Yahoo email accounts are hacked at a ludicrous rate.

[GoodEnough]

Yahoo email accounts are hacked at a ludicrous rate.
I know someone who has an UNHACKABLE password generator (like lastPass)
Yet, their account has been hacked several times (for spam email)

Do you think someone from the inside is selling acct data ?

 

[OverVolt]

They probably haven't updated their security since the 90's.

 

[Homerboy]

Yahoo email accounts are hacked at a ludicrous rate.
I know someone who has an UNHACKABLE password generator (like lastPass)
Yet, their account has been hacked several times (for spam email)

Do you think someone from the inside is selling acct data ?

I don't think you're using the word "UNHACKABLE" correctly.

 

[lxskllr]

I don't think you're using the word "UNHACKABLE" correctly.

Hyperbole. That helps rule out my theory that it was due to less sophisticated users. Curious what Yahoo does/doesn't do that other companies do.

 

[OverVolt]

Maybe a voodoo man in the keyboard bro stealing ur keys.

 

[ISAslot]

how do you know it was hacked?

 

[waffleironhead]

It want till just recently that Yahoo made me update my password from 5 characters to 6. Feel much safer now.

 

[Platypus]

yahoo's security team is actually pretty solid, this sounds made up or his machine is compromised in some other capacity.

also LOL @ lastpass being unhackable, do some research.

 

[ISAslot]

sounds like the spammers spoofed his address. Hacking not found.

 

[BxgJ]

Doesn't yahoo have two step auth?

 

[mmntech]

also LOL @ lastpass being unhackable, do some research.

Yep, it was hacked a few months ago. Don't think the crooks got anything useful though, but it was a PITA having to go back and change all those passwords.

Crooks can hack my Yahoo Mail account all they like. All they'll see is a crap ton of undeleted spam messages.

 

[Kneedragger]

I get those spam emails from my brothers Yahoo account all the time. I don't know what he does but it's pretty funny.

 

[Charmonium]

also LOL @ lastpass being unhackable, do some research.

IIRC, lastpass stores your pw's in encrypted blobs so unless there is someway for the hackers to get your masterpassword, which shouldn't be possible, you should be fine. Although it is curious that LP is still telling people to change their master pw.

LastPass has announced on their company blog that they detected an intrusion to their servers. While encrypted user data (read: your stored passwords for other sites) was not stolen, the intruders did take LastPass account email addresses, password reminders, server per user salts, and authentication hashes. The latter is what’s used to tell LastPass that you have permission to access your account.
According to LastPass, the authentication hashes should be sufficiently encrypted to prevent anyone from using them to access your account. However, the company is still prompting all users to update their master password that they use to log in to their LastPass account. If you use LastPass, you should do this immediately. If you share that master password with any other services, you should change it there, too. Finally, if you haven’t enabled two-factor authentication you should do that immediately here.

http://lifehacker.com/lastpass-hacked-time-to-change-your-master-password-1711463571

 

[destrekor]

yahoo's security team is actually pretty solid, this sounds made up or his machine is compromised in some other capacity.

also LOL @ lastpass being unhackable, do some research.

IIRC, lastpass stores your pw's in encrypted blobs so unless there is someway for the hackers to get your masterpassword, which shouldn't be possible, you should be fine. Although it is curious that LP is still telling people to change their master pw.



http://lifehacker.com/lastpass-hacked-time-to-change-your-master-password-1711463571

Platy, not sure what you are implying or suggesting here.
Lastpass is actually phenomenal. They have to be a pretty damn big target, and yet nobody has gotten anything of import from their servers. I think they've implemented their hashes and salts spectacularly.


Also, I think the OP was referring to a password generated using Lastpass to be "unhackable" - which is nonsense. No password itself is unhackable, which is why a password should be sufficiently complex (and long).


Length matters more these days than anything else, and I wouldn't doubt if the OP's friend uses a short password. Even if you make Lastpass create a super-complex password, if it's only 8 characters, it won't take long for a rainbow table (if I'm not mistaken) to crack it.

Length + complexity. Lastpass can't do a damn thing for you if you don't utilize it to its fullest capacity (or any random password generator tool).

Also, for Lastpass - anyone not using 2-factor should be slapped upside the head with a dumb bell. Again, that does nothing for your site-specific weak passwords, but it helps protect your main password (which I also hope is sufficiently long and complex).

 

[John Connor]

Probably lack of common sense using the Internet. Might have malware and other crap. I've had Yahoo accounts for years and never had an issue.

 

[disappoint]

Probably lack of common sense using the Internet. Might have malware and other crap. I've had Yahoo accounts for years and never had an issue that I know of.

FTFY

 

[GoodEnough]

I get a spam email from this person's Yahoo account at least once a year.

Unhackable means they have a 20 character password with every variation (symbols, caps, numerals, ucase, lcase, etc) Any Password Strength Checker will give it 100%
They change it, and it still gets hacked. I must get 20 hack spams a year ONLY from Yahoo emails. Something totally does not add up. No way this is random.

 

[XavierMace]

I get a spam email from this person's Yahoo account at least once a year.

Unhackable means they have a 20 character password with every variation (symbols, caps, numerals, ucase, lcase, etc) Any Password Strength Checker will give it 100%
They change it, and it still gets hacked. I must get 20 hack spams a year ONLY from Yahoo emails. Something totally does not add up. No way this is random.

How do you know their account has been hacked?

 

[BxgJ]

I get a spam email from this person's Yahoo account at least once a year.

Unhackable means they have a 20 character password with every variation (symbols, caps, numerals, ucase, lcase, etc) Any Password Strength Checker will give it 100%
They change it, and it still gets hacked. I must get 20 hack spams a year ONLY from Yahoo emails. Something totally does not add up. No way this is random.

Checked if they are spoofing the email address?

Btw, no such thing as a 100% strength password. Not possible by definition.

 

[drebo]

I get a spam email from this person's Yahoo account at least once a year.

Unhackable means they have a 20 character password with every variation (symbols, caps, numerals, ucase, lcase, etc) Any Password Strength Checker will give it 100%
They change it, and it still gets hacked. I must get 20 hack spams a year ONLY from Yahoo emails. Something totally does not add up. No way this is random.

Maybe you're the one who's been compromised and the spammers are spoofing your contacts' addresses to make the messages more legit-seeming.

 

[Imp]

Only account of mine -- I had all Gmail, Hotmail, and Yahoo -- to ever get hacked and used as a spambot was my Yahoo. Probably because I used it to receive garbage and never changed the password. Whatever, did a full delete a few weeks back. My few actually used accounts are all 2-step now.

 

[MustISO]

Take a look at the email header and you'll probably find that they're not coming from Yahoo but from other stolen accounts. Not sure how it's done but the spammers harvest one or more contacts. Once they have that it's simply spoofed mail that looks like it comes from them. Seen it from Yahoo, Google, Hotmail, etc.

 

[Ichinisan]

Security/recovery questions are a common vulnerability. Change them.

 

[GoodEnough]

How do you know their account has been hacked?

Umm, b/c my friend is probably not trying to sell me discount prescription drugs?

 

[GoodEnough]

Checked if they are spoofing the email address?

How do I do this?