News for hackers. Stuff that matters.

A comment on Yahoo hack warning: What happened and should you be worried?.

Re:Yahoo hack warning: What happened and should you be worried? by cm2187 on Sunday February 19, 2017 @05:09AM (#13679012)
How could someone forge a cookie after stealing the source code? Did yahoo use a hardcoded private key in the code? Then any developer at yahoo could have broken into an account. That cannot be right.
[ Parent | on HN ]
Re:Yahoo hack warning: What happened and should you be worried? by niftich on Sunday February 19, 2017 @08:01AM (#13679483)
It doesn't answer your question precisely, but I asked a similar (albeit more incredulous) question a few months back [1] and got a thread full of educated speculation from current and former Yahoo devs.

[1] https://news.ycombinator.com/item?id=13180234

[ Parent | on HN ]
Re:Yahoo hack warning: What happened and should you be worried? by Buge on Sunday February 19, 2017 @05:22AM (#13679050)
Maybe the cookie generation had some sort of vulnerability (such as length extension) and looking at the source code helped attackers locate it and exploit it.
[ Parent | on HN ]
Re:Yahoo hack warning: What happened and should you be worried? by street on Sunday February 19, 2017 @07:01AM (#13679304)
Yup, perhaps they put the username of the logged in user in an encrypted/signed cookie, and the private key was in the source code.
[ Parent | on HN ]