-1

What can a Yahoo user do about this?

http://arstechnica.com/security/2016/12/what-can-you-do-with-a-billion-yahoo-passwords-lots-of-bad-things/

What can you do with a billion Yahoo passwords? Lots of bad things

Now, Yahoo user data could be behind scores of spear-phishes or other breaches.

Obviously, my passwords should get changed, and 2FA enabled but is there anything specific I should do to mitigate this problem?

SDsolar
  • 977
  • 1
  • 6
  • 25
  • I see that Verizon is already reacting to this news: http://arstechnica.com/business/2016/12/verizon-skittish-about-acquisition-again-after-yahoo-hacked-again/ In wake of billion-account hack, Verizon reportedly not so hot for Yahoo – SDsolar Dec 19 '16 at 00:13
  • Also see that this was a second hack of Yahoo: http://arstechnica.com/security/2016/12/yahoo-reveals-1-billion-more-accounts-exposed-and-some-code-may-have-been-stolen/ Yahoo admits it’s been hacked again, and 1 billion accounts were exposed That's a billion with a b—and is separate from the breach "cleared" in September. – SDsolar Dec 19 '16 at 00:15
  • 4
    You should change not only passwords in the Yahoo account, but also all accounts where you have reused the same password. – Lie Ryan Dec 19 '16 at 00:48

1 Answers1

4

As said in the article the damage is already done. The leakage was in 2013 and passwords were encrypted using MD5, by now most of those passwords if not all should have been decrypted. Apart from changing your Yahoo password and enabling 2FA if haven't done yet there's not much more to do

Except one thing, learn from it. Things that we should learn about it:

  • As a developer, never use fast hash functions as MD5 to store passwords
  • As a user, change your password regularly. If you use a password manager it's trivial to do, if you don't you should
Mr. E
  • 1,954
  • 9
  • 18
  • If you read the articles in the comments you will see this is another breach, just a few months ago. Maybe by the same people that did it in 2013, maybe not.. And the passwords aren't nearly as dangerous as the addresses themselves. It provides a target-rich environment for spear phishing. – SDsolar Dec 19 '16 at 05:14
  • I totally agree about the password manager. I use one, and so am not worried about the passwords. As for gaining access to the Yahoo developers to deliver your message about hash functions, good luck. – SDsolar Dec 19 '16 at 05:16