News for hackers. Stuff that matters.

A comment on Yahoo discloses hack of 1B accounts. Parent comment

Re:Yahoo discloses hack of 1B accounts by pbhjpbhj on Wednesday December 14, 2016 @07:27PM (#13181143)
> The problem was that the security team had to go head-to-head with the budget team. //

Wouldn't engineers at such a big corp whistle-blow such incompetent decision making?

Apparently [1] they had a $1.37B net income in 2013. Given using bcrypt with a Blowfish hash and salting was pretty much a de facto standard by that point (I think that's what Wordpress were doing, hardly revolutionary security work) it seems the relative cost for Yahoo was approximately zero.

All I can imagine is that those in control were asked to leave the system open for government snooping? Why else would engineers working there not [anonymously] bring this to press attention - "hey, Yahoo security amounts to a piece of sticky tape holding a bank-vault shut".

- - -

[1] http://www.marketwatch.com/investing/stock/yhoo/financials#

[ Parent | on HN ]
Re:Yahoo discloses hack of 1B accounts by danielweber on Wednesday December 14, 2016 @09:20PM (#13181812)
It's not that hard to implement something at the start. It's more work to retrofit it on top of an existing system in a way that doesn't reduce the total security.
[ Parent | on HN ]