Yahoo security breach

[jefmcg]

Oh, god. Just remembered signing up for a yahoo email account circa 2000. Back then I used phone banking, and the only id they required (after your name and account number) was date of birth and mother's maiden name. Yahoo seriously asked for the same information when creating my account, which would be a huge security risk. i didn't give that information (I never give date of birth accurately, unless it's something that really needs accurate identity, like bank account or NHS).

How is Yahoo! even still a thing?

 

[classic33]

Never asked for D.O.B. when setting up the e-mail account.

 

[jefmcg]

Never asked for D.O.B. when setting up the e-mail account.

Then you have never signed up for a yahoo account, because they did it in 2000 and they are still doing it now.

(facebook and gmail also ask for DOB and gender, neither is optional and facebook insists on binary gender)

 

[classic33]

Then you have never signed up for a yahoo account, because they did it in 2000 and they are still doing it now.

View attachment 145173

(facebook and gmail also ask for DOB and gender, neither is optional and facebook insists on binary gender)

One I went to last night, and had since 2002, must be a false one then.

 

[Tin Pot]

That's not true. You can send an email to <anything>@company.com. The company can then decide what to do with that email. They can bin it silently, they can return it to you with an error message, they can route it the recipient. They can forward it on to a different address. There is no need for email addresses to be public.

(I run my own server and accept any mail addressed to it. I don't have to publish a list created by infinite monkeys of all possible email address.)

How do people know what address to send email to to get it to the right recipient?

 

[Tin Pot]

Yes in their own databases.

Because the email address is not sensitive, it's public information - like your street address.

The encryption of the passwords is the right solution, it's just that people rarely do it properly because they don't understand cryptography but more importantly they don't understand or
spend money on key management.

 

[Andrew_Culture]

It's actually very common.

Most breaches are discovered by third parties, and are more than six months after the event.

Assume every company you interact with has been breached.

Yup, my server got hacked and I only stumbled upon the hacker by chance. The little 'erbert got convicted though http://lawsie.blogspot.co.uk/2011/05/how-i-was-hacked-and-how-justice-was.html

 

[ufkacbln]

There is an American program called "Person of Interest"

In one episode there is a discussion on Social Media:

REESE
I've never understood why people put all their information on those sites. Used to make our job a lot easier in the C.I.A. (takes another sip from his cup)

FINCH
Of course, that's why I created them.

REESE
You're telling me you invented online social networking, Finch?

Reese stands up. Finch goes to his computer, setting down his doughnut.

FINCH
The Machine needed more information. People's social graph, their associations.
(opens up search on social networking website for "Jordan Hester")
The government have been trying to figure it out for years. Turns out most people were happy to volunteer it. Business wound up being quite profitable, too. Unfortunately, Jordan Hester seems to be more cautious than most, but I was able to run a credit check.

Reese looks at papers on glass board. Finch picks up his doughnut again.