4 ms·
Despite of the state Yahoo! is in I find it very hard to believe that a company like Yahoo! would store it's passwords in plain-text. In addition, doesn't yahoo
by prayag 14y ago
Despite of the state Yahoo! is in I find it very hard to believe that a company like Yahoo! would store it's passwords in plain-text. In addition, doesn't yahoo voice uses the Yahoo single sign on, that would mean that there is a very good chance that the central authentication server and not yahoo voice is authenticating the user and the password doesn't even touch yahoo voice. Of course, there is a possibility that Yahoo uses a simple API based authentication for own apps and the architect took the easy way out and just stored the plain-text password.
If it wasn't in such credible news source I would have found the entire thing very hard to believe.
- nivla 14y agoSadly a lot of prominent websites choose to store passwords in plain text or with a reversible encryption. It not until a hacker dumps their db or someone exposes it, we come to know about it. For me, I was really surprised to find even Discover Bank storing their customer's passwords in plain text. I did a write up about it: http://www.techflock.com/discover-card-storing-passwords-in-plaintext/ http://www.techflock.com/discover-card-storing-passwords-in-... YC Disc: http://news.ycombinator.com/item?id=4102387 http://news.ycombinator.com/item?id=4102387
- damncabbage 14y agoThere is a review process by a disinterested internal party that's given licence to shoot anything down that isn't secure enough by their standards, so I agree with the parent poster that this is unlikely (but not impossible, if someone was doing something really stupid).
- prayag 14y agoI agree that a lot of websites store passwords in plain text. Mostly it's because these companies are not technical. They have IT departments but are companies like a bank (As in the case of Discover, or hardware manufacturers or govt. agencies). I just hold a tech company like Yahoo to a much higher standards. In addition, a little bird told me that these passwords are not being accepted by the yahoo servers. The whole thing doesn't pass the smell test.
- jmathai 14y agoEx-Yahoo here. Anything on the yahoo.com domain uses the single sign on service. Yahoo doesn't distribute login cookies for the yahoo.com domain any other way. That being said, the passwords are NOT stored in plain text. And individual properties don't get direct access to the user database. It's done through libraries and protocols with extremely restrictive ACLs. And one of the options isn't: "give me this user's password in plaintext". Even if a Yahoo! property wanted to store user passwords, they couldn't. Every Yahoo! user logs in from login.yahoo.com. Having a good understanding of how Yahoo!'s security is set up, I don't see how any of this is possible. EDIT: It's starting to look (to me) as if those users got phished.
- s_henry_paulson 14y agoSuccessfully phishing half a million people without anyone noticing?
- jmathai 14y agoYes, you'd be surprised how sophisticated these folks are. Yahoo! has so many layers of security in place in their infrastructure that to have any large scale attack I'd imagine you have to have some sort of insider info.
- steve8918 14y agoEx-Yahoo as well... there's a lot of stuff Yahoo did poorly on the executive/management side, but a lot of engineering processes and decisions were very well handled. All the security decisions went through the Paranoids, and they did a great job, so there is no way Yahoo would have let plaintext passwords exist in their infrastructure.