10 ms·
Engineer admits hacking Yahoo accounts searching for images
- SteveNuts 7y agoI truly don't understand how Yahoo still exists. How have they survived this long?
- peterhookgen 7y agoI ask myself the same question, especially when it was announced on HN they just spent cash on a new branding logo https://www.underconsideration.com/brandnew/archives/new_logo_and_identity_for_yahoo_by_pentagram.php https://www.underconsideration.com/brandnew/archives/new_log...
- sincerely 7y agoWorking for Pentagram seems sweet. Huge cool designer cachet despite the fact that all you do is redesign logos and branding for incredibly uncool legacy corporations
- Alex3917 7y agoWhat's the deal with this new folksy corporate logo style that everyone is jumping on? It seems like Yahoo and McDonalds are just copying Walmart.
- martinpw 7y agoFrom that article: The strategy positions Yahoo as an “amplification brand,” amplifying the things that matter, helping to “amplify you.” So, umm, I guess I have no idea what they do.
- kevin_thibedeau 7y agoy! upside down. Money well spent.
- deleted 7y ago[deleted]
- marsrover 7y agoAll the great logos they design keep them in business.
- taftster 7y agoFantasy football, NCAA Men's Basketball tournament, and maybe finance.yahoo.com is about it.
- tempsy 7y agoThe updated Yahoo Finance app is really slick, actually. It actually makes me wonder WTF happened to Google Finance? Why did they essentially abandon it? Charts just show up at the top of the results page but there's no dedicated site anymore.
- mikeyouse 7y agoThe fall of Google finance is astounding. You can go to https://finance.google.com https://finance.google.com and search for "Slack" with no results. You can search for "WORK" (Slack's stock symbol) with no results. You have to actually type "NYSE:Work" to have it show up in the search results. It's astonishing.
- ping_pong 7y agoAgreed, Google Finance is garbage. I talked with a Google recruiter and asked if there were any positions at Google Finance, and she thought I meant in the Finance department, not on that particular site. There's so much that can be done with it, and Google has abandoned it.
- JumpCrisscross 7y ago> There's so much that can be done with it, and Google has abandoned it Does anyone know the inside ballgame on this one?
- journalctl 7y agoWhat other service am I supposed to use as a permanent throwaway email account?
- zeta0134 7y agoI realize you're posting this in jest, but I actually prefer AOL for this. They're one of the only major providers that will still let you sign up without providing a phone number. And, like Yahoo, I'm kindof amazed that they're still around.
- throwaway13000 7y agoYahoo owns AOL!
- toast0 7y agoNot accurate. Verizon owns them both, but bought AOL before Yahoo.
- journalctl 7y agoHuh, I didn’t know most of the providers require a phone number now. Thanks for the info!
- bediger4000 7y agomail.yandex.com - they don't even require a cell phone number.
- throwaway13000 7y agoWhen was the last time you changed your email address?
- mixmastamyk 7y agoThey’re profitable.
- spedru 7y agoIt's sobering to think about this in tandem with the fact that people in the IQ bracket for “engineer” tend to get away with crimes. Honestly, though, at least this can be turned into a concrete example to shoot down “if you don't have anything to hide...” and the like. The banal, lascivious panopticon elicits a real disgust response that might be moving, as opposed to the “shut up you alex jones weirdo” that sticks to talk of the NSA no matter how many Snowdens happen.
- duxup 7y agoJust for the sake of feedback, I found your post confusing. It's not really clear to me what you are saying exactly.
- Nzen 7y agoPresumably, this person is airing frustration with common responses to privacy oriented discussions he or she has experienced as participant and/or vicariously. He or she has characterized them ending in ad homenims, whereby the privacy minded individual is construed as politically or intellectually unmoored, similar to Alex Jones. Spedru posits the covert and exposed deviants within companies, that we've exchanged our data with, are another style of entity (besides state actors) that we ought to strive to deprive of access to that data. At least, that's as charitably as I can characterize the comment.
- spedru 7y agoYes. This is exactly what I meant. Didn't mean to come off as obscure, sorry, I'm a little out of it and English isn't my best language on a good day. I meant to tack a “distributed” onto that “panopticon”. A bunch of perverts scattered around tech companies might make for a convincing “actor” to bring up to ordinary people who think talking about government agencies is too crazy-sounding. As for the intelligence bit, I mean to say, “engineers are typically high-IQ, high-IQ people get away with crimes, imagine how many creeps have gotten away with this sort of thing and we'll never know”.
- Dylan16807 7y ago
- JazzXP 7y agoThe fact he was able to usually means something is lacking in the backend security. Yes, bad employee, but more encryption and security models are required. Back when I was working on share trading software, this was one of our requirements of the system.
- alfiedotwtf 7y agoEncryption, in email? lol... This is what happens when end-to-end encryption isn't the default in communications software. All email providers are vulnerable to this bar none.
- nailer 7y agoHonestly I'd like to see one of the webmail providers do a decent attempt at gpg. The web migrated from a primarily unencrypted state to an encrypted one - it's not impossible with the right UX.
- Yiin 7y agoProtonMail?
- ekianjo 7y agoHardly a major provider though.
- alfiedotwtf 7y agoCommunication between a ProtonMail customer and a non-customer, there is no end-to-end encryption. Communication between ProtonMail customers, you still have to trust that their UI hasn't been MiTM'd.
- robjan 7y agoThe web is encrypted in transit but most data is probably stored in an unencrypted form, much like email.
- ycombonator 7y agoI had a YouTube employee login to my account, defaced my video titles and description. And Google wouldn’t do a thing about it. Don’t trust FAANGs and other ‘wangs’ with your private content !
- jrockway 7y agoDo you have any more details about this?
- dehrmann 7y agoI'm starting am engineering job at a FAANG in a few weeks. They already had me sign something agreeing to not do anything with the data of someone I know in the course of my work, told me access is monitored, not to make actual changes to people's accounts because hacking isn't distinguishable from admin changes by users, if something accidentally happens, notify a specific group so they can reach out to the user. It feels like they take privacy really seriously, but at the end of the day, yes, employees do have access to your data, so before giving any company your unencrypted data, think hard about it.
- deleted 7y ago[deleted]
- andykx 7y agoI strongly doubt that Google harbors any negative feelings for you specifically. Do you have any concrete evidence for your claim?
- PavlovsCat 7y agoThey said someone at Google, not everyone at Google.
- lonelappde 7y agoHow do you know it was an inside job?
- Trias11 7y agoBanks routinely hire hit-n-run contractors to manage systems will low level, uncontrolled, unaudited access to mind boggling resources and eye popping access to private customers info. Email porn? Child play.
- d-d 7y agoEverything has to get decrypted at some point, right? I try not to think about what would happen if a Google employee decided to leak everyone's search history.
- HackerMandroid 7y agoIt would be interesting to see if things people are embarrassed of became normalized over night. It'd probably just be awkward for a while tho.
- dodobirdlord 7y agoThe fact that it hasn't happened yet when there are so many Google employees suggests that it's infeasibly difficult.
- lonelappde 7y agoIt's a rare person who throws away millions of dollars of income just for the lulz.
- tester347 7y agoyou meant 150k?
- kardos 7y agoIt may be simply a matter of data volume so large such that there isn't a practical way to leak it. Security by obesity in a sense
- hos234 7y agoNot just contractors. In most parts of the world there will be a 20 year old, with 3 months of "security training" paid less than $1000 a month, running around the data center with keys to the castle.
- tennessee5 7y agoChris Putnam, who used to work at Facebook, did almost exactly the same thing with videos.
- xenihn 7y agoHoly shit, that's a name I haven't seen in forever. I remember gbs.tv and SA secret santa.
- glandium 7y agoWait, what? I knew the part where he wormed Facebook and eventually got hired, but I didn't know that. Do you have a source? I only was able to find the part I already know about.
- xuki 7y agoGiven that it's a brand new account you can take it with a grain of salt.
- raz32dust 7y agoEnd-to-end encryption is the only foolproof was of preventing this. But if that is not possible, training and audit/alerts is the next best thing. Training is important because new employees or new college grads might not be aware of truly how egregious it is to view someone's personal data. It really had to be drilled into the culture. By audits and alerts, I mean that if one employee accesses sensitive information, they know that other teammates are getting an alert about it. People do such things when they think nobody will know.
- raxxorrax 7y agoThis is probably a common occurrence in the industry, especially at companies that make money with user data. This is at the core of the issue why the recommendation has always been to minimize data exposure from industry experts. Even if end-to-end encryption would be applied, there will never be 100% security from administrators and developers. You cannot even reasonably audit these systems with current technologies. And yes, protected HR and user information will regularly leak into IT departments. If the latter is outsourced to third parties, this means data leaks galore.
- zarro 7y agoOh you think this is bad, just imagine all the guys at the NSA
- zantana 7y agoSeriously optic nerve https://www.extremetech.com/extreme/177500-gchq-nsa-secretly-collected-webcam-images-from-millions-of-yahoo-users https://www.extremetech.com/extreme/177500-gchq-nsa-secretly... was the equivalent a whole floor of that guy.