Yahoo Mail Resets Account Passwords After Attack 96
MAXOMENOS writes: "Last night Yahoo! announced via their Tumblr page that they had detected attacks against some Yahoo Mail accounts. They reset the passwords to all affected accounts, and advised users of good password practices. Quoting: 'Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise. We have no evidence that they were obtained directly from Yahoo's systems. Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts. The information sought in the attack seems to be names and email addresses from the affected accounts' most recent sent emails.'"
The real news (Score:5, Insightful)
The real news is that apparently, Yahoo Mail still exists.
Re: (Score:2)
I wonder how desperate for attention one must be to confess a security breach just to be in some news.
Re: (Score:2)
"I wonder how desperate for attention one must be to confess a security breach just to be in some news."
Do you really think that was the goal? Advertising a security breach? It isn't really anything novel these days--everyone is doing it. We've become bored with the very idea.
More than likely, they are simply trying to determine who is using which account. They release this sort of announcement to get users to simply interact in any way, be that changing your password or even trying to do so. This way, they
Re:The real news (Score:5, Interesting)
I've been using Yahoo mail since almost the beginning and still do.
I changed my password as soon as I heard about this. Or, I tried to. Yahoo makes it so difficult to change your password that I actually had to go to Google and search for "How do I change my Yahoo password". Then once I figured out where to go (none of the links worked - I had to paste it from an answers.yahoo.com reply), the AJAXified page wouldn't work in Firefox on Linux, so I had to fire up my work PC and use IE.
Unbelievable.
While I was there, I deleted an old yahoo personals alias (also didn't work in Firefox - had to use IE), and then changed my backup email. But that didn't work either - the link in the confirmation email went to an error page.
Re: (Score:1)
Odd, I did the same thing last night with Firefox on Linux. Was easy to find link, was easy to change, had no issues at all.
I keep reading about how horrible Yahoo mail is, but I never seem to have the issues everyone else does. Their spam filter is also nearly 100% perfect for me as well.
Re: (Score:2)
I think it has more to do with the fact there's little point in spamming what most people use as their spam email account.
I only check mine when some forum or whatever refuses to allow me to login until I confirm an email address.
Re: (Score:2)
And once again I was reminded that the only reason that I have a Yahoo e-mail/profile/thingy is because there is one, countem' ONE Yahoo group that I use. The actual e-mail account has nothing in it, not even random spam, after three or four months between log-in
My Soapbox! (Score:3, Interesting)
I manage mail servers for a mid sized company, and Yahoo can kiss my ass! Their IP ranking system is stupid and they won't change it, which fucks any smaller ISP hosting multiple domains on a single IP. If we have a company get a mailbox compromised from domainx, yahoo blocks all mail from the IP instead of the domain so everyone else is screwed. Even when we lock the account, yahoo has no method of unblocking.
To make things 10 times worse, their mail interface has a big ole "SPAM" button which allows us
RE: My Soapbox! (Score:2, Interesting)
I used to work for a student loan servicer - who only sent emails for things like account notifications, ACH withdrawal notifications, etc. We'd have to fight our way off of Yahoo blacklists two or three times in the five years I was there. Yahoo's "spam" management is a common problem for admins hosting mail services.
Re: (Score:2)
You sound like someone who has never run a mail server for more than one person. What is your ingenuous magical cure for someone getting their email password compromised? Sure, change the password. Then there's cases where someone forwards mail from your server to another. Surprise, they get a spam. Don't even mention spam filters, it they're anything less than 100% effective, this problem happens, and none are 100% effective unless they send all mail to /dev/null.
Then you get to deal with the anti-spamme
Re: (Score:3)
why do you think it's hard? (Score:2)
When in Yahoo mail, click the gear in the upper right, select "account info" (it's the thing at the bottom), at the next page click "change password".
That's not at all difficult, it's barely different from how you do it on google or anything else.
I used Chrome to do it.
Re: (Score:2)
Seconded, I changed my short before hopping onto /. today. Took a few seconds, no problems at all. I was surprised there wasn't a second box to confirm the new password in, although you can show it as plaintext.
There's plenty wrong with the new, "improved" Yahoo mail, I'd move to Gmail or something else if it weren't for the fact that 15 years worth of everybody in my life has my Yahoo address, but changing the password isn't problematic.
Disable Adblock to Change Password (Score:1)
Re: (Score:3, Insightful)
Yahoo mail was once the equivalent to gmail. It had very good UI, speed and storage for its day. All of this when many ISPs still charged for an email account. It is not surprising that many people still hold on to their yahoo mail accounts.
Re: (Score:2)
Also, Yahoo acquired a number of email list service providers many years ago; the only reason I still have an account there.
Re: (Score:3)
Re: (Score:2)
Really? Last time I used it, admittedly a long time ago, about half my mail was spam. Sadly, that was still better than my ISP mail.
Re: (Score:2)
This was back when ISPs only gave you a 2-10MB mailbox and limited attachment sizes to as little as 1MB.
Then GMail hit with their 1GB mailbox, all the other free webmail providers had to up their limits.
Re: (Score:2)
It is the primary mail service for AT&T.
Re: (Score:1)
No the real news is that Yahoo still exists separately from Google. I would have figured the Marissa Mayer, being the former resident Queen Bee, (literally, Illinois Institute of Technology granted Mayer an honoris causa doctorate degree in recognition of her work in the field of search in 2009 [and she was Vice President of Local, Maps, and Location Services and, before that, vice president of search products and user experience as well as the highest ranking female there.]) would have taken the job of CE
WTF (Score:1)
Re:WTF (Score:5, Interesting)
Hashing passwords is pretty pointless unless they're also salted. Otherwise all the common and short passwords are as good as being in plain text.
As for why a 3rd party had the passwords, I think Yahoo need to be quite a bit more forthcoming and explain this. Surely they are aware that their customers are going to be reusing passwords and that, by giving a third party these passwords they are also exposing their customer's accounts on numerous other sites?
Re:WTF (Score:5, Insightful)
As for why a 3rd party had the passwords, I think Yahoo need to be quite a bit more forthcoming and explain this.
Quite feasible that yahoo had nothing to do with it:
Jimbob creates account on somecrackablesite.com using jimbob@yahoo.com email address. somecrackablesite.com gets cracked and attacker gets DB dump which contains username/email/pass for jimbob. Attacker assumes jimbob used same password for both sites and gains access to yahoo account. This is why using the same password for multiple sites is a big no-no.
Re:WTF (Score:4, Insightful)
This is why using the same password for multiple sites is a big no-no.
And flipping that around a bit, it is also a security risk as so many sites allow a password reminder through e-mail. If someone cracks only your e-mail, he can just send these reminder requests around the web and get access to various sites.
Re: (Score:1)
That's why your e-mail should be one of your most closely guarded accounts, together with banking accounts and alike. Did y'all turn on 2 factor auth yet?
Obliquely related, some e-mail providers let you freely use aliases like somemail+slashdot@gmail.com and somemail+dotslash@gmail.com for somemail@gmail.com - sites that ask for e-mail in password reset form will just tell you "No such account" if you have it set to "somemail+thissite@..." but ask for "somemail@...". As a bonus, you'll instantly know there
Re: (Score:2)
I use my mobile phone to access my bank all the time (usually when I am out and about and want to check my account balance and transaction history to see where I am at and whether I can afford the things I want to buy). One of the options my bank offers for extra security is SMS authentication. If the SMS is comming in on the same phone I am using to access the bank, its definatly not 2-factor authentication in any sense of the term.
Re: (Score:2)
It's feasible, but Yahoo are taking a hammering on this.
If they believe the data was obtained via a 3rd party and they know they don't share passwords hashed or otherwise with 3rd parties, I would have expected them to be shouting that from the rooftops.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Don't just hash, salt and hash.
Don't just salt, use a truly random per-username salt.
Don't just do that, use PBKDF2/RFC2898/PKCS#5, bcrypt, or scrypt with tens or hundreds of thousands of iterations.
Don't just do that, actively forbid users from using P@$$w0rd, P@$$w0rd1, and so on and so forth.
I disagree.
Don't just do that, actively forbid users from using any password in any language. Require them to use biometric blood dna sampling form a heat detected finger.
Seriously when are we going to stop being forced to remember gibberish so thieves don't steal our stuff?
Re: (Score:3)
Maybe they were. As the Target security breach demonstrated, if you can intercept the information prior to it being hashed/encrypted, it's still usable.
For an example, say a website's authentication process code is compromised. It works exactly the same as it always has been, but prior to hashing the supplied password to compare to the saved salted & hashed value (exactly the way it should be), an extra function call is made that saves the username and password to some data store (text file, remote dat
password will not protect you (Score:3, Informative)
advised users of good password practices
Good password practices are pointless if the backend database is compromised. That's like adhering to the five second rule after dropping a donut in a dogpile.
Re: (Score:1)
They're saying you shouldn't make it so your username and password from $third_party_site can log you in to Yahoo Mail.
Happens at all ISPs (Score:2, Informative)
Re:Knox not guilty of anything FU Italy (Score:1)
Italy is Incredibly corrupt and the dead woman's family believes Knows should die. However they don't have the means too get to her. This is why double jeopardy is in the constitution.
Among the funny things ... (Score:5, Informative)
... is why suddenly yahoo is making a show of caring.
I have a four-letter yahoo account (not that kind of four-letter word...) from waaaaay back in the day. It was something I maintained for about two decades for plausible deniability... a cut-out.
SCORES of people have tries to hack it. A couple have succeeded, but not since I switched it to a 32-character mixed-case-and-special password. Still, they try at the rate of about 3 a week (that I *see* via attempted password-reset manipulations, 2-factor authentication change attempts, etc).
But ... I have received about 10 emails from folks who wanted to 'own' the email address. And -- I think -- because I didn't acquiesce, I have received hundreds of thousands of spam emails in the intervening time. They've submitted my email to stupid dating sites in French, German, Thai, Spanish, Tamil and most recently Hebrew. Hell, I got 1000+ emails/day from ONE SITE for a few days, about a week ago.
There's been phishing, spear-phishing based on the pseudo-identity hosted there, blind newsletter sign-up. Every kind of crap you can imagine, and several more.
And every step of the way, I reported the infringements, the spamming, the users who have a variant of the name (e.g. foo2525 instead of foo): to the spam-handlers and to the variant-users.
And yahoo has never given a shit. Not once. Period. IMHO, 'cause it was one account-holder. But I've kept it anyway -- since it's a great cut-out. And I'll continue to do so. Yahoo is a joke; has been for many years now. Sometimes... that's its value. It's a great example of what NOT to do, and it's a great revealer of the seedy underbelly of the 'net.
http://demotivators.despair.co... [despair.com]
Re: (Score:3)
And frankly, that's as it should be. If you lucked into an especially desirable account name, it's not Yahoo!'s responsibility to keep people who want to buy it away from you. And reporting people who have a variant? Seriously? Unless it's a trademark or copyright issue, you have precisely zero leg to stand on. Yahoo! isn't responsible for your sense of self entitlement.
Meanwhile, I've had a Yahoo! account for de
Re: (Score:1)
RTFMessage. To be clear, I wrote that I reported folks who used a variant to the variant-user. e.g. send email as foo@yahoo.com instead of foo2525@yahoo.com and I get the email reply, I sent it on to foo2525 with a note that they used the wrong email. Of course, the correct email has to be indicated somewhere, or I have no way ...
My mistake was not adding ", respectively" to the sentence.
Glad to see you got your exercise today, jumping to conclusions.
Are you hallucinating? (Score:1)
To be clear, no you didn't write any such thing. You didn't write anything even close to such a thing.
Your mistake isn't that you didn't add "respectively", it's that you're a clueless moron who not only didn't read what he wrote, but for 'reporting them to Yahoo' and bel
Learn English (Score:1)
Amazing. I restrained myself and didn't call out your ignorance, since I tend to use rather complicated sentence construction. You failed to learn when hit with the clue-stick.
So hey, let's play...
The sentence read "I reported the infringements, the spamming, the users who have a variant of the name (e.g. foo2525 instead of foo): to the spam-handlers and to the variant-users." Let's dissect this.
The disingenuous would read this to mean I reported everyone to the spam-handlers *and* the variant-owners. T
Re: (Score:1)
Re: (Score:1)
Close... It's qwer@yaho^H^H^H^HH^H^H^H^H Ha. I'm not so foolish ... what do you mean that crtl-H doesn't delete anymore? ...
Re: (Score:1)
Last night's spam email was probably the cause (Score:4, Informative)
A spam email that went to the Inbox stating that Yahoo! was going to close all inactive accounts if you did not click on this link and log in was probably how the attacker got the passwords. The link went to one of those off-shore URLs that we should all avoid.
Phishing is still alive and well.
And there are a lot of gullible people to phish for.
Re: (Score:2)
My mom got that one. Fortunately, she called me first BEFORE she did anything about it.
Re: (Score:2)
I think that was just the usual background phishing that's always going on.
On the 19th I got a legitimate Yahoo sign-in alert for an account I had forgotten about and not used for the better part of a decade, with the only activity being a "Yahoo! Partner's Application" login. I'm guessing this login was part of this attack.
Tumblr? (Score:2)
Really? This is how businesses are delivering their security announcements?
Re: (Score:1)
Nah they will just announce in the white house press room and the feeding frenzy will begin.
Re: (Score:1)
I am curious why it wasn't on their main news page.
Re: (Score:2)
It sounds like an external password database was hacked and all the usernames + 'yahoo.com' and the matching passwords were tried against Yahoo Mail.
It doesn't seem like Yahoo could have done anything more about this. It is a case of password reuse [xkcd.com], not Yahoo's password storage.
Right. Evidently it's easier to go for knee-jerk Yahoo bashing than to read TFA. I wonder if the folks who do that also save time and energy by reusing passwords? ;-)
They still exist? (Score:1)
Yahoo mail has always been a one off disposable email to me, and answers.yahoo is just silly, who would post something there when you can just Google it, not to mention virtually every answer that I have seen get "modded up" as best has been incorrect.
Interestingly, using it to sign up for a site recently I noticed they wanted my phone number with a promise to "keep it secure" next to the number space.
Oh Yahoo... (Score:2)
via Tumblr? (Score:2)
WTF is that and why did Yahoo think I would see it?
I'm using two-factor ID... (Score:2)
I changed my PW to a machine-generated chunk of gibberish, and turned on 2-factor ID.
Re: (Score:2)
I think you'll find that the comment section of that news website is run by Disqus.com. It's not the news site that got hacked. Disqus.com got hacked.
Phone Number Requirement for Account (Score:1)
weak password yahoo horse shit (Score:1)
Yahoo will probably issue themselves a "best of the web" award to compensate for the inconvenience.
Such douchebaggery.
Must have been Disqus.com data leak (Score:2)
I received the Yahoo password notification (cell phone text) for a Yahoo account that I set up only for the purpose of making comments on Disqus sites.
I had to change the password from something simple to something obtuse in order to login. The sent folder is still empty, since I have never sent a single email from that account. Since I have never used that email account for any other site, obviously there are no password reset attempts in the inbox.
There far too many web sites getting hacked. Are the d