Yahoo shareholders because of this?
- deleted 9y ago[deleted]
- empath75 9y agoPossibly from the remnants of yahoo called altababa
- jmount 9y agoThere never is a break-in where they get 1/3 or 1/2 of the accounts. It has to be nearly all or some much smaller faction. (my own presumption based on the idea nothing large does mere 2 to 3 way replication or partition)
- kingnothing 9y agoIt depends. It's possible a company could catch a breach while the data is being dumped to s3/russia/wherever and cut it off before everything is extracted. Another possibility is that only one particular system is breached, which wouldn't actually affect all users of a given company. If Facebook were hacked, it's possible that only the ad-buy system is compromised and not their entire user store, for example, thus exposing only people who have purchased ads and not all users.
- mschuster91 9y ago> Another possibility is that only one particular system is breached, which wouldn't actually affect all users of a given company And a third possibility, especially given today's trend to distributed systems, is that the attacker gains access to one shard (or its dump) only.
- jmount 9y agoI am assuming shards are much smaller than 1/3rd of all the data.
- vertex-four 9y agoIf you store EU user data in the EU and other user data somewhere with less restrictive privacy laws, an attacker could get hold of one or the other reasonably. On the other hand, yeah, it's much more likely the entire account database was dumped.
- takeda 9y ago> It depends. It's possible a company could catch a breach while the data is being dumped to s3/russia/wherever and cut it off before everything is extracted. At that point honest behavior would still assume all accounts were transferred. You don't know that data was not transferred earlier or it's also hard to estimate what part of data was sent successfully. If data could be accessed it should be treated as compromised.
- hlmencken 9y ago> A massive data breach at Yahoo in 2013 was far more extensive than previously disclosed, affecting all of its 3 billion user accounts, new parent company Verizon Communications Inc. said on Tuesday. Imagine the buyers remorse
- JBReefer 9y agoDoes anyone have insight on how this works? Do you just sue the pants off of the execs, or the lawyers who did due diligence, or the SREs maybe? Do the clawback the difference in goodwill + legal costs from the selling investors? Is there recourse at all? It'll probably the some poor schmuck SRE getting the blame, like always, right?
- ianamartin 9y agoIt works like this: lawyers come up with a security checklist. Managers make sure the checkboxes are checked. Engineers are all ignored because fuck you, your opinion isn’t on the checklist. It’s security theatrics, not actual security. And if you stand up for something more, get ready to quit because you won’t be listened to.
- paragraft 9y agoThere'll be a small chunk of the purchase price left in escrow for a year for any extra liabilities that weren't discovered in DD. They'll be claiming that. But it won't be much.
- empath75 9y agoI used to work at aol. Neither company trusted the others networks or security processes. Integration planning meetings were like negotiating a prisoner exchange.
- rhizome 9y agoNo remorse, VZ got a discount on the purchase price based on this issue.
- 9y ago
- hendersoon 9y agoTo put this number in perspective, there are ~7.5 billion humans currently living on the earth.
- ProAm 9y agoWait for the day that Facebook is hacked.
- shallot_router 9y agoI'd be pretty surprised if an attacker could actually get away with a lot of sensitive, actionable bulk user data from Facebook. DMs would probably be way too big in total, unless they just looked for DMs of high-profile people. As for passwords, they're probably not stored in a very crackable format (probably some kind of super-bcrypt-esque algorithm with a pepper). Of course, they could hijack the login procedure and harvest passwords in real-time until they're detected. That would still be really bad depending on how long they can evade detection - maybe millions of passwords - but at least it wouldn't be retroactive. And the password dump could still be bad for people looking to target individuals within the dump. Maybe advertising data could be trimmed down enough to dump the whole thing? Every ad that accounts have clicked?
- slig 9y ago> Of course, they could hijack the login procedure and harvest passwords in real-time until they're detected. Facebook makes it really hard for people to log off. Unless one is using a shared computer, I doubt she types her password more than a couple times a year.
- Skunkleton 9y agoI have had at least three different yahoo accounts. Maybe someone out there has 3 billion accounts, and the rest of us are fine?
- kiernanmcgowan 9y ago3 billion - we live in an age where half the population of the earth can exist on a service, and everyone is vulnerable. Yes, a good chunk of these are probably duplicates for business / spam / anon accounts, but this is where the world is trending. How long is it until facebook or google have a massive breach?
- ktta 9y agoWell I would say close to half of those accounts are duplicate - as in not 1 account per person.
- jlgaddis 9y agoThe article mentions this: > The number of individuals affected by the 2013 attack is smaller than 3 billion, because some people have multiple accounts ...
- ktta 9y agoWell 'smaller' and 'close to 50%' will have different effects, and I'm willing to bet that the number of individuals affected will be a lot, lot less than 3bn.
- anonytrary 9y agoI would go further and say 3b is an order of magnitude too large. Bots aside, If there are only 3 accounts per user, our estimate is at 1b. Now, we take into account malicious agents like bots and spammers, easily carrying a bloat factor of 3-5. The closer estimation might be 100s of millions of unique human users, and maybe half of those users actually care. TLDR+Edit: Didn't see your other post and accidentally straw manned you. Anyway, I agree it's gonna be "a lot lot less" than 3b unique human accounts.
- craftyguy 9y agoIf that's the case, I think the bigger news then is that yahoo actually had 3B users!
- ktta 9y agoBypass - https://www.facebook.com/flx/warn/?u=https%3A%2F%2Fwww.wsj.com%2Farticles%2Fyahoo-triples-estimate-of-breached-accounts-to-3-billion-1507062804 https://www.facebook.com/flx/warn/?u=https%3A%2F%2Fwww.wsj.c...
- basch 9y agohttps://outline.com/http://www.wsj.com/articles/yahoo-triples-estimate-of-breached-accounts-to-3-billion-1507062804 https://outline.com/http://www.wsj.com/articles/yahoo-triple...
- michel-slm 9y agobetter than the Facebook trick! Thanks
- snowpanda 9y agoThere's also this for my Firefox friends: https://addons.mozilla.org/en-US/firefox/addon/bypasspaywalls/ https://addons.mozilla.org/en-US/firefox/addon/bypasspaywall... It does a whole range of sites.
- deleted 9y ago[deleted]
- moneytalks 9y agoIt's a very short article, here are the salient bits: === A massive data breach at Yahoo in 2013 was far more extensive than previously disclosed, affecting all of its 3 billion user accounts... ... ...Oath ... said the company determined last week that the break-in was much worse than thought, after it received new information from outside the company. ... declined to elaborate on the source of that information. Compromised customer information included usernames, passwords, and in some cases telephone numbers and dates of birth... ... The number of individuals affected by the 2013 attack is smaller than 3 billion, because some people have multiple accounts ... Oath will immediately begin notifying the users who own the additional roughly 2 billion accounts. That is expected to take several days and occur via email... === Emphasis mine re: details of disclosed info.
- fitzroy 9y agoOn the bright side, the estimate is unlikely to triple again.
- devy 9y agoYeah, I doubt Yahoo! has 9 billion user accounts.
- kakaorka 9y agoI never expected it to have 3 billion in the first place :)
- shallot_router 9y agoI'm not too surprised at the 3 billion. I'm just wondering how many of those correspond to real people.
- danvoell 9y agoJust an ancillary comment but Yahoo has a whole bunch of password requirements. So much so that my passwords don't cut it and I can never remember my password. And/or I need to validate every new device. Is this all just for show? Its insult to injury that they force all these things and then they get broken into.
- snakeboy 9y agoHopefully your experience is characteristic of most yahoo users, and this breach is less effective because people are using a unique password for their breached account.
- hitekker 9y agoOn the plus side, I only use my one email account with yahoo for spam.
- megous 9y agoPerhaps I can go through my spam folder and disable all those irina781@yahoo.com types of accounts.
- RcouF1uZ4gsC 9y agoI think the issue right now is that private user information is viewed as an asset, not a liability. If we could find a way to make it more of a liability, companies would be less likely to collect it just for the sake of having it, and they would be more proactive in securing it.
- closeparen 9y agoUser accounts? Really? This is Yahoo we’re talking about. You really do need user accounts to run an email service
- tambienben 9y agoHow much do you actually need to know about someone to serve up email to them?
- deleted 9y ago[deleted]
- osteele 9y agoFor a consumer mail service, you to need to know enough to let them recover their account, possibly with decades of un-backed-up correspondence with and photos of since-deceased friends and relatives, when they’ve forgotten their password, and without letting someone else recover their account. This is a hard problem. (I’m expecting some idealized “solutions” from people with idealized beliefs about mass market tech skills.)
- Karunamon 9y agoYou also need a process for resolving ownership disputes. Facebook takes the tactic of having the person claiming ownership upload government-issued ID, which seems like it would be the only foolproof way to do so, yet they're constantly maligned for it.
- deleted 9y ago[deleted]
- foxfired 9y agoI know many mention facebook or google being hacked will be an even bigger deal. But I wonder, with all the online spaces google/facebook has under control (ads, analytics, cdns, dns, crawlers, your phone, etc.) if they suspect a breach, they could literally disable any website or device that tries to share that information. If it happened in the past, well, who will know?
- wlesieutre 9y agoPlenty of leaked stuff (like credit cards) moves around on the "dark web" via TOR sites, which most of those won't impact. Not unless they went as far as to make the Android OS check that you're visiting onion sites and scanning for leaked information to block them, which would be pretty extreme.
- programbreeding 9y agoNothing would stop someone from being able to share it via the darknet. Tor, Freenet, Zeronet, etc. There's no way that news would be able to be stopped.
- c3534l 9y agoA government hack would be even worse and, IMO, far more likely.
- kylehotchkiss 9y agoWhen I was on Facebook today, I saw an ad with a photo of a minivan, and some copy about finding a new vehicle. The ad was posted by Yahoo. When I clicked it, it took me to the search result for minivans. This company feels like an AI experiment.
- orangepenguin 9y agoI feel a little sad that pay-walled articles make it to the top of HN. I'm sure the article is interesting, but a lot of us can't actually read it.
- mattbeckman 9y agoHere's a bookmarklet I use sometimes: javascript:window.location.href='https://m.facebook.com/l.php?u='+encodeURIComponent(window.location.href);
- orangepenguin 9y agoThat looks pretty handy. I'm at work (maybe I shouldn't be on HN at all, haha...) and Facebook is blocked. But I guess that's my problem. :) I'll check it out when I get home.
- jakenberg 9y agoDude... you are a g
- derwiki 9y agoReal LPT in the comments!
- Sohcahtoa82 9y agoThis isn't reddit. Keep that meme-y crap out of here.
- dstaten 9y agonot working for me, unfortunately
- PMan74 9y agoWhy does that even work? I get technically what is going on - WSJ see the link as having been referred from Facebook. But why does the WSJ display the content for free to somebody that seems to be coming from Facebook yet look for a subscription for direct access (or from a Google search result referral) .
- bogomipz 9y agoOn a related note Equifax stated yesterday that they identified an additional 2.5 million accounts that were breached: https://www.nytimes.com/2017/10/02/business/equifax-breach.html https://www.nytimes.com/2017/10/02/business/equifax-breach.h... Is proper audit capability just not seen as important at these companies?
- oeunht3nh 9y agoI imagine that if it's not the type of audit required by the government then it's a liability. You can plausibly deny something you never audited.
- runesoerensen 9y agoTo be fair Equifax's adjustment was relatively minor, and they did disclose that they were still investigating the matter.
- bogomipz 9y ago2.5 million people is minor?
- runesoerensen 9y ago> 2.5 million people is minor? It's relatively minor. Equifax's preliminary estimate was off by less than 2%, Yahoo's ~300%.
- misterbowfinger 9y agoall of my fake email accounts are compromised!!!
- Top19 9y agoI tried to enable MFA on a Yahoo account I was helping someone with at work 24 hours ago. Their MFA is still SMS-based, which I’m pretty sure is a bad thing. They don’t allow an app like Duo (although they do reject VOIP numbers which I guess is good).
- normaljoe 9y agoDownload Yahoo Mail app and setup. They call their MFA Account Key and it uses the Mail app to push similar to Duo. I think other apps include Account Key, but it was just being pushed out when I last worked with Yahoo. The SMS is just a bootstrap and once you have the app you can pick your second authenticator as login.
- kristopolous 9y agoThe statistical analysis on the password database here would be fantastic! You've likely got demographics, geolocation, age, when the password was made (going back maybe 20 years!) and more. It'd be a great research tool if it ever leaks.
- garethsprice 9y agoLooks like both Equifax (2.5m additional accounts) and Yahoo chose today as a good day to bury bad news (the papers being filled with Las Vegas, Puerto Rico, etc). Slimy moves from their PR teams.
- bluetwo 9y agoAs well as the grilling of Wells Fargo and Equafax executives in congress.
- danm07 9y agoThat's like half the world's population!
- blackflame7000 9y agoYahoo probably has the record for cumulative total of spam in users inboxes.
- trishmapow2 9y agohttps://github.com/njuljsong/wsjUnblock https://github.com/njuljsong/wsjUnblock Make WSJ & NYTimes Great Again
- ezioamf 9y agoAll personal data should be public (in effect it is public after all leaks). Personal data should not be used for user authentication.
- deleted 9y ago[deleted]
- make3 9y agowow yahoo is such a piece of trash now
- nashashmi 9y agoThere is an unpatched server at some IP address long forgotten and no longer used by Yahoo but still nevertheless works. The page still shows the Yahoo portal with news on the front page from when Yasser Arafat was alive. I believe the page has not been updated since 2003. The IP address is in the 200 range. I used to remember the IP address for many years due to photographic memory even though I had only seen it briefly once. But I just cannot dig up that memory anymore.
- tqi 9y agoInteresting to see the comments here. One thread arguing that free services should be incentivized against collecting/profiting off user data, followed by a thread lamenting the WSJ content paywall...
- projectant 9y agoWhy is it that when a disaster happens numbers are gradually revised upward?
- takeda 9y agoIn case of hurricanes and other natural disasters most people die later due to lack of water, electricity etc. In case of Equifax, Yahoo etc it is because they simply lied to not look as bad, but then they need to provide accurate information. IMO if someone broke to a database it should be considered that all data was accessed and all data should be treated as compromised. Unless break in was to a subsystem and just that subsystem then all data in it should be considered compromised.
- projectant 9y agoI tend to agree. Just come out at the start honestly and say, "All 3 billion accounts affected at Yahoo", or whatever. I feel angry when I see the numbers gradually going up, I think one reason is because I see it like they're trying to dupe us, or "cook the frog slowly". I understand they have to protect "shock" to their stock price, or reputation, or prevent panic, but honesty is still valuable, right? When you have a natural disaster, surely there are experts who have already mapped out such situations and they can say, roughly 20,000 homes will be destroyed in an event like this. Wouldn't it be good to start off at a big estimate and then revise down? I hate to think this is to some extent driven my the media's need to "drip drip" out a story, instead of giving people the truth.
- jamesrom 9y agoWhat's a couple of billion between friends?
- Raynak 9y agoOnly 38 doesn't seem so bad now.
- tryingagainbro 9y agorelated to this: I got a "someone has your password" from Google and they blocked access...diff country, different device. My question: Now I assume that one way or another they got that from Google or from one of the many hacked forums /websites (yeah, I used the same id+password in many sites). Do they try to login manually or try 10000 at a time via bots? I doubt they they went manual since they must have millions of accounts. id my user name was cpowell or hclinton I suppose but....
- throwaway613834 9y agoSomewhat off-topic, but does anyone know what top-level domains are in practice "safe" to use for email addresses if we're going to migrate to our own domain? I mean "safe" in the sense of being unlikely to cause confusion or problems with less-than-well-written software (or humans). Obviously .com is okay, and I haven't heard of problems with .edu/.gov/.org/.net, but I'm a little afraid of getting a domain for email addresses that isn't a well-established 3-letter TLD, on the off chance that someone has hard-coded a requirement like this in their code. I'm not sure if I'm just being paranoid about this though. Any suggestions on what's considered safe?
- chrisper 9y agoDon't bother with any of the custom ones if you don't want to end up in spam at most companies. I went with .org and had no issues sofar.
- throwaway613834 9y agoOh, good point! Do .info, .name, .me, .io, etc. also cause problems like custom ones? Or do you just mean the newer ones like .services and .online and whatnot?
- chrisper 9y agoKind of both. The world of emails works in mystical ways! It really depends on the admin. He or she might very well block .me etc. since no serious company is going to have a .me email. A lot of admins do block something like .services. Your best bet is to go with a tld that is also commonly used by companies. Also, if this is important to you, you need to check if whois privacy is supported for a specific tld.
- oneweekwonder 9y ago> I'm not sure if I'm just being paranoid about this though. Any suggestions on what's considered safe? Maybe a bit, I don't think it is based in paranoia, you have technical reasons. Just recently had to strip tld from uri's, and boy was that harder then excepted! That being said domains like co.uk, co.jp been around for a long time. I will stay away from "fancy .named" domains, but country level names should work fine. Would love to hear other opinions as well.
- propman 9y agoWe need jail time...they knew Security was compromised and hid it even from their own cto, they knew accounts were hacked and they hid it for years
- chirau 9y agoThe biggest surprise here is that Yahoo has 3 billion accounts. They are probably counting my 25+ Craigslist accounts I guess. And just maybe all the 'princes' I've been over the years. Lol
- Dolores12 9y agoWe should assume that all their data were leaked unless proven otherwise.
- graycat 9y agoSo, let's see: We have a server farm and it is working along. We want to know right along, in real time, if it is sick or healthy. So, we do some monitoring. There are two kinds: (1) The first kind looks for problems never seen before. Here we get to use data of two kinds, (i) when the system was healthy and (ii) when the system was sick and we detected the problem, understood it, found out why, and tried to prevent that problem in the future. (2) The second kind looks for problems never seen before, that is, zero-day problems. Here we have no data on the problems but likely do have a lot of data on when the system was healthy or at least seemed to be, not just on the day of the data collection but also later. In both cases we have two ways to be wrong: (A) Say that the system is sick when it is healthy -- a false alarm. (B) Say that the system is healthy when it is sick -- a missed detection. So, from (A) and (B), we get two rates and want both to be low. We can get data on many variables at high data rates. Now, what do we do? Okay, it's a problem in, say, data analysis, data science, statistics, AI/ML, right? Hmm .... What do we do? Uh, be warned: If the false alarm rate is too high, then the monitoring will be ignored.
- asnyc 9y agoMore than half of the people in the world still don't have internet access ! I believe the estimate of 3 B includes all yahoo accounts created until 2013 - maybe an opportunity to indicate the clout it once had.
- jlebrech 9y ago3 Billion, 12 year olds that didn't know how password security worked, me included.
- ausjke 9y agoSince nowadays the leakages are measured by Billions here and there with critical info exposed, plus facebook/google etc can track your move and even your thoughts/opinions,your daily life in general, so I assume we officially entered a world of no privacy with no turning back. I think we need a new technical design to cope with this indeed, something like a new style of identity with biology info used, and dynamically generated tokens and such, and the browser be in anonymous mode by default, etc.
- methodover 9y agoThis still is a huge concern for us web app developers. Most people re-use their email addresses and passwords across multiple sites. One breach at one internet company affects all the others. IMO, password reuse is the #1 web application security problem in the world right now, and there's very little in the way of accepted industry standards to mitigate it.
- magd 9y agoAnd Yahoo Finance wants to trade stocks now. Really?
- Taylor_OD 9y agoDoes anyone have a good solution to deleting a Yahoo account? I've got one that is 99.9% spam mail now but I've never deleted it because If I remember correctly someone else could open up that email in my name and continue to get my emails. They also don't support automatic email forwarding if I remember correctly. It remains as the dark spot of my email accounts.
- gamad 9y agoIsn't that "All of them?"
- tamrix 9y agoI swear if your company is about to go under, the executives are just selling off the data, calling it a breach, making some bank and giving an excuse to go close down which wouldn't be their fault.