Slashdot Mirror
Yahoo Mail Resets Account Passwords After Attack
MAXOMENOS writes: "Last night Yahoo! announced via their Tumblr page that they had detected attacks against some Yahoo Mail accounts. They reset the passwords to all affected accounts, and advised users of good password practices. Quoting: 'Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise. We have no evidence that they were obtained directly from Yahoo's systems. Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts. The information sought in the attack seems to be names and email addresses from the affected accounts' most recent sent emails.'"
The real news is that apparently, Yahoo Mail still exists.
Why in the fuck weren't the passwords hashed or something? Why did a third party need the passwords? Grr
Brave Sir Robin ran away. ("No!") Bravely ran away away. ("I didn't!")
advised users of good password practices
Good password practices are pointless if the backend database is compromised. That's like adhering to the five second rule after dropping a donut in a dogpile.
I work for a large ISP and we regularly see our customers' accounts targeted when some other website leaks their user information and it includes email addresses on our network and passwords the attackers can guess will give them access. If we can get hold of the leaked data we can work out which accounts are at risk and either warn the customers or reset their authentication credentials before hand. Standard practice and good to see Yahoo is following it.
... is why suddenly yahoo is making a show of caring.
I have a four-letter yahoo account (not that kind of four-letter word...) from waaaaay back in the day. It was something I maintained for about two decades for plausible deniability... a cut-out.
SCORES of people have tries to hack it. A couple have succeeded, but not since I switched it to a 32-character mixed-case-and-special password. Still, they try at the rate of about 3 a week (that I *see* via attempted password-reset manipulations, 2-factor authentication change attempts, etc).
But ... I have received about 10 emails from folks who wanted to 'own' the email address. And -- I think -- because I didn't acquiesce, I have received hundreds of thousands of spam emails in the intervening time. They've submitted my email to stupid dating sites in French, German, Thai, Spanish, Tamil and most recently Hebrew. Hell, I got 1000+ emails/day from ONE SITE for a few days, about a week ago.
There's been phishing, spear-phishing based on the pseudo-identity hosted there, blind newsletter sign-up. Every kind of crap you can imagine, and several more.
And every step of the way, I reported the infringements, the spamming, the users who have a variant of the name (e.g. foo2525 instead of foo): to the spam-handlers and to the variant-users.
And yahoo has never given a shit. Not once. Period. IMHO, 'cause it was one account-holder. But I've kept it anyway -- since it's a great cut-out. And I'll continue to do so. Yahoo is a joke; has been for many years now. Sometimes... that's its value. It's a great example of what NOT to do, and it's a great revealer of the seedy underbelly of the 'net.
http://demotivators.despair.co...
A spam email that went to the Inbox stating that Yahoo! was going to close all inactive accounts if you did not click on this link and log in was probably how the attacker got the passwords. The link went to one of those off-shore URLs that we should all avoid.
Phishing is still alive and well.
And there are a lot of gullible people to phish for.
You can lose something that is loose, so tighten the loose item so you don't lose it.
Ahh, you're from one of those countries which is extremely religious, extremely sexually repressed, where all the men think all women are sluts, women that don't sleep with ugly men at the drop of a hat are called up tight bitches, where the police and prosecutors are grossly incompetent. Let me guess, in your biggest central square when it's packed with people, a woman isn't safe from gang rape without 10 to 20 other women around her at all times, or even with one or two men protecting her? Or are you from the country where all the plaza's are full of illegal aliens spinning and tossing and demonstrating trinkets, and when the police car comes by the all scatter to a nearby street, and when the police car goes away they instantly reappear? The two most awful places in the world to visit, with the exception of some 2000 year old stone buildings from our first great civilizations.
"Yahoo! announced via their Tumblr page"
Really? This is how businesses are delivering their security announcements?
From neither New York nor New Jersey do I hail. Why do think so?
I have an account on Yahoo... But... Paraphrasing my teacher... "Big deal. Next week it will be fine."
We all will have what we deserve. Yahoo!
It sounds like an external password database was hacked and all the usernames + 'yahoo.com' and the matching passwords were tried against Yahoo Mail.
It doesn't seem like Yahoo could have done anything more about this. It is a case of password reuse, not Yahoo's password storage.
I manage mail servers for a mid sized company, and Yahoo can kiss my ass! Their IP ranking system is stupid and they won't change it, which fucks any smaller ISP hosting multiple domains on a single IP. If we have a company get a mailbox compromised from domainx, yahoo blocks all mail from the IP instead of the domain so everyone else is screwed. Even when we lock the account, yahoo has no method of unblocking.
To make things 10 times worse, their mail interface has a big ole "SPAM" button which allows users to delete mail in a single click where their "Delete" button requests confirmation. Users tend to use the SPAM button because it's easier to delete messages, and not obvious that they are actually reporting the person as a spammer to Yahoo who again fucks the ISP by blocking their mail. After years of complaints from companies, if you use FireFox you will see a button that says "Report Spam", but IE still just shows "Spam".
Yahoo of course does not give a shit and won't add a confirmation to that "spam" button to let users know they are reporting a server for "spam" and not simply deleting a message.
And look, I absolutely hate spam. I would not work for a company that sends spam and think they are as useful to society as telemarketers. Yahoo just sucks at doing anything worthy to reduce spam. Their IP ranking system has been broken and complained about since it came out, but since it's cheep for them to use they continue with the broken program and don't care that this harms their user base more than it saves them money trying to fight spam.
Yahoo mail has always been a one off disposable email to me, and answers.yahoo is just silly, who would post something there when you can just Google it, not to mention virtually every answer that I have seen get "modded up" as best has been incorrect.
Interestingly, using it to sign up for a site recently I noticed they wanted my phone number with a promise to "keep it secure" next to the number space.
"If any question why we died, Tell them because our fathers lied."
Some people still *actually* use yahoo for anything including email? Wow... that's just so um early 90's... kind of a fad like AOL.
You put the "fun" back in dysfunctional. Whenever I think of Yahoo, inevitably this pops into my head "It's the Bumpus Hounds! Ta da da da, da da!"
WTF is that and why did Yahoo think I would see it?
To be clear, no you didn't write any such thing. You didn't write anything even close to such a thing.
Your mistake isn't that you didn't add "respectively", it's that you're a clueless moron who not only didn't read what he wrote, but for 'reporting them to Yahoo' and believing Yahoo! could do anything about such third parties.
..since my Yahoo (junk) mail account was hacked a couple of months ago. I am certain it was because I used by Yahoo credentials to post a comment on a popular 'news' website (**cough** Slate).
I changed my PW to a machine-generated chunk of gibberish, and turned on 2-factor ID.
Mission: To provide products that consume time and energy as entertainingly as permitted by the laws of thermodynamics.
Even with this breach, I still think their mandatory MOBILE phone number requirement to get a Yahoo account is BS. Just one more data point floating in the revenue stream...
Been trying to help a friend get into their yahoo mail all morning, it won't allow access, sends to password reset instead, and no matter how strong I make the password it says it's too weak.
Yahoo will probably issue themselves a "best of the web" award to compensate for the inconvenience.
Such douchebaggery.
You can have my SIG when you pry it from my cold, dead hands.
When in Yahoo mail, click the gear in the upper right, select "account info" (it's the thing at the bottom), at the next page click "change password".
That's not at all difficult, it's barely different from how you do it on google or anything else.
I used Chrome to do it.
http://lkml.org/lkml/2005/8/20/95
Alabama?
I tried logging into yahoo mail about a month ago - My password worked just fine so I should be able to read my mail right? Fuck NO!
Instead I was presented with 2 security questions that I probably filled out 10 years ago with fake data that I have no idea what I put the answers for.
Then yahoo tells me I can have an email sent to my "backup email" which was a fake email, because I figured I'd never need that shit as long as I can login with my correct password right? Wrong?
So apparently with yahoo, A normal functioning password is not enough to access your data. You need 2 security questions now and a backup email.
I thought I'd see who's running Yahoo these days. Turns out, it's some dumb cunt I met in their chatroom's about 5 years ago - Marissa Mayer.
Now I know why she closed them down.
Don't just hash, salt and hash.
Don't just salt, use a truly random per-username salt.
Don't just do that, use PBKDF2/RFC2898/PKCS#5, bcrypt, or scrypt with tens or hundreds of thousands of iterations.
Don't just do that, actively forbid users from using P@$$w0rd, P@$$w0rd1, and so on and so forth.
I received the Yahoo password notification (cell phone text) for a Yahoo account that I set up only for the purpose of making comments on Disqus sites.
I had to change the password from something simple to something obtuse in order to login. The sent folder is still empty, since I have never sent a single email from that account. Since I have never used that email account for any other site, obviously there are no password reset attempts in the inbox.
There far too many web sites getting hacked. Are the developers simply clueless or are they just out-gunned by hackers?
Had to change the password on an old account that I forgot the password to and had to access recently. The trick to get past the 'password not secure enough' error is simply to turn off adblock for that moment. Was driving me nuts, when I was trying 30+ random-char, unmemorizable passwords that would probably satisfy ~95% of all password requirements and still getting that stupid error, until I found the solution.
I always salt my hash. Tastes better with salt - kinda bland without it.
Don't just hash, salt and hash.
Don't just salt, use a truly random per-username salt.
Don't just do that, use PBKDF2/RFC2898/PKCS#5, bcrypt, or scrypt with tens or hundreds of thousands of iterations.
Don't just do that, actively forbid users from using P@$$w0rd, P@$$w0rd1, and so on and so forth.
I disagree.
Don't just do that, actively forbid users from using any password in any language. Require them to use biometric blood dna sampling form a heat detected finger.
Seriously when are we going to stop being forced to remember gibberish so thieves don't steal our stuff?
Italy is Incredibly corrupt and the dead woman's family believes Knows should die. However they don't have the means too get to her. This is why double jeopardy is in the constitution.
Amazing. I restrained myself and didn't call out your ignorance, since I tend to use rather complicated sentence construction. You failed to learn when hit with the clue-stick.
So hey, let's play...
The sentence read "I reported the infringements, the spamming, the users who have a variant of the name (e.g. foo2525 instead of foo): to the spam-handlers and to the variant-users." Let's dissect this.
The disingenuous would read this to mean I reported everyone to the spam-handlers *and* the variant-owners. That's totally unhelpful. So, perhaps there is another interpretation, after one is finished with your ad hominem nonsense: It can represent two different actions. Obviously, "variant-users" cannot refer to spammers -- that's just stupid. Then, it quite obviously indicates the resolution path for the variant-owners is *to* the variant-owners. The use of "respectively" would force the reader to cross-correlate the phrases, easing the process.
So, learn some bloody English, you puerile, self-indulgent, narcissistic, entitled moron. When they invent a "does not exceed a 6th grade reading level" tag, I'm sure you'll finally come into your own.