Slashdot Mirror
Yahoo Fixes Flaw Allowing an Attacker To Read Any User's Emails (zdnet.com)
Yahoo says it has fixed a severe security vulnerability in its email service that allowed an attacker to read a victim's email inbox. From a report on ZDNet: The cross-site scripting (XSS) attack only required a victim to view an email in Yahoo Mail. The internet giant paid out $10,000 to security researcher Jouko Pynnonen for privately disclosing the flaw through the HackerOne bug bounty, In a write-up, Pynnonen said that the flaw was similar to last year's Yahoo Mail bug, which similarly let an attacker compromise a user's account. Yahoo filters HTML messages to ensure that malicious code won't make it through into the user's browser, but the researcher found that the filters didn't catch all of the malicious data attributes.
Now only the government read read users emails
“He’s not deformed, he’s just drunk!”
for misleading readers
How does the attacker get the information if it is being popped and not being accessed by web?
Oh, they don't? The older way BEFORE webmail is actually MORE SECURE?
Then why the fuck does Yahoo think they can tell ME about using MY "insecure method" of getting email and I really should upgrade to their blahtity blatity blah?
Keep going Yahoo. I've been a user of yours for well over a decade. And you're about one more hairbreak from not receiving another dime from me again. (At least $2,000 over the years for both webhost and pop mail access.)
never works, you need to sandbox it or whitelist or gtfo
Does that mean anyone can read the spam that I have sent to my junk yahoo account?
Why in the world would anybody in their right mind continue to use Yahoo after everything that's come out about them this year? Changing your email is a pain in the ass but worth it in this case.
"The internet giant paid out $10,000...
So being able to read your customers email is only worth $10,000 to you, Yahoo?
Don't be surprised if you find the next hack against you was sold to the black market for half that amount, simply because you're too fucking cheap to offer up more than a financial slap in the face.
One would think money talks would be a well-known and understood concept to a greedy corporation.
fixed and reaveiled after the fact. nice and gg.
Well, the only yahoo mail, I have I use for my Flylady emails. The hacker will learn how to enjoy the holidays while getting all the holiday chores done without any stress or inconvenience to our families. :) Enjoy your hacker you!
Here you go Mr. Hacker for finding a critical bug in one fo the few services keeping the company alive... 10000$. Enjoy it.
Here you go CEO, here's a 50 million$ bonus for your focus on improving security on Yahoo.
These services still call these established e-mail access methods "less secure", and encourage you to turn them off rather frequently. Is this because then they can't show you ads on their web-mail site?
(captcha: sucking)
There are two sides to that. In a day I can run a suite of tools across a dozen such services. Those tools will find likely weak areas with little effort or time on my part. Over the next couple of days, I can explore the issues highlighted by the tools and quite possibly find an issue like this.
At current bug-bounty levels, I could probably earn a bit more than I could make at a salaried position, while setting my own hours and exploring the things that interest me. So prices are reasonably fair. Another way of looking at that is that skilled people DO in fact participate in bug bounty programs, so they find it worthwhile.
Yes, in theory committing crimes could be an easier way for people to make money, until they go to prison. A bank robber makes more per hour than a bank teller.
> level of effort should never be a pricing metric, in much the same way that a surgeons salary should not
You may notice that becoming a surgeon requires a ton of effort. Therefore, people don't generally put out that level of effort unless they'll be well paid for it.
> at least priced high enough to entice everyone away from the black market.
There is no price, for any service, that customers are willing to pay and will entice everyone to do good rather than crime. Accountants get paid well to do things right, some choose crime instead. That'll always be true.
As if there weren't already enough reasons for users to dump Yahoo?
Who?
It is the slowest, most ponderous, most irritating one out there bar none. I hope this year they will not add those ridiculous Christmas gimmicks, which make it even slower, more ponderous and more irritating.