Slashdot Mirror

← Back to Stories (view on slashdot.org)

Yahoo Sued For Gross Negligence Over Huge Hacking (reuters.com)

Posted by msmash on from the empire-stikes-back dept.

Yahoo apparently took two years to investigate and tell people that its service had been breached, and that over 500 million users were affected. Amid the announcement, a user is suing Yahoo, accusing the company of gross negligence. From a Reuters report: The lawsuit was filed in the federal court in San Jose, California, one day after Yahoo disclosed the hacking, unprecedented in size, by what it believed was a "state-sponsored actor." Ronald Schwartz, a New York resident, sued on behalf of all Yahoo users in the United States whose personal information was compromised. The lawsuit seeks class-action status and unspecified damages. A Yahoo spokeswoman said the Sunnyvale, California-based company does not discuss pending litigation. The attack could complicate Chief Executive Marissa Mayer's effort to shore up the website's flagging fortunes, two months after she agreed to a $4.8 billion sale of Yahoo's Internet business to Verizon Communications. Yahoo on Thursday said user information including names, email addresses, phone numbers, birth dates and encrypted passwords had been compromised in late 2014.

56 comments

  1. Not good enough by Anonymous Coward · · Score: 5, Insightful

    When you're this negligent with your security, a simple class action lawsuit for damages won't suffice. It doesn't solve the problem, either, because these are usually settles to the benefit of the lawyers. Instead, the executives and any managers who were behind this negligence need to spend some serious time in prison. Yes, that includes Marissa Mayer, who needs to be behind bars for the awful way her company handled the breach. I despise the Russian hackers, who deserve to be on the receiving end of vigilante justice. However, there also needs to be some lengthy jail sentences for plenty of people at Yahoo. It's also time that companies like Yahoo that do this have to pay serious restitution to everyone on the receiving end of such a breach, enough so to put the company out of business (that shouldn't be hard in Yahoo's case).

    1. Re:Not good enough by hcs_$reboot · · Score: 1

      While this is true, that will never happen. Not within the next 10 years at least.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    2. Re:Not good enough by JaredOfEuropa · · Score: 5, Interesting

      I join you in your moral outrage, but... does the law (US law or otherwise) even have a provision for such negligence? Also, what is it we want to see punished? Lax security? That sounds fine until you realise every guy with a message board will be on the hook as well: not everyone is a security expert (or even a half decent webadmin), and certainly not everyone can afford to hire one.

      What I certainly would like to see punished is the very very late disclosure of the breach. Starting this year, companies in the Netherlands are obliged to disclose data breaches. Fines for non compliance go up to €500k for simple cases; for more serious cases the fine is capped at 10% of net yearly turnover. It's a start... the law applies only if sensitive information was leaked such as names, dates of birth, addresses, medical info, etc. It doesn't cover username / password. Also, the company discloses the breach to the authorities, not their customers; the authorities may force the company to inform their customers as well though.

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
    3. Re:Not good enough by Anonymous Coward · · Score: 2, Interesting

      "When you're this negligent with your security, a simple class action lawsuit for damages won't suffice. "

      Take a good look at the Lawyers involved...
      They don't take on trivial cases.
      They win.
      They get huge settlements.

      And don't think for a minute that "Ronald Schwartz" just waltzed into the Law Offices with a grudge. There will be other suits filed all over the country Very Soon Now, by other "Chosen" Plaintiffs, just to get this all rolled into one Big Hairy Juicy Class Action Law Suit. Possibly the biggest, ever.
      Of course, even Lawyers have to eat, and this will take years, maybe a decade, unless Yahoo or whatever quickly stripped carcass of Yahoo is left, caves. But still, there is Big Money behind this. Just Whose is the question.

      "I despise the Russian hackers, who deserve to be on the receiving end of vigilante justice."
      I like the way that you phrased this, because the hands-off Wild West metaphor for the Internet has gone too far. When Law failed in the Wild West, Vigilance Committees formed and hung a few self-made bastards. (And note that subsequently, a few members of these Committees were hung themselves... These things do tend to get out of hand.)

      "Yes, that includes Marissa Mayer, who needs to be behind bars for the awful way her company handled the breach"
      The Wild West metaphor applies to Mayer as well. She should stop thinking about redesigning Logos, and start thinking about full-time heavily-armed Security for Herself, her Family, and her Associates, for the foreseeable future.

      People, a lot of them, and this includes Stockholders, are getting very angry at Corporate America. Both Trump and Clinton are channeling this, which is actually dangerous for both of them given their past. That Corporate America has allied itself to the Criminal World, and I'm looking at you, ISPs and the entire Advertising Industry specifically, and Big Pharma, Big Finance, and the Entertainment Industry in general, means that there is little room any longer for subtleties; at some point something snaps, and it comes time to just simply hang them all, and then throw the Nations largest Block Party ever, and have some Barbeque.

      Then again, I was never much good at Prophecy; if I was, I'd have a bigger Yacht...

    4. Re:Not good enough by drinkypoo · · Score: 0

      What I certainly would like to see punished is the very very late disclosure of the breach. Starting this year, companies in the Netherlands are obliged to disclose data breaches. Fines for non compliance go up to â500k for simple cases; for more serious cases the fine is capped at 10% of net yearly turnover. It's a start...

      No, it isn't. If loss of the company is not a potential reality for a breach, then it's not a start. It's just wankery.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    5. Re:Not good enough by Anonymous Coward · · Score: 0

      I hope your talent for prophecy is more reliable than your talent for capitalisation...

    6. Re:Not good enough by MoarSauce123 · · Score: 4, Insightful

      Worse even, If Yahoo is convicted and has to pay damages it will be less expensive than implementing proper safeguards. As long as breaches are cheaper than security not much will happen.

    7. Re: Not good enough by Anonymous Coward · · Score: 0

      Name, DOB, and address appear to be public info here in the US. This haa shown up in the courts before.

    8. Re:Not good enough by Anonymous Coward · · Score: 0

      I supposed the best course of action then is to do nothing, and let Yahoo keep all that money. Putting money in the hands of lawyers is so reprehensible that it's better just to not take the guilty to court.

      Now, stop your whining, class action lawsuits were always about removing money from the violator when it made no sense for an individual to sue. That information may damage certain people badly, but until then it probably only benefited Yahoo in a small way. Courts attempt to be fair, so if you haven't yet lost a million dollars but someone gained ten dollars at your expense, then they'll rule the amount in question is ten dollars. Hypothetical amounts of damage pale in comparison to real damage (or lacking that, real gains).

    9. Re:Not good enough by Anonymous Coward · · Score: 1

      Here is the problem - data breaches are so common in large companies that it is difficult to fault a specific company for negligent behavior. If everyone is negligent using current technology then there is no fault involved. You remind me of managers who believe if they simply demand, threaten, cajole, reward, etc, their programmers to work harder then software projects will be ready sooner. Threatening corporate managers with jail does not improve technology.

    10. Re: Not good enough by thundercattt · · Score: 1

      I remember reading the same /. article it's cheaper to run the status quo, get hacked than to keep upto date on security.

    11. Re:Not good enough by Anonymous Coward · · Score: 0

      You have grown up in a culture where capitalization is reduced to a minimum, like in France, and a double space added to the end of a sentence for clarity is superfluous. I get that you haven't read much written before 1980 or so, in original text.

      Try reading some of the Great Invective written during the late Nineteenth Century, the Age Of the Robber Barons. (Can you say just why the "the" wasn't capitalized here?)
      of course i could write all unixy. that was common on usenet in the early days. they also disliked commas. and semicolons. or sometimes even periods which meant one never knew where a sentence began or ended paragraphs were nonexistent andsometimesoutofsheerlazinesstheyskippedanypunctuationorspacingatall
      Because C.

      Yes, I make use of Capitalization. It is a way to draw attention to a word or concept, without any actual added text. This is known as Rhetoric, something not taught in Yank Schools for decades. Bold or Italic may not translate between Forums; some of the early ones read now are full of &nbsp. And making _emphasis_ by the the use of underscore too often, is hard on the eyes.
      Anyway, I'm not going to change, and if you feel that you have not received full value, see the Cashier, and she will give you a refund.

    12. Re:Not good enough by HiThere · · Score: 1

      It's not using current technology that's the problem, it's that without unsafe methods you can't do remote administration, and it's more expensive to get someone to come in when you need to update the system. It's rather like a lot of the bugs that depend on bios flaws wouldn't be a problem is the bios couldn't be updated without throwing a local switch. And a lot of the complexity is mandated by marketing needs, not by technology.

      It's my suspicion that a really safe network would be much cheaper, but this means you need the manufacturers selling things that require the equivalent of moving a jumper before you could update them, or perhaps even install executable software. It's not something that's cheaper if only one company does it...unless that company is, say, Intel.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    13. Re:Not good enough by Anonymous Coward · · Score: 0

      "When you're this negligent with your security,"

      Sorry, but you are completely full of shit. They were not negligent, they had exactly as much security as the NSA wanted them to have. You know it's exactly true.

    14. Re:Not good enough by ShanghaiBill · · Score: 1

      the executives and any managers who were behind this negligence need to spend some serious time in prison.

      This reminds me of the old adage: "We build prisons for people we are afraid of, and then we fill them up with people we are mad at".

      Prisons are to segregate people that are physically dangerous from civilized society. For other people, there are always better alternatives. For instance, Marissa could spend the next 5 years changing bedpans in hospitals while wearing an ankle bracelet.

      America imprisons far more people per capita than other countries. Far more than Russia, four times as many as China, 15 times more than Japan. There is little evidence that this leads to less crime, and plenty of evidence that by disrupting families it increases crime.

    15. Re:Not good enough by Anonymous Coward · · Score: 0

      " For instance, Marissa could spend the next 5 years changing bedpans in hospitals while wearing an ankle bracelet."

      FTFY:
      " For instance, Marissa could spend the next 5 years being a bedpan in hospitals while wearing an ankle bracelet."
      Too bad, due to Modern Medicine... no more Dysentery Wards...

      "America imprisons far more people per capita than other countries."
      This is true, and note that many of the crimes, especially Drug crimes, were specifically criminalized and prosecuted with our Yellow, Brown, and Black chums in mind. (Opioids, Cocaine, and Pot respectively, and no miscegenation for all. (Overturned, Loving vs. Virginia, 1967.)) And let's not kid ourselves, "White Collar" crime makes the news just _because_ it is so rarely prosecuted. Just what deterrence is there against it really? Probation, fines paid out of pocket change and a few weeks cumulative of Community Service?

      "...and plenty of evidence that by disrupting families..."
      Ah, now that's an idea. Maybe it should be made very clear that the Sins of the Father, or in this case the Mother, shall punish the children unto the third and fourth generation. Now, _that's_ a deterrence. No inheritance and a mandated name change the only way out of Perpetual Shame. (Have you ever met a Mussolini, a Bonaparte, or a Capone? Nixon was fortunate that he only had daughters, and they quickly married off.) (Note that I avoided Godwin.)
      "... disrupting families it increases crime."
      I don't know of a single case where incarceration of a White Collar Criminal, as rare as it is, has ever led the rest of the family to go on crime sprees, and neither do you. But you made a good oblique point, and it boils down to this:

      Increasingly, Black Men have been found to have been wrongly convicted; let's just say this is the result of too much Prosecutorial zeal. And it is entirely possible that White Collar inmates were also wrongly convicted, because in your words, they are "...people we are mad at"
      We like to think that we have a System of Laws, not of Men. But this isn't true. Never has been, never will be. It's just the best that we have.

      A final point- Our Incarceration System as you mention is the largest in the World, and many say it is too expensive. I don't think that it is nearly expensive enough. It should hurt a lot more, especially in the pocketbook, a Public that wants so many of their members locked away, out of Spite.

    16. Re:Not good enough by Anonymous Coward · · Score: 0

      Well, if they're not sued, they still will not spend the money needed to remain secure. Every company that gets large enough operates with intense pressure to justify every position financially. Many companies know their support sucks or could have done much more to prevent user accounts being hacked, but they have already decided it's cheaper to take the heat from angry customers than it is to higher enough people. They only want to higher more employees they know will bring money, particularly sales and account executives, and depending on the company, also marketing, data science, product, and engineering.

  2. Access granted by Anonymous Coward · · Score: 0

    Yahoo routinely granted backdoor access and/or handed over login credentials to any female that requested it. This happens much more often than you think.

  3. Priorities are priorities by 93+Escort+Wagon · · Score: 1

    Marissa couldn't realistically investigate any faster than that. After all, she was busy tweaking the kerning for the updated company logo.

    --
    #DeleteChrome
    1. Re:Priorities are priorities by Anonymous Coward · · Score: 0

      And clearly the security-related issues were the result of "extreme carelessness" instead of "gross negligence", so the only reasonable outcome is for the charges to be dismissed.

    2. Re:Priorities are priorities by Anonymous Coward · · Score: 0

      Calm down. It's one user out of 500,000,000. Without a class action or govt involvement, you think this one NYer will have the financial power to take on a global corporation?

    3. Re:Priorities are priorities by Anonymous Coward · · Score: 0

      Did you misspell gross incompetence?

    4. Re:Priorities are priorities by Anonymous Coward · · Score: 0

      Not one user. It's an ambulance chasing law firm that wanted to be the first in line at the feeding trough.

  4. Disclosure 2 years later wait what? by Anonymous Coward · · Score: 1

    2 YEARS later and likely only due to a condition on the merger so that Verizon doesn't have to accept the responsibility of eventual disclosure. Same shit different year. Good riddance to bad rubbish. Yeah you really turned that company around doll. Congrats for running it into the ground, not like it wasn't headed in that direction anyway, now you just get to be the fall girl. I'm sure she'll land on some soft pillows thanks to that golden parachute.

  5. No trouble for the pending sale. by williamyf · · Score: 2

    Remember, yahoo is selling the CORE ASSETS, but Yahoo (the company) will still exist, as a placeholder for Alibaba and YAhoo! Japan shares. So, is Yahoo (the company) that is still liable for the breach, not verizon. If push comes to shove, Yahoo can sign a MoU stating that is it, and not Verizon, the one who will carry all the brunt of the hack (lawsuits, fines, reparations, costs and any other thing derived from this hack).

    The alibaba, yahoo japan and any other assets in this company shall be enough to cover that.

    --
    *** Suerte a todos y Feliz dia!
  6. Cheaper to get hacked than do security maintenance by Neo-Rio-101 · · Score: 5, Interesting

    Wasn't Slashdot only a number of articles ago talking about how much cheaper it is to get hacked than to deploy proper security and maintenance?

    We've known this for ages....and I learnt about it the hard way years ago as a webmaster.

    In my junior sysadmin pre-ITIL cowboy days, I was tasked with managing a web server, and it turned out that PHP needed an immediate update.
    Without further ado, to avoid the risk of getting hacked, I went and updated PHP to the next version up.
    Turns out that doing so broke a number of customer webpages - which were reliant on some old broken and unmaintained code. The website owners then complained and whined to our company that we threatened their businesses. (Fortunately they only made peanuts to our bottom-line, so luckily we didn't care that much)

    Lesson was simple: it is much easier to maintain old versions that keep things working AND DO NOTHING than to do any proactive security maintenance. This works in a number of ways.

    Firstly, when you eventually get hacked IT IS NOT YOUR FAULT. It is the fault of some hacker and things will be seen that way. Blame gets shifted away from the admins anyhow.

    Secondly, doing nothing is CHEAPER. It involves less risk, less change, and less responsibility. In a world where shareholders, finance and management dictate the aims of IT - you may as well fire the sysadmins because it's risky if they do any maintenance, meaning that since they're not going to do anything you may as well fire them. Just get contractors to build things to work once, then leave the systems on the internet indefinitely until they either end up getting hacked to the point of failure, or the hardware breaks down. Then rebuild the system from scratch with more contractors when that time eventuates.

    That's how security patching works in the real world. In other words, it doesn't.

    The thing is, it's ALL ABOUT SHIFTING BLAME in the world of IT, and IT is a risk, and it is expensive.
    That's why there is so much outsourcing combined with support contracts so company managers can point the finger at vendors when things go to hell and then walk away with legal indemnification and still keep their job and their pensions while saying that they kept costs down when things eventually go to pot.

    So in this Yahoo case, someone finally has to guts to call Yahoo out on it.

    --
    READY.
    PRINT ""+-0
  7. Re:Cheaper to get hacked than do security maintena by h33t+l4x0r · · Score: 4, Insightful

    It's not about that. The initial hack could have been anything from a 0day to a 5 year old exploit - you don't know and that's not the issue anyway. The issue is that they didn't tell anybody about it for 2 years. Users need to know that their passwords are compromised because they often will (for example) use the same password for online banking.

  8. Ask for 5 times your money back!! by Anonymous Coward · · Score: 0

    Oh, wait a minute, yahoo was free.

    So you got your money's worth.

    1. Re: Ask for 5 times your money back!! by Anonymous Coward · · Score: 0

      Not all accounts are free.

      Even if a service is offered for free there are obligations on those offering it. E.g. offering free chicken which turned out to be infected with salmonella on a large scale in would not protect you from prosecution.

  9. Seems fair by melting_clock · · Score: 4, Insightful

    Gross negligence is accurate enough when a company allows data on 500 million customers to be hacked and then fails to notify those customers for 2 years. Choosing to keep this from customers achieves little more than proving the company cannot be trusted. This should have been handled better.

    Fixing the problems, then disclosing the breach and taking immediate action to protect customers would be the action of a responsible and trustworthy company.

    This is going to cost them customers and reduce the value of the company. Not an ideal situation for anyone about to buy it...

    1. Re:Seems fair by Anonymous Coward · · Score: 0

      Yahoo still has customers ??

      The last time I saw their name was a few months back, installling some software and the installer had a sneaky "Install Yahoo toolbar and set as default search engine" box automatically ticked.
        Thought to myself "shit, is this how desparate they've become ?"

  10. Re:Cheaper to get hacked than do security maintena by JaredOfEuropa · · Score: 3, Insightful

    pre-ITIL cowboy days

    Are things a lot better post-ITIL? In my experience ITIL has made things a lot more predicable... most often predictably awful. Not that I blame ITIL for that; that's like blaming your hammer for the shoddy birdhouse you built. It's more like a crutch: people think "if we all do what it says in this book, we'll do better". In terms of business outcomes I have not found that to be true very often.

    --
    If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
  11. Re: Who is msmash? by Anonymous Coward · · Score: 0

    ...
    Yeah, the old editors...about that.
    They're all gone. Slashdot got bought from Dice and everyone got let go.

  12. Re:Cheaper to get hacked than do security maintena by Zedrick · · Score: 2

    > Lesson was simple: it is much easier to maintain old versions that keep things working AND DO NOTHING than
    > to do any proactive security maintenance. This works in a number of ways.

    Uh, that's not the right lesson to draw from this. If customers gets hacked because they are running out of date CMSes, it's their fault. It's also their fault if it's not working because they have outdated crap that's incompatible with modern php-versions. But if you neglected to update php, and the customers gets hacked because of that, it's your fault. You might be able to talk your way out of it in some cases by pointing out that (this kind of) hacking is bad, but if the customer is a company or a person who cares, they will demand to know exactly how this could happen. Having a logfile that shows them exactly what exploit in their outdated CMS or plugin or theme was used is very satisfying.

    I see this in every major php release. The answer to customers who complain is "too bad, update your old outdated Joomla 1.5.x/WP 3.5.x-crap. Or if you don't want to do that, good luck finding a reliable host that still has php 5.eol".

  13. Great. Look forward to 6 mos by Anonymous Coward · · Score: 0

    I eagerly anticipate receiving 6 months free e-mail service from Yahoo, Inc., while the lawyers ultimately win a seven to eight figure payment out of the proceeds from the judgement. Of course this means even MORE ads served whenever using Yahoo.com services, more annoyance and risk for us, while the owners continue to get millions of dollars each year.

    This won't make anyone better off except lawyers, and everyone else will pay for it. That's the joke.

    Get it?

  14. Re:Who is msmash? by Anonymous Coward · · Score: 0

    I willing to give msmash the benefit of doubt... for now.
    But manishs is terrible.

  15. Did Mayer do anything positive? by Anonymous Coward · · Score: 0

    So did Mayer do anything at Yahoo except collect big pay checks? She gave Katy Couric a nice paycheck too and then she preceded to be a ass not a asset.
    But a ton of people lost their jobs but not a lot was done in protecting people's (customers) information. Clueless is how I describe Mayer.

  16. Closed my account with Yahoo. by asjk · · Score: 1

    It was one of my earliest memberships on www.

    1. Re:Closed my account with Yahoo. by Anonymous Coward · · Score: 0

      I think Hotmail was my earliest.

      I've with with Yahoo for forever as well (as a paid email customer). So many online accounts are linked to my yahoo mail address. Nevertheless, I am going to have to start looking at alternatives. Anyone here using Startmail?

  17. Good luck getting around the mandatory arbitration by schwit1 · · Score: 1

    "Important Notice: This agreement is subject to binding arbitration and a waiver of class action rights ..."

  18. Verizon takeover by um...+Lucas · · Score: 1

    I'm behind the eight ball on this... Has Verizon made any mention of if they're still as eager to buy yahoo, since it could potentially expose them to this new liability that probably wasn't included for when they made their offer? Thinking of what happened to BoA when buying CountryWide Mortgage, for instance...

  19. Par for the course for Ms. Mayer by OneHundredAndTen · · Score: 2

    She is a perfect example of an individual who owes everything to timing - she happened to be at the right place, at the right time. She is pretty useless.

  20. Re:Cheaper to get hacked than do security maintena by freeze128 · · Score: 1

    Firstly, when you eventually get hacked IT IS NOT YOUR FAULT.

    It's not your fault *THE FIRST TIME*. However, if you get hacked again after implementing fixes, it certainly IS your fault. It's cheaper to do nothing, but when you get hacked, you must do something, and it must be something to implement better security, and notify your users. Taking TWO FUCKING YEARS is way too long.

  21. Jesus christ. by Anonymous Coward · · Score: 0

    ITIL

    No wonder Slashdotters are afraid of losing their jerbs to H1Bs.

    1. Re:Jesus christ. by Anonymous Coward · · Score: 0

      I just read the Wikipedia entry for ITIL and, Jesus Christ. So this is what CTOs and their minions author instead of code.

  22. I predicted this yesterday... apk by Anonymous Coward · · Score: 0

    See subject: I noted it in the very article on /. you speak of (sued over negligence in lax security) https://it.slashdot.org/comments.pl?sid=9693719&cid=52949651/ but I had NO IDEA it'd occur in the NEXT DAY'S NEWS (today)!

    APK

    P.S.=> My ESP is on "high power" this week it seems, lol - actually, it didn't "take a brain" @ all - it seemed to me @ the time this would be a NATURAL OUTCOME of said negligence... apk

  23. Re:Cheaper to get hacked than do security maintena by Anonymous Coward · · Score: 0

    Most outcomes are awful, but i don't think ITIL has much to do with the outcome, it just improves the predictability.

    In other words, with ITIL you have enough vision to see it's going to lead to an unsatisfactory outcome; without it you are optimistic, and hence you'll feel better.

    The truth is that if a customer is calling a web hosting provider, it's already a bad outcome. The best you can hope for is that the customer admits to messing up their environment, and it is fixed in minutes. Anything beyond the customer messing up their own environment is generally going to leave the customer with the impression that someone else should have done something to prevent the problem, and the hosting provider is the easiest target.

  24. Am I the only one... by tacarat · · Score: 1

    ... that thinks "state sponsored" means enough time and resources got thrown at this to make even exemplary security meaningless? They could have simply bribed some sysad that was getting fired/quitting anyway to go in, plug in a USB, and leave. Before slamming their IT staff, remember Kevin Mitnick.

    --
    "Common sense will be the death of us all"
  25. Re:Cheaper to get hacked than do security maintena by HiThere · · Score: 1

    PHP? It's been my impression that right there you have identified one of the main security problems with your system.

    FWIW, any rapid changeover is going to introduce its own costs and problems, but it is possible to write secure software which will generally pay for itself over time. Just not in the next quarter, or probably the next year. And you need to do decent Q/A testing before releasing the software. You still won't catch everything, but with the right design exploits won't propagate from module to module.

    The real problem is trying to change too much too quickly and without sufficient Q/A. Doing that will save you money over the long term, but not over the short term, and it will mean that you don't adopt the latest glitz very quickly...and often not at all. So your image, as well as your actuality, won't be "cutting edge" but rather "solid and reliable". There are reasons the "cutting edge" is frequently called the "bleeding edge".

    --

    I think we've pushed this "anyone can grow up to be president" thing too far.
  26. Surprising reaction from a supposedly tech site by Cytotoxic · · Score: 1

    Do we know anything about what was "lax" at yahoo? I certainly doubt that the lawyers involved in this have the slightest clue if there was any negligence at all involved. Their calculus is "wow, millions of accounts compromised. Let's go class action!

    And then I read through the comments here, and there is indignation at such weak security and lax procedures and they shouldn't just be sued they should all be taken out and shot and big corporations are teh evil!!

    What we do know is that the hackers targeting the company were "state sponsored". That means that the equivalent of the NSA targeted Yahoo for penetration.

    Does Slashdot really think that China's Ministry of State Security doesn't have the resources to hack into your server? Or the Russian FSB? You really don't think they have the resources to penetrate competently implemented security, particularly when an enterprise comprises tens of thousands of people and hundreds of thousands of devices?

    For all I know, Yahoo had an intern drive a box of backup tapes with all of the account info unencrypted to the dump and that's how they got hacked. But somehow I think it was a little more sophisticated than that. And my first thought certainly wouldn't be gross negligence.

    And I'm pretty sure the lawyers don't have the slightest bit of evidence that it was gross negligence at this point. They just see the size of the whale, and they'll seek to prove their case later. Or just make enough noise to get a big pile of cash to go away.

    If they really had something, I'd feel differently. But somehow I doubt they have anything at all at this point

  27. *hire (not higher!) by Anonymous Coward · · Score: 0

    Sorry, can't edit as an AP.

  28. Gross Negligence Yahoo! by Anonymous Coward · · Score: 0

    Well.

    The prosecution attorneys will have there hands full trying to convict 10,000 Idiots of Negligence. And the TOP IDIOT Meyers will still get a whopping Pay Day she does not have any right to. That IS the Valley Way.

    Ha ha

  29. What I learned from the attack by Anonymous Coward · · Score: 0

    When I first heard about the attack, my reaction was "Yeah, big surprise, fortunately I don't have any real accounts over there, just john-doe accounts for websites that insist on making you give them an email address to subscribe." Then a couple of things happened:

    - My spam filter trapped a "From: Yahoo Subject: We've been hacked, change your password" message. Yeah, right, I get those all the time. - I looked at it, and oops, it wasn't obviously fake! - Oh, right, I did have a sort of real Yahoo account from back when people used YahooGroups to do mailing lists...