Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Yahoo Mail Passwords: Act Now
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
joe9804
50%
50%
joe9804,
User Rank: Apprentice
6/23/2018 | 6:47:27 PM
I want to share my personal experience.
After watching your article I want to share my personal experience with you guys. Some days ago I was a yahoo mail user. But I don't know how one day my account was hacked. I searched for Yahoo support in the Google and found some company. One of them is Yahoo Support Number. I called them but they didn't solve my problem. Then I contact some other support but no one can recover my account. Then I can understand that the problem is in Yahoo itself.
M_Gordon
50%
50%
M_Gordon,
User Rank: Apprentice
2/3/2014 | 1:08:32 PM
Re: Password managers
Kristin,

You should check out LastPass, it's a really useful password manager. It allows to use many different and strong passwords without having to remember each one. They also have an security add-on option, Toopher, which adds another layer of security to each of your accounts in LastPass. It's extremely user friendly and uses location awareness of your smartphone to automate the authentication process. Check out this video, it helped me better understand what Toopher does. http://www.youtube.com/watch?v=k78xDTpy7PU
Susan Fourtan
50%
50%
Susan Fourtan,
User Rank: Apprentice
2/3/2014 | 6:00:59 AM
Re: Password managers
Kristin, 

"I choose the option to have my browser remember most of my passwords, too. But it's the worst when you're required to clear cookies and other settings for some reason and all your passwords are cleared. Password hell all over again."

I know! I went through password hell this past weekend. I had to reset my FB password, which is always easier that trying all the password formula alternatives and all the possible combinations I can think of I used for a FB password.

I am still waiting one my online libraries to send me a new password. :( 

-Susan

 
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
2/3/2014 | 1:45:14 AM
Re: Password managers
The best practice to my experience is using the same password with sufficient complexity for all your internet accounts. This sounds nothing new but sometimes it's difficult to handle it in this way due to various constraints from different web sites. Furthermore, I normally chose not let web browser to remember my password - it does not take me long to enter the password everytime and it helped me to remember it. 
Kristin Burnham
50%
50%
Kristin Burnham,
User Rank: Apprentice
2/1/2014 | 9:20:08 AM
Re: Password managers
I choose the option to have my browser remember most of my passwords, too. But it's the worst when you're required to clear cookies and other settings for some reason and all your passwords are cleared. Password hell all over again.
jgherbert
50%
50%
jgherbert,
User Rank: Apprentice
1/31/2014 | 9:51:24 PM
Re: Password managers
@Shane M. O'Neill:

"I don't trust that a password manager can't be hacked. So I continue on in the living hell that is memorizing passwords and keeping them on a piece of paper hidden in my house. "

That's _so_ 1980s. Anybody with any self respect would use Post-Its stuck to their monitor, surely?

I must confess that I am about at explosion point with passwords, especially with every site having different requirements for password strength. SSO has issues but I gotta tell you, right now I am all about some kind of federated SSO across web sites. 

I do use a password manager by the way, but there isn't a single product that I've yet found that works consistently across (in my case), windows, linux, OSX and iOS, and integrates with the web browser so that I don't have to jump between applications all the time to find and then paste in a password. Especially on a smartphone that's a huge pain.

 
Susan Fourtan
50%
50%
Susan Fourtan,
User Rank: Apprentice
1/31/2014 | 6:37:16 PM
Re: Just one password?
anon, 

"The likely culprit in this case of Yahoo was probably not a very secure site."

Exactly. Yahoo! Mail has never been secure. It has had plenty of hacking problems. I am not surprised about this new one at all. 

-Susan
Susan Fourtan
50%
50%
Susan Fourtan,
User Rank: Apprentice
1/31/2014 | 6:26:00 PM
Re: Password managers
Kristin, 

I can see how the habit of using the same password for multiple sites could have started for many.

If you have to sign in to ten, or more sites daily you may well forget some of the passwords. One password for all can solve the problem. It brings others, as we know. 

Chrome offers the option of remembering passwords. I choose this option to certain sites. Some other times I ask for a new password. This is handy for sites I don't use frequently. It's faster and easier than trying to remember a password I use a few times a year. 

For the important passwords I don't use a password manager at the moment. I have a password formula. 

-Susan 
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
1/31/2014 | 5:01:29 PM
Re: Just one password?
I'm not sure it's better, but if I need to create an insanely complex password to protect my password manager, why not just use that insanely complex password everywhere and save myself the trouble of the password manager?
anon7244892334
100%
0%
anon7244892334,
User Rank: Apprentice
1/31/2014 | 4:47:27 PM
Re: Just one password?
Yes of course, but the probability that someone will hack your password manager versus hacking any of a multiple of sites/accounts where you're using the same UN/PW is substantiall lower.  The likely culprit in this case of Yahoo was probably not a very secure site.
Page 1 / 3   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17098
PUBLISHED: 2020-09-30
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior version...
CVE-2020-15731
PUBLISHED: 2020-09-30
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448.
CVE-2020-5132
PUBLISHED: 2020-09-30
SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision vulnerability. When the users publicly display their organization’s internal domain names in the SSL-VPN au...
CVE-2020-15216
PUBLISHED: 2020-09-29
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revisio...
CVE-2020-4607
PUBLISHED: 2020-09-29
IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.