Yahoo! Mail! users! change! your! passwords! NOW! Yahoo! is urging users of its Mail service to change their passwords to something secure and unique to the web giant – after a security breach exposed account login details to theft. The company said that it has reset the passwords on accounts connected to what it termed a "third-party database compromise" – that database …
Bet it was Sky. The email account security for them is the worst.
Having once worked for them, I had a customer who was complaining because when he logged int his account for the first time, he was forced to reset his password, and found 24,000 emails dating back several years. Which he had proceeded to delete.
He had been a sky customer for 10 days.
He had actually accidentally hacked another users account because they shared a name and taste in football teams.
He did not want to accept the fact that he had broken the law. He was also unhappy that some other person kept trying to change the password back again.
My forehead met the desk several times over that conversation before i passed the whole mess over to a manager to escalate to the appropriate people.
He did not want to accept the fact that he had broken the law.
That's probably because based on the facts as you presented them he hadn't. There are no strict liability offences in the Computer Misuse Act so you have to establish mens rea (essentially deliberate intent) in order for it to be a crime. The scenario you describe falls far short of that.
You should use a password manager to remember most of those account passwords (with long randomly generated passwords), then you only have to remember the important ones (online banking, etc) and the password for the password manager.
The way I deal with passwords is to treat them like nouns that describe a new thing. Like say, my (non-existent) ¡¡¡Yahoo!!! account is associated in my mind with the (pass)word "J8&都帶ѕ"É//rť|¹çሰS❦27" (without quotes).
Simple really. The only problem is I can never remember if the 'ѕ' is a Latin or Cyrillic one.
Yes, I'm routinely forced to dumb down my passwords to accomodate for the dimwitsenforcing this kind of rules. Worst thing is, there is no chance in hell of me remembering the resulting mess of mixed-case number-and-symbols-containing nightmare, so I have to write it down somewhere, making it all the more, erm "secure". Not that it matters anyway, as any decent rig would crack it in roughly 12 seconds, due to these rules not being fit for secure password generation.
Not that anyone would want access to my Yahoo accounts of course: I give them away to spam-spaffing outfits exclusively. Interestingly, that includes the US' Customs and Border Protection (every once in a while you bump into a zealot deskjockey who insist the "email" field in these forms must be filled; invariably this is followed by a few hundred spam messages being sent to the addy over the next week. Not too bad, as spammers go, but you'd think the US government wouldn't sell their databases to penis enlargement pills outfits. And you'd be dead wrong).
The other problem with all these bloody passwords one has to manage is that the average phone keyboard is only marginally usable at best. Pressing extra alt and capital keys between numbers, letters and uppercase is a complete pain and hard to do accurately. Thank you Blackberry Torch with an onscreen keyboard incompatible with adult european male fingers -- or a tiny slide out one with a substantial ridge around it that makes number entry a contortion.
I don't have a lot of trouble generating the passwords. Remembering them is a whole other story.
What I find more annoying is that some sites change the rules on what needs to be included, so my the passwords with that level of complexity which I routinely generate don't always work. Because some silly site (Yahoo!) won't allow you to use symbols in your password. The worst is WebEx where they have about 4 symbols that are allowed. So the resulting password is always complete jibberish. Also annoying in this story is that the third party is not named. They should be. I only use my Yahoo account for things I expect to be spammed on, so it isn't overly important to me. I did use the same password on a throwaway FB account just so I could keep track of the FB account pw. I don't actually care about the accounts per se. I just don't want them being used to hack other people.
"you'd think the US government wouldn't sell their databases to penis enlargement pills outfits"
Errm... large portions of the US Gov _are_ penis enlargement outfits. <exits, humming the :Marine Corps Hymn", especially the part about "If the Army and the Navy ever gaze on heaven's scenes, they'll find the streets are guarded by United States Marines". You can't make this stuff up.>
This post has been deleted by its author
I'll read the Daily Mail by choice before I use Yahoo for...fucking anything, thankyouverymuch.
:-)
Steven R
(for our international commentards - the Daily Mail is like the Weekly World News, or other schlocky, lie-filled, made up tabloid rag in your locale, except it passes itself off as a real newspaper. And even more tragically, people actually take it seriously)
Hello, anybody read the article ?
>Yahoo! is urging users of its Mail service to change their passwords to something secure and unique to the web giant – after a security breach exposed account login details to theft.
>The company said that it has reset the passwords on accounts connected to what it termed a "third-party database compromise" – that database contained records on some of Yahoo!'s users.
This is so bad, really, soooo bad practice it beggars belief ...
1. What are clear text passwords doing in a database?
2. Worse, WTF is a third party doing with account details .... in clear text ???
As Linus says, the security guy at Yahoo should be shot.
Doesn't sound like Yahoo did anything wrong. If anybody should be shot, it's the users who used the same password on multiple sites. And there's no evidence that clear-text passwords were stored anywhere. Software like John the Ripper and hashcat will make short work of salted and hashed password files.
A completely separate service to Yahoo has had their database hacked, Yahoo have obtained a copy and flagged the Yahoo mail accounts in the hacked database as accounts which must to change their password as many people use the same password for everything. If as soon as you log into Yahoo you are forced to change your password then you're affected otherwise you're not affected.
In other words the headline in El Reg is wrong and would be something much more serious.
As much as I like to stick the boot into Yahoo, they seem to have done things properly this time, apart from telling everyone via Tumblr when it should be via their login screen.
I still wouldn't trust Yahoo with my mobile number for 2FA though.
The link provided in the article is to a tumblr blog entry. I can find nothing on the Yahoo site (at least not as obvious as it needs to be), so how does Yahoo expect us to know about the problem if we don't subscribe to the likes of The Register?
Is it meant to be under the omg! menu?
Is it meant to be under the omg! menu?
In the 'states' there is a syndicated 'media show' (IIRC OMG! The Insider) that is partnered with yaHOO!, perhaps that is where they should have publicized it.
It is quite likely more important than the latest antics of Justin Bieber.
I cant think of a single reason, why a third party firm should be given a list of Yahoo's users email addreses, let alone giving them the users email addresses PLUS the passwords. Honestly, can anyone tell me even a single reason that would happen? Anyone?
(and lets not go into the fact it seems to have been done in plain text, which is frankly gobsmacking!)
Sally has an account with Yahoo. She doesn't have much of an imagination, and uses the name of her dog as a password. She then downloads a new version of some Adobe product, which requires registration. So she supplies her yahoo email address and, foolishly, the same password that she uses for that account. When the Adobe database is hacked, the attackers know that this sort of behaviour is rife and they use the Adobe details to try and break into the Yahoo account. Chances are good that they'll succeed with a moderately high proportion of users. Yahoo were not at fault in this scenario
If what you say is true, then it won't be a Yahoo-only problem. The same issue would be faced by hotmail, Google etc.
It is rather unclear, but there do not seem to be reports of that happening.
If it is only Yahoo that are having the issue, then there is some smoke being blown up donkeys.
I also immediately thought "hey, opportunity grab !".
It is telling that Yahoo! adopts the same strategy as Google for grabbing you phone number.
Unfortunately for them, I'm not giving Google my number because the less it knows about me the better I feel, and I certainly won't be giving it to Yahoo! because I find it even less trustworthy than Google.
Google may be an evil, all-watching Internet overlord, but at least it is an efficient one. Yahoo! just looks like a bunch of confused amateurs next to the Big G.
We read so much about the importance of complex passwords. However I wonder how many times user IDs such as John.Smith, jsmith, user2, training, sysadmin and administrator are used. Making user IDs more complex but still meaningful will help increase security. Especially for sysadmins. I've long advocated this, but it is rarely mentioned.
Nor mine but, like you, done it anyway.
Incidentally, after resetting password was asked to supply a mobile phone number. I refuse to do that on principal because these web firms have no hesitation in flogging details (or they get them stolen).
I ignored the demand for a mobile number and simply signed out of Yahoo. Had no problem signing in with the new password.
All operating systems can and in secure settings are configured to remember x number of previous passwords and prevent you from using them again. Whether the password is encrypted or they are just checking against a hash I don't know, but it's pretty much irrelevant. At my current work location I believe they are tracking the previous 24 for both network and email accounts. Damn thing remembers passwords I don't remember having used.
I understand the reason for the check and the absurdly high number of remembered passwords. Back when it remembered the last 5 passwords we had people who would change the password 6 times to get back to their original password. Personally I'd rather those idiots were throw into the Hell of the Upside Down Sinners.
"Please change your password with the form that won't let you change your password. One line asks for current password, second line asks for new password, then click Save. So sez the instructions.
Error pops up telling you the passwords don't match.
Seriously?"
Are you using firefox by any chance?
I almost tore my hair out with this, checking and rechecking i was tapping in the right characters only to have the bloody thing moan about pw not matching.
After pissing about, changing characters, case and symbols thinking it was their shit pw system not recognising certain characters, I tried it in chrome, and it worked first time.
Dont know if its an compatibility thing with an add -on or yahoo are just shit at making websites function properly. Il go with the second option.
Yes, I anticipated this could happen. And decided beforehand that if Yahoo flucked up and locked me out I'd simply abandon the account I've had for 15 years and move to a different provider.
Luckily my password change went smoothly -- apart from their stupid demand for a cellphone number (which I ignored by simply signing out). But Yahoo remain on a short leash as far as I am concerned. Too many more screw ups and slowdowns and I'll look elsewhere.
Keepass is a brilliant piece of software. I just need to persuade the other half to use it. As for blame, there are the users using the same password on multiple sites (I am sure plenty people do it), but Yahoo! should take the majority of it for giving out users passwords (and usernames) to another company. You just don't do that, unless you're Yahoo. I have been threatening to dump Yahoo for a while, now seems as good a time as any.
Just why, exactly, was Yahoo sharing user's passwords with a third party? The only reason to have the password is if you're going to log into the account. What was that third party doing?
Regardless of the fact that it was the third party's systems that were hacked, it is an enormous breach on the part of Yahoo for even sharing passwords with that third party. The liability is Yahoo's.
Was spammed from the Yahoo! account of a friend on Tuesday, presumably one of those thusly cracked. The spam contained nothing but a hyperlink, which I entirely failed to follow. I'm guessing some exploit attempt was on the other end.
Worryingly, the following day I got three very similar spams from the webmail of a relative, but not using a Yahoo! account. This time it was AOL. Is there some link between the two?
-A.
"GIVE US URE PHONE NUMBER! U CAN TRUST US!"
Like hell.
Well, Google's been doing it for ages, it was only a matter of time until Yahoo decided they needed to sell ads to phones too.
Thing is, I don't need secure. Anyone could hack my gmail or yahoo or facebook or TheRegister accounts, and I couldn't care less, so having to jump hoops for a "strong" protection I don't need is really fucking annoying.
I suspect that this was an extremely bad breach.
One that reveals Yahoo was passing plaintext passwords over to partners.
When I logged in today I got the "suspicious activity detected on your account" message, along with "UPDATE YOUR PASSWORD RIGHT NOW NOW NOW NOW".
I had already read a headline about the compromise and I had a unique username and password on Yahoo. Otherwise I would have read the accompanying words as meaning some other site had been compromised and hackers were using that login info to abuse my Yahoo account. That's extremely sleazy. There was no apology, not acknowledgement of a massive screw-up.
Someday Britain will wake up and find that the London Financial District has been successfully migrated overnight to Lagos. Fortunately being an English speaking country business will continue uninterrupted and Abu Dabai will purchase the vacant real estate from the owners for a pittance. Britain will then apply for membership in the African Union.....
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
