Slashdot Mirror
Yahoo Insiders Believe Hackers Could Have Stolen Over 1 Billion Accounts (businessinsider.com)
An anonymous reader quotes a report from Business Insider: The actual tally of stolen user accounts from the hack Yahoo experienced could be much larger than 500 million, according to a former Yahoo executive familiar with its security practices. The former Yahoo insider says the architecture of Yahoo's back-end systems is organized in such a way that the type of breach that was reported would have exposed a much larger group of user account information. To be sure, Yahoo has said that the breach affected at least 500 million users. But the former Yahoo exec estimated the number of accounts that could have potentially been stolen could be anywhere between 1 billion and 3 billion. According to this executive, all of Yahoo's products use one main user database, or UDB, to authenticate users. So people who log into products such as Yahoo Mail, Finance, or Sports all enter their usernames and passwords, which then goes to this one central place to ensure they are legitimate, allowing them access. That database is huge, the executive said. At the time of the hack in 2014, inside were credentials for roughly 700 million to 1 billion active users accessing Yahoo products every month, along with many other inactive accounts that hadn't been deleted. In late 2013, Yahoo CEO Marissa Mayer said the company had 800 million monthly active users globally. It currently has more than 1 billion.
Must of used 1111/
Just say they stole all the accounts. It's also simpler to say: "Everyone who's had a yahoo account (and still cares about it) change your passwords now."
Unbelievable!
700 million to 1 billion active users accessing Yahoo products every month
Oh and the hacking thing.
The most dangerous drug
Is that a british Billion or a USA billion?
Perhaps we can forever rid ourselves of the english language uncertainty over the definition of a billion by renaming the US billion to a "Yahoo".
Some drink at the fountain of knowledge. Others just gargle.
Probably one of the worst CEOs ever, down there with Stephen Elop.
I use it daily.
Ironically, I've only ever used it for their OAuth service so I could log into other smaller websites, without having to worry about their password storage security. I sure called that one well...
John
Mine was pretty much used a decade ago as an account to sign up for other things that required an email address. Hadn't looked at it in at least 5 years, and deleted it only a few months ago because I thought it probably wasn't good to have this unused account hanging out there.
1 billion active Yahoo accounts? Don't think so.
No, mine is gone now -well will be in 91 days.
Anyone else pissed off that she can make 100's of millions of dollars just by sucking the right billionaires dick ?
I'm not so much pissed as jealous. I'm a straight guy, but I swear, find me someone who'll pay me 100's of millions of dollars for sucking a cock and you can consider it a done deal.
Just cruising through this digital world at 33 1/3 rpm...
After having my gmail account hijacked a few years ago, I began using a password generator/storage program on my desktop and changed passwords to unique passords for everything. It's damn hard to remember passwords such as '67zu2tLqWdfaXe6hV6m5,' but nobody is going to stumble upon it.
They didn't make any bones about it - their first step was to fire a ton of engineers. The "New Yahoo" was supposed to coat along on existing software, acquisitions, and inertia so that it would be more profitable in the short term, making it look more profitable. To bad all software has bug, the acquisitions sucked, and inertia only takes you so far against resistance.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
So, here is the way to fix this sort of thing using very old, very simple, freely-available tech:
First, all passwords are hashed with salt on the client. If you want to protect a bad (brute force-able) password, you could use secret salt (i.e. a keyfile) hashing layer separately but for maximum portability known salt (like the base domain, "yahoo.com") should be used. This will protect good passwords from being brute-forced without something on the client being compromised, and offers strong protection for password reuse (regardless of whether or not reuse with different services is ill-advised, it will always happen.)
Ideally, this needs to happen via a special API call to the browser itself and not by scripting on the website. The browser is already aware of password fields (this is how it offers to remember logins for you) and thus can in principle alert you whenever an insecure passfield field (or whenever 'no legitimate password field') is present. This would prevent all but the most careless users from having a spoofed website discover their plaintext passwords. I would much prefer that the browser itself handle this hashing but even a javascript implementation of client-side hashing would be a huge improvement over the status quo, primarily because the presence of client-side hashing can be easily detected and audited whilst we have to take them at their word if they claim to be doing this all securely on the backend. (And also because a client-side hash reduces the attack surface such that a database breach or HTTPS attack alone is insufficent--with JS client-side hashing, only a successful website spoof that is undetected by the browser would reveal the plaintext password.)
Next, on the server side, the already client-hashed password is hashed a second time prior to being stored in the database. What does this accomplish? I'm glad you asked! What this means is that a simple read-only database breach does not allow an attacker to log into anyone's account. This is because if they try to use the value stored in the database (post server-hash), it will be hashed a second time prior to being compared to the value in the database, and this second hashing will result in a mismatch. Thus, a successful attack would need to either intercept the pre-server hash value in memory (a much more difficult feat, and one that will only reveal users that log in while the attack is in progress), or they need write permission to the database to overwrite the password, which should sound the alarm in two ways: one by (hopefully) causing database integrity checks to fail, and another by locking users out of their accounts.
The upside of all of this: Good passwords remain safe to reuse on other websites (so long as everyone uses these standards. Websites and apps refusing to use these standards should be aggressively warned against.) Even with bad passwords, it's much harder for attackers to gain access to accounts, and the number of accounts compromised should be reduced. And the CPU load of doing this hashing should be minimal compared with the overhead that HTTPS already imposes.
Now tell me, can anyone explain why this isn't happening yet? This sort of thing would allow us to stop insisting that the most important thing users need to do is memorize a different quality password for every single account they have (impossible for most people.) The elbow grease to do this is minimal and with enough of an outcry, we could easily shame these big name companies into adopting these standards.
(And please, for all you anonymous cowards who want to tell me that hashing with known salt values are useless... go educate yourself on the properties of cryptographically-secure hash algorithms. I don't care about pre-computed rainbow tables. This isn't about protecting weak passwords from brute force attacks. Once offline attacks become possible--which happens whenever a hashed value becomes known, provided the hashing algorithm and salt are both k
So you think she planned to kill the company in the long run to make herself look good in the short run? Makes sense to me.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I don't believe a word of it. If it were true, they would lie and say something else. Their only reason for announcing this is to manipulate the public opinion and to cover their corporate asses and branding. The fact is, if they announce a billion stolen passwords then I guess we no longer can accuse Yahoo of selling them, or the rest of the data mine that goes with it. And Verizon can't be blamed either, they never had control of the treasure. The timing of this announcement, to a degree of truthiness, was perfectly timed at the moment the Verizon deal was ready to go into escrow, perhaps. It is a hedge on public opinion when the customer realizes that somebody has sold them out: it was hackers. Yahoo would never dream of cashing in and selling you out, and neither would Verizon. That's why Yahoo and Verizon are transacting billions of bucks while hackers just transact a billion accounts and the customers wonder how many billion spam emails they received before criminals were involved. Its all conflated to firmly steer awareness you've been totally sold out, in violation of the promise to the customer, but its not their fault - the hacker's did it - its a criminal act, not yahoo's fault, because they are struggling incompetent boobs, and Verizon is so perfect a corporation that the hacker's only chance to get in was before the Verizon deal and security gauntlet arrived.
Double doody
Truth is the last thing that needs to be stated in the news. Everything is a paid advertisement, even the programming between commercials. We're the product when it comes to mass media. Do you feel like you've been screwed? Who pimps customer meat? We must be the human traffic.
No, she planned to make the company look good in the short run to foist it off on someone else and collect an even bigger golden parachute. That is the trend nowadays. Just look at how a company's stock goes up when someone announces a mass lay-off. They know that in the short term, there will be more profits, and if they're lucky, they can unload the stock before it all turns to crap.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
She was hired by the board of directors to get the shareholders a big payday. She was willing to do it by making the company a going concern in the long term, but the shareholders decided they wanted to cash out quickly.
She added value to the company at a rate of 10 to 20 million USD per day that she's been employed, at a 100:1 return on her compensation. Form the perspective of the people that hired her, that's a big damned success.
Well, yes. Of course, if many people do that, everything goes to crap in the end, but that seems to be the current trend.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I haven't had time yet to digest it in detail but it is indeed interesting.
The one valid criticism of my ideas are that they don't go far enough; the instant I read 'challenge-response' in the article title I said to myself "oh, well, that's going to be even better." I don't claim to be the final word in these matters; I don't do this shit for a living. That doesn't change the fact that my recommendations are dirt-simple, low overhead, powerful and require nothing extra from the user (although they should still be using strong passphrases for maximum benefit.) If this basic idea can be made even better with a challenge response then by all means, let's do that instead.
This is like me noticing that firemen lined up using thimbles to ferry water to the scene of a crash. My suggestion to use buckets instead may not be the global optimum solution, but it is clearly a huge improvement.
So you think she planned to kill the company in the long run to make herself look good in the short run?
That's precisely what CEOs of public companies are hired to do now. Pump the share price as high as possible as quickly as possible, damn the consequences, and then bail with a golden parachute.
"If there was a gay Afro-Puertorican Linux distribution, I'd give it a try" ~lucm
That's how many were compromised.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
IANAL, so, any around? How about a million small claims? Think Crypto Wars here: FBI's Comey said that they were waiting till next year for an "adult conversation about encryption" after collecting data this year. Collecting data? How 'bout a data point like: Poor Security = Enormous Financial Consequences. Fast. Did Yahoo encrypt everything, every connection? Could encrypting everything have been part of a comprehensive security plan? *I* didn't have a Yahoo account ;-) but if I did I think I just might head to the County Courthouse for a $200 filing for the hassle of needing to switch to Google.
P.S. As I noted elsewhere, you've probably hopelessly bungled your hash. You shouldn't have tons of collisions like that. A proper hashing algorithm will correctly utilize all of your input and you should produce (and save) output that significantly exceeds the size of the input.
This first occurred to me last night when I was debating another alleged expert cryptographer, who was eventually forced to concede all of my claims--you guys have a very limited understanding of how hashing can be used, their mathematical properties, or how the odds of collisions can be easily adjusted. And none of this requires much CPU overhead if you're already doing HTTPS.
oops, please ignore the below reply. I meant it for another AC post.