3

So Yahoo was hacked by a state sponsored attacker, and half a billion credentials were compromised. These credentials also allow access to the OpenID network, which is one of the ways you can login to the Stack Exchange network.

So, what happens next? Does this affect the network in any way? If so, what will we do about it?

  • "Yahoo was hacked by a state sponsored attacker", incidentally, this claim has yet to be verified by any credible 3rd-party source, and must be viewed with considerable skepticism. – Alexander O'Mara Sep 23 '16 at 23:35
4

From what I have read no credentials were saved in plain text, as you might expect from a company as Yahoo. Hashed credentials were compromised, so that means that if you have the salt, a password dictionary and a lot of CPU time available, you can gain access to the account and all other parties that rely on their login mechanism, like Stack Exchange with the use of OpenId. Also it seems that security questions and answers were obtained, so that will mean someone else can reset your password with that information.

That means they can also gain access to your Stack Exchange account. If you use Yahoo, you should definitely change your credentials. Since the hack was two years back, any password change the last two years should have been sufficient.

Should SE block all Yahoo logins? I am not sure about that. Is the risk acceptable considering the costs? If SE would block those accounts, it would require to manually reset each and every account. Not sure if that is a good idea. Also the hack was years ago, so any potential hack should already have taken place by now. I didn't notice anything, maybe SE did.

  • 4
    It's also worth noting that the breach itself occurred two years ago - it was just only disclosed recently. Who knows what all has already happened in that time, if anything. – animuson Sep 23 '16 at 19:27
  • Good point. If something would happen we should already have seen it by now. Maybe SE wasn't too interesting for them. – Patrick Hofman Sep 23 '16 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .