3 ms·
Ex-Yahoo here. Anything on the yahoo.com domain uses the single sign on service. Yahoo doesn't distribute login cookies for the yahoo.com domain any other way.
by jmathai 14y ago
Ex-Yahoo here. Anything on the yahoo.com domain uses the single sign on service. Yahoo doesn't distribute login cookies for the yahoo.com domain any other way.
That being said, the passwords are NOT stored in plain text. And individual properties don't get direct access to the user database. It's done through libraries and protocols with extremely restrictive ACLs. And one of the options isn't: "give me this user's password in plaintext".
Even if a Yahoo! property wanted to store user passwords, they couldn't. Every Yahoo! user logs in from login.yahoo.com.
Having a good understanding of how Yahoo!'s security is set up, I don't see how any of this is possible.
EDIT: It's starting to look (to me) as if those users got phished.
- s_henry_paulson 14y agoSuccessfully phishing half a million people without anyone noticing?
- jmathai 14y agoYes, you'd be surprised how sophisticated these folks are. Yahoo! has so many layers of security in place in their infrastructure that to have any large scale attack I'd imagine you have to have some sort of insider info.
- steve8918 14y agoEx-Yahoo as well... there's a lot of stuff Yahoo did poorly on the executive/management side, but a lot of engineering processes and decisions were very well handled. All the security decisions went through the Paranoids, and they did a great job, so there is no way Yahoo would have let plaintext passwords exist in their infrastructure.