Yahoo security breach

[Chris S]

I've just had an email from Yahoo informing me that their systems suffered a security breach at the end of 2014. They've also advised me to:

• Change your password and security questions for any other accounts on which you used the same or similar information used for your Yahoo account.
  
  
• Review your accounts for suspicious activity.
  
  
• Be cautious of any unsolicited communications that ask for your personal information or refer you to a web page asking for personal information.
  
  
• Avoid clicking on links or downloading attachments from suspicious emails.

I think they're about 2 years too late.

 

[Andrew_Culture]

It's weird that it's taken two years!

Here's hoping Altavista and HotBot aren't holding back any info like this

 

[Keith Oates]

I've been having some weird things going on with Yahoo lately.!!!!!!!!!!!!!!!!!!!!!

 

[classic33]

Is the e-mail the first of a series of false ones? Not had that one yet.

 

[Chris S]

No - it's now in the news:
https://www.theguardian.com/technology/2016/sep/23/yahoo-questinos-hack-researchers

 

[Tin Pot]

It's weird that it's taken two years!

Here's hoping Altavista and HotBot aren't holding back any info like this

It's actually very common.

Most breaches are discovered by third parties, and are more than six months after the event.

Assume every company you interact with has been breached.

 

[classic33]

No - it's now in the news:
https://www.theguardian.com/technology/2016/sep/23/yahoo-questinos-hack-researchers

It was in the news earlier this year as well.

 

[Tin Pot]

It was in the news earlier this year as well.

I believe August was the first indication.

 

[keithmac]

I had a lovely spam free email address for 10+ years before a company too lax in their data security manged to advertise it to the nation.

Why can't email addresses be encrypted as well as the passwords when signing up?.

 

[Tin Pot]

I had a lovely spam free email address for 10+ years before a company too lax in their data security manged to advertise it to the nation.

Why can't email addresses be encrypted as well as the passwords when signing up?.

You mean in storage?

Email addresses are public information, otherwise they wouldn't work.

The other companies have also been breached, they either know it and have been in the news or they don't know it yet.

 

[keithmac]

You mean in storage?

Email addresses are public information, otherwise they wouldn't work.

The other companies have also been breached, they either know it and have been in the news or they don't know it yet.

Yes in their own databases.

 

[classic33]

I've been having some weird things going on with Yahoo lately.!!!!!!!!!!!!!!!!!!!!!

I keep on getting e-mails from Scooosh, telling me I've got an iPhone 7 to collect.

 

[jefmcg]

Email addresses are public information, otherwise they wouldn't work.

That's not true. You can send an email to <anything>@company.com. The company can then decide what to do with that email. They can bin it silently, they can return it to you with an error message, they can route it the recipient. They can forward it on to a different address. There is no need for email addresses to be public.

(I run my own server and accept any mail addressed to it. I don't have to publish a list created by infinite monkeys of all possible email address.)

 

[r04DiE]

All of you need to use Tutanota. And that is all.

Or when signing up for shopping and stuff, you should be using MailDrop, or similar.

 

[jefmcg]

Yahoo's security people are morons. I had several accounts with them, and didn't answer the security questions (or just put in a random sequence of letters) so I wouldn't create a back door to my accounts, as I was not going to lose the passwords. So later on I tried to get back into my account. If I had lost the password, I could have used the security question to reset the passwor. However, even though I still had my password it wouldn't let me back into the account until I answered the security question. So I couldn't log back into the account despite having the password, but (assuming I had answered the security question honestly) an acquaintance could as long as they knew where I went on my honeymoon - and most people post that on facebook these days.