Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Yahoo Encrypting Data In Wake of NSA Revelations

samzenpus posted about 8 months ago | from the protect-ya-neck dept.

Yahoo! 137

Nerval's Lobster writes "Following reports that the NSA aggressively targets Google and Yahoo servers for surveillance, Yahoo is working to encrypt much of the data flowing through its datacenters. 'As you know, there have been a number of reports over the last six months about the U.S. government secretly accessing user data without the knowledge of tech companies, including Yahoo,' Yahoo CEO Marissa Mayer wrote in a Nov. 18 blog posting. 'I want to reiterate what we have said in the past: Yahoo has never given access to our data centers to the NSA or to any other government agency.' In order to make Yahoo's systems more secure, she added, the company is introducing SSL (Secure Sockets Layer) encryption to Yahoo Mail with a 2048-bit key. That security measure will supposedly be in place by January 8, 2014. Beyond that, Yahoo plans on encrypting all information that moves between its datacenters by the end of the first quarter of 2014. Around that same time, the company will give users the option to encrypt all data flowing to and from Yahoo; it will also 'work closely with our international Mail partners to ensure that Yahoo co-branded Mail accounts are https-enabled,' Mayer wrote. (While it's not a crushing expense for massive companies such as Yahoo, introducing this sort of security does add to infrastructure and engineering costs, and takes time to actually put in place.)"

cancel ×

137 comments

Which Encryption Scheme is Safest? Can we tell? (4, Interesting)

Press2ToContinue (2424598) | about 8 months ago | (#45457697)

Not mentioned was which encryption schemes Yahoo is considering. Maybe it's simply HTTPS, but is that good enough? Are there other possibilities?

Since the NSA has backdoored encryption schemes in the past, how can Yahoo determine if the scheme they implement is actually going to prevent the NSA from decrypting it? It's a serious question, and you can patly answer "you can't", but if I were responsible for implementing this scheme, this is the question I would pose to the team and require some sincere digging because it would be an even bigger embarrassment to implement the encryption, and then read another Snowden-esque revelation showing it was for nothing, and I was made a fool of.

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45457727)

Not mentioned was which encryption schemes Yahoo is considering. Maybe it's simply HTTPS, but is that good enough? Are there other possibilities?

Since the NSA has backdoored encryption schemes in the past, how can Yahoo determine if the scheme they implement is actually going to prevent the NSA from decrypting it? It's a serious question, and you can patly answer "you can't", but if I were responsible for implementing this scheme, this is the question I would pose to the team and require some sincere digging because it would be an even bigger embarrassment to implement the encryption, and then read another Snowden-esque revelation showing it was for nothing, and I was made a fool of.

And probably fired for wasting company resources but hey, I'm sure the NSA will at least give you a medal.

Re:Which Encryption Scheme is Safest? Can we tell? (4, Funny)

Jeremiah Cornelius (137) | about 8 months ago | (#45457915)

Yeah. SSL/TLS. That's just as effective against a determined state actor, with access to the telecommunication infrastructure [wikipedia.org] , as a Kleenex Condom.

"You don't need to see his papers. This is the certificate you are looking for..."

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45458083)

Wait, are you saying Kleenex Condoms do not leave me invulnerable to viral infections? I was kind of betting on that. Damn.

Re:Which Encryption Scheme is Safest? Can we tell? (2)

MooseTick (895855) | about 8 months ago | (#45458099)

Will a Kleenex Condoms protect me from a man in the middle?

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45458197)

Well, that would be stretching it... Maybe the two-layered kind will hold.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Jeremiah Cornelius (137) | about 8 months ago | (#45459021)

That depends if you are topping him.

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45461861)

No, but if the man in the middle is clean and healthy it could protect YOU!

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45458347)

Uh.. they need more than just access to the infrastructure. They would need the ability to sign their own certificates with a valid (or stolen) key. They may or may not have that, but saying that access to the infrastructure itself is all that is required is incorrect.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Jeremiah Cornelius (137) | about 8 months ago | (#45459007)

No. They'd only need to control DNS for completely bogus keys.

Now. How'd they pull that off?

Beside which, getting real private keys hasn't been hard for them, it seems. Got PEM?

USE A HOSTS FILE...apk (0)

Anonymous Coward | about 8 months ago | (#45460263)

Jeremiah Cornelius - MAYBE you should "use" my HOSTS file!

APK

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Bert64 (520050) | about 8 months ago | (#45461639)

And do you trust all the ssl certificate authorities? How many of those are based in the US and thus fall under the jurisdiction of the NSA? Come to think of it so does yahoo, who's to say the government wont simply demand that they hand over all their keys?

Re:Which Encryption Scheme is Safest? Can we tell? (2)

Doug Otto (2821601) | about 8 months ago | (#45457731)

This protects them from a "man in the middle" how?

If the government has the keys it doesn't matter how many bits they use.

cop with a warrant (2)

globaljustin (574257) | about 8 months ago | (#45459683)

+1 Insightful on the "government has the keys" point...

here it is: law enforcement & NSA must have the ability to access anything, given proper rights & proceedures

no one can make successful counter-point...all arguments are arguments over ***under what conditions*** the LE/NSA can access the information

Yahoo is doing absolutely nothing other than PR 'damage control' by manipulating the facts with this news.

Yahoo will give up **anyone's** data as fast as humanly possible when asked by a legal authority and this news changes nothing about that.

the speed at which LE/NSA can access our data under legal order is simply a **question of IT engineering**

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45457755)

it could be rot13 for all they care..this is just a marketing announcement

Re:Which Encryption Scheme is Safest? Can we tell? (5, Informative)

Shakrai (717556) | about 8 months ago | (#45457809)

Not mentioned was which encryption schemes Yahoo is considering. Maybe it's simply HTTPS, but is that good enough

HTTPS isn't an encryption scheme, it's a mechanism to establish a (theoretically) secure channel of communications. The actual ciphers to be used are negotiated between server and client, and can range from "You're kidding, right?" (RC4) to "The Federal Government claims it's good enough for Top Secret data." (AES-256)

As with everything, there's a level of third party trust (the certificate authorities) or shoe-leather (exchanging keys in person) that's required regardless of the ciphers you end up using. That's a whole different discussion though.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

erikkemperman (252014) | about 8 months ago | (#45458531)

As with everything, there's a level of third party trust (the certificate authorities) or shoe-leather (exchanging keys in person) that's required regardless of the ciphers you end up using. That's a whole different discussion though.

You're of course right in pointing out the distinction between the transfer protocol and the encryption.

I don't believe Yahoo (or any other big player) facilitate the shoe-leather alternative though, it's third party certification or nothing.

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45457913)

'As you know, there have been a number of reports over the last six months about the U.S. government secretly accessing user data without the knowledge of tech companies, including Yahoo,' Yahoo CEO Marissa Mayer

'As you know we had been openly and willfully been giving any and all data to the NSA without putting fight, we continue to be like Google and others be using PR propaganda to deny such allegations, this includes putting back doors into are servers, as well as being fully aware of the NSA's latest "tapping" schemes, but rest assured we will give the impression we will fight this by created another openly back door into giving the NSA are encryption keys, or making it known which encryption we will use to make the transition go without a hitch for both Yahoo and the NSA'

Why do they keep denying these leaks? Either these companies simply do not care or they think the general public buys into there press releases over there concern for you privacy. The part that bothers me the most is just how many people buy into there "we see and know nos'thing, NOS'THING!"

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45457919)

The encryption scheme that is best is called IPSec.

And make certain you run it in secure mode with proper cyphers, not something stupid like DES or with pre-shared keys. And only, only, trust your own central CA (ie. NOT the public CA!!), with some hardware RNG that is not connected to the network for certificate generation.

They would also have to be certain that all servers not connect to the network until after they have enough entropy to not generate guessable shared keys. In details lies the problems. Always the details!

Re:Which Encryption Scheme is Safest? Can we tell? (4, Informative)

Dahamma (304068) | about 8 months ago | (#45458053)

IPSec is no more an encryption scheme than HTTPS. Both are protocols that use authentication and encryption schemes, they just work at different layers of the stack.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

jeff4747 (256583) | about 8 months ago | (#45458089)

Modern encryption works by making it take a very, very, very long time to brute-force the encrypted data. Part of that lengthy time is the hardware involved in the brute-force effort.

The NSA has resources well beyond what are available to the rest of us - the joke is the NSA measures its computing power in acres.

Add that to large budgets to develop specialized hardware, and nice standard encryption algorithms to target with that hardware, and it's not clear that the NSA can't read everything. Encrypted or not.

Re:Which Encryption Scheme is Safest? Can we tell? (5, Insightful)

EdIII (1114411) | about 8 months ago | (#45458305)

The issue is not whether they can brute force encryption.

We already assume they have the capability of brute forcing all encryption within a reasonable time frame. Something hilariously well protected? 3-6 months.

That being said, the NSA, still only has so many units of discrete work it can perform in a given period . Now, unless you are going to try to convince me that the NSA has computing power many orders beyond the total computing power of the entire planet, it means there is still safety in numbers.

Mass. Surveillance.

That's the real game. That's the real threat to privacy and freedom. If everyone makes sure that the NSA has to waste those work units decoding a pair of testicles you sent to your best friend, the NSA is still left with picking and choosing its battles .

I'm okay with that. If the NSA really can break all of my communication and files within a week or two, but can only do it for several dozen Americans at a time during that period, we are all still protected as a whole. The NSA can still do its job. Yes, there was an original job they ostensibly are supposed to perform in my best interests.

The sheer magnitude of what would need decryption for mass surveillance makes it illogical to worry about, IF WE ARE USING ENCRYPTION EVERYWHERE AND ZERO-KNOWLEDGE 3RD PARTY SERVICES. I can't stress that last part enough.

Re:Which Encryption Scheme is Safest? Can we tell? (5, Informative)

Fwipp (1473271) | about 8 months ago | (#45458419)

Yes, that is how encryption works. But if your key is large enough, the time & energy to brute force it will take much longer than your lifespan. As an example I just googled, brute-forcing AES-128 at 10 Petaflops would take 10 quintillion years (10^18). http://www.eetimes.com/document.asp?doc_id=1279619 [eetimes.com]

The _real_ concern is that the NSA knows of weaknesses in these encryption schemes, and doesn't have to brute force it.

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45458547)

Or alternatively, the NSA knows of weaknesses that allow the message to be decrypted in significantly less time. Maybe they can decrypt a message in just a matter of weeks or months instead of bazillions of years.

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45459325)

At a private company they can just exchange one-time-pad keys and the code becomes unbreakable.

Re:Which Encryption Scheme is Safest? Can we tell? (2)

fustakrakich (1673220) | about 8 months ago | (#45460981)

As an example I just googled, brute-forcing AES-128 at 10 Petaflops would take 10 quintillion years (10^18).

Brute-forcing Yahoo's CIO at about 1 lash per second with a rubber hose won't even take 5 minutes. And a single National Security Letter will shut the whole thing down anyway.

Where's the beef?

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Bert64 (520050) | about 8 months ago | (#45461663)

The simplest concern is the way sites are authenticated by certificate authorities... Some of those certificate authorities are under US jurisdiction and thus beholden to the NSA, and others are under the jurisdiction of other governments who may well want to do the same thing.

Re:Which Encryption Scheme is Safest? Can we tell? (3, Informative)

lgw (121541) | about 8 months ago | (#45458481)

No one is ever going to brute force a 256-bit symmetric key. Even if you imagine a matrioshka brain (turn the entire energy output of a star into computation) it would take longer than the age of the universe. A 128-bit symmetric key is safe from brute force vs all realistic threats.

If the math is flawed, OTOH, or your "random" key wasn't so random, it's easy (there is deep suspicion about the RNG built into Intel procs these days).

Re:Which Encryption Scheme is Safest? Can we tell? (1)

sl4shd0rk (755837) | about 8 months ago | (#45458111)

Maybe it's simply HTTPS, but is that good enough?

No, not really. In security, you don't have infallible trust in a system which isn't verifiable -- which means, just because Yahoo says they are doing transport encryption in their data center doesn't automatically make that system trustworthy. You need proof that they have done what they said. Otherwise, it's just their word.

Secondly, Yahoo's biggest problem is the data laying on the disks. They can encrypt the traffic all they want that doesn't do anything for the mail stores on disk. Ms. Mayer is basically throwing a bunch of pointless acronyms that mean "we do HTTPS". Big whoop.

Re:Which Encryption Scheme is Safest? Can we tell? (3, Interesting)

swb (14022) | about 8 months ago | (#45458413)

Most of the SANs I've seen support disk encryption and IPSec encryption between the SAN and the host or OS talking to it. If your OS writes encrypted data to storage (encrypted filesystem) as well, you have two layers of encryption on the platter and two layers of encryption in transit.

Of course that doesn't address weaknesses in ciphers or key exchange systems, but it seems like it would make it a lot harder to get at the data because the only place it is decrypted is during interprocess communication (decrypting from the filesystem and before re-encrypting it for final transit to client).

Not that this trivializes that risk, but it seems to make it a lot tougher.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

lgw (121541) | about 8 months ago | (#45458533)

I'd be surprised if any "big data" uses SAN. I don't know about Yahoo, but Google, MS, and I'm pretty sure Amazon all use simple direct-attach storage. It's a bit silly to be worried about anyone reading the data off of 10000 servers through some backchannel without being noticed. Encrypting the links between those servers would accomplish a lot, IMO.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

swb (14022) | about 8 months ago | (#45458611)

And I would imagine that the distributed filesystems they use on those systems probably aren't even very coherent even if you could read a physical disk.

Re:Which Encryption Scheme is Safest? Can we tell? (3, Informative)

mlts (1038732) | about 8 months ago | (#45459019)

It depends on where the "brains" are. Facebook (IIRC) has the redundancy on the backend app layer where coupled with NoSQL, if something drops... there is some redundancy built in somewhere to pick it off, or drop a couple tuples, but the tables still have their integrity. Whole servers can drop off the map, and Facebook will keep going. Isn't pretty, but their model really can handle stuff getting tossed here and there.

Apple, on the other hand, uses Teradata systems with NetApp appliances on the backend, so one large cloud provider does go with the more traditional storage stack model found in the enterprise. However, unlike losing a FB post or two, a user losing chunks of their data would not be a good thing, so Apple's model tends to be more rigidly ACID compliant.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Bert64 (520050) | about 8 months ago | (#45461677)

Only a small fraction of people understand the technology enough to know that proof is required, not only proof that encryption is being used but also that its implemented correctly and the keys are securely stored.

The vast majority of people will just read the marketing literature and assume that yahoo aren't trying to mislead them. They don't understand how these things work and don't care to, they simply put blind trust in what they're being told.

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45458113)

You are presuming that this is going to be more effective than just security theatre. I think it is not much more than hoping to prevent the loss of overseas customers that suddenly are frightened of the cloud.

All of the major providers will do this, once one commits to it. As you can see, they are all starting to commit to it.

If they are truly serious about it, that will be something that remains to be seen. It may be that some are more serious than others. As you said, simply HTTPS... one can ask if that is good enough (and I would suggest that, no, it is not. HTTPS is a privacy lock, not a security lock).

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Delarth799 (1839672) | about 8 months ago | (#45458129)

Well I'm sure the 20 or so people who still use Yahoo feel very secure just knowing that Yahoo is trying to do something.

Re:Which Encryption Scheme is Safest? Can we tell? (2)

mlts (1038732) | about 8 months ago | (#45458359)

Encryption schemes are important, but whenever someone mentions "let's encrypt it", I cringe.

Encryption isn't some magic switch that you turn on and all your data is 100% secure from bad guys. What happens is that it makes a smaller chunk of data (i.e. the key or keys) the valuable part.

Key management isn't a cookie-cutter thing. Error on security, and your data can't be recovered. Error on accessibility, and the bad guys now have your keys and can get your data.

A small company can get by with burning an archival CD-ROM, as well as printing out all keys (passwords especially, but .asc files of private keys as well [1]) A bigger company would have recovery info be split up among corporate officers in a "x out of y" structure (where 3 out of 5 officers are needed to regenerate the master key.) Even larger companies would have regional managers, and far more exotic key management layouts with multiple recovery paths.

If Yahoo decides to just "encrypt it", they need to put in a good key management structure in place... and of course, that will be the prime target for bad guys [2], so it has to be worth the security payoff of keeping the eggs in one basket.

[1]: Yes, it will be hell and a half to retype in, but it will be there. Having archival media on a CD helps with that, but if bit rot nails the CD, there is always the paper copy.

Oh, and don't try utilities which print bitmaps to paper like Paperbak. I've had great look in printing them out... but scanning them in and recovering any data... absolutely zero luck whatsoever, so don't bother with those utilities as of now.

[2]: The NSA is hyped, but one major threat are blackhats who would love access to Yahoo's assets for blackmail, DDoS, extortion, or to find other people to attack.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Anonymous Coward | about 8 months ago | (#45458455)

Well,
My Guess is SSL/TLS is fine but the trust system is broken against a motivated state actor.

(forgive my terminology...it's been a while since I've delt with certificates)
1.) Steal the private key from Google, Yahoo, etc.
2.) Force a trusted certificating authority to issue a leaf/signing certificate. Then the government can issue SSL certs for Yahoo, Google, etc on behalf of that certificating authority who gave them a leaf certificate.
3.) Steal the signing certs of a root authority
4.) Setup a shell trusted certificate authority and force the browsers to trust it
The list goes on......

I've actually performed a version of #4 so I could track SSL internet usages (pharma sucks).
Essentially, a proxy decrypts the traffic, the system issues a certificate on the fly for the website (Google, Yahoo, etc) and then re-encrypts the traffic and sends it to the user.
Every machine had my proxy installed as a Certificating Authority.....Unless you looked into the certificate trust chain, you would never see it.

In the Case of Yahoo, the NSA would most likely force Yahoo to give up their key or force Equifax (their certification authority) to issue a Yahoo certificate.
Though I would place my money on the government already having a leaf/signing certificate from Equifax that the government can use against any of Equifax's customers.

Re:Which Encryption Scheme is Safest? Can we tell? (1)

Mister Liberty (769145) | about 8 months ago | (#45458719)

...how can Yahoo determine if the scheme they implement is actually going to prevent the NSA from decrypting it? It's a serious question

Yes it is. And these SE-Corps (looking at you GOOGLE!) should be much more vocal and transparent in letting the public know the predicaments they as a Corporation are in, what factors are there to consider, and their respective weights, what the options are that they're contemplating, and what their decisisions, when made, are based on.

In short -- your users may be searchers, and as such they are learners They are not dumb and will not be kept in the dark!
To NOT mention, to AVOID SUBJECT, to be SILENT, are all modes of being vocal, as a matter of fact very vocal, but prob. not in the way and having the consequences that your business model much agrees with.

Re:Which Encryption Scheme is Safest? Can we tell? (2)

bobbied (2522392) | about 8 months ago | (#45458729)

Since the NSA has backdoored encryption schemes in the past, how can Yahoo determine if the scheme they implement is actually going to prevent the NSA from decrypting it?

You have to understand that any key based encryption technique is breakable. It doesn't matter what key based technique you use, it can eventually be brute forced. All you can hope to do is make it take a very long time to decode, so long that the message becomes not worth the effort.

There are "unbreakable" techniques, but they all require a one use a random pad that both parties know, but never disclose or reuse. That's about the *only* way to make sure the NSA cannot decode your stuff. Good luck doing that Yahoo.

Re:Which Encryption Scheme is Safest? Can we tell? (0)

Anonymous Coward | about 8 months ago | (#45458893)

it doesn't matter, they gave the keys to the NSA

Re:Which Encryption Scheme is Safest? Can we tell? (1)

LifesABeach (234436) | about 8 months ago | (#45460031)

Yahoo can encrypt all it wants, it's where the data is unencrypted that the NSA would be waiting. And every other spy angency with 10 cents of common sense.

Email is insecure by design (1)

flyingfsck (986395) | about 8 months ago | (#45460265)

Normal Email is insecure by design. Yahoo cannot fix it. If you want to secure your email, then you got to do so at the end points, or quit using email.

It doesn't matter (0)

Anonymous Coward | about 8 months ago | (#45461885)

If Yahoo! sees your data, NSA can see it too. Regardless of whether they use OTP and trusted couriers with suitcases handcuffed to their wrists to shuffle the data between nodes in their data center.

For Yahoo! to capitalize on your private information, the data HAS to be plaintext at some point. That's all that's needed.

This is just smoke an mirrors. All cloud services are suspect unless you host them yourself in your own premises and have control of what is going on.

Lol (0)

Anonymous Coward | about 8 months ago | (#45457711)

As if the nsa cant blow right thru ssl.

Re:Lol (1)

dmbasso (1052166) | about 8 months ago | (#45458605)

I love how so many people here are so sure the NSA can do magic on encryption... it's like complexity doesn't exist. They can solve any problem expressible in a general formal system! Halting problem? Fuck the halting problem, that's like stealing candy from a child.

NSA - the Chuck Norris of the agencies.

Re:Lol (2)

mrchaotica (681592) | about 8 months ago | (#45458759)

It's not that we think the NSA can brute force SSL; we think the NSA has compromised the certificate authorities.

Re:Lol (2)

dmbasso (1052166) | about 8 months ago | (#45458895)

I just picked that comment because it said "thru [sic] ssl", and I interpreted as "breaking DH" or something. But I was referring to a somewhat spread sentiment that breaking encryption is just a matter of developing technique, which may not be the case (hence my sarcastic reference to the halting problem & Godel's incompleteness theorem).

Like this post above [slashdot.org] :

The issue is not whether they can brute force encryption.
We already assume they have the capability of brute forcing all encryption within a reasonable time frame. Something hilariously well protected? 3-6 months.

Re:Lol (1)

manu0601 (2221348) | about 8 months ago | (#45460283)

If you secure your own inter-datacenter links, you accept only certs signed by your own private CA, hence the compromised CA is not a problem. And even if your private CA is compromised, ephemeral DH exchange ensures stored traffic remains difficult to decipher.

Re:Lol (1)

BitZtream (692029) | about 8 months ago | (#45460887)

The DH exchange only works if you don't get Man-in-the-Middled. Thats the point. Once the certificate authority is compromised, they can create a cert that makes them appear as the server you think you're supposed to talk to, so you do the DH exchange with their server, so the DH exchange isn't a problem. Then they just make another connection on to the destination which does a whole new DH exchange for keys.

yahoo sucks a dick (-1)

Anonymous Coward | about 8 months ago | (#45457721)

i recently logged into yahoo after a year or so - it prompted me for some security question i couldn't remember. now im locked out of all my yahoo services

yahoo is a steaming piece of shit. I'm surprised people actually still use it

Re:yahoo sucks a dick (0)

Anonymous Coward | about 8 months ago | (#45457773)

Sure, Yahoo blows but it seems like you're the one who locked yourself out their services; not Yahoo.

How Is That Possible? (0)

Anonymous Coward | about 8 months ago | (#45457811)

Parent put in their correct password, which should grant authentication, and then yahoo asks for a years old security question after successfully authenticating?

Yeah, yahoo definitely shut them out. (And Sucks A Dick)

Re:How Is That Possible? (0)

Anonymous Coward | about 8 months ago | (#45458033)

i couldn't remember

I'll see your theory and raise you fact.

Re: yahoo sucks a dick (0)

Anonymous Coward | about 8 months ago | (#45457841)

MArrissa you mean? Yes please! And please someone post the XKCD or whatever of the interogator with the pipe wrench.

Re: yahoo sucks a dick (0)

Anonymous Coward | about 8 months ago | (#45457903)

There ya go: http://xkcd.com/538/ [xkcd.com]

I'm from the future, where we have google search.

Weasel words (1)

Anonymous Coward | about 8 months ago | (#45457839)

Yahoo CEO Marissa Mayer wrote in a Nov. 18 blog posting. 'I want to reiterate what we have said in the past: Yahoo has never given access to our data centers to the NSA or to any other government agency.

The operative phrase here is "our data centers". A little less than half the data centers that Yahoo have their servers in are not owned by Yahoo, they lease space there. So, Yahoo's data flows in and out of the cage(s) they have their servers in into the house network. You can work it out from there.

Re:Weasel words (0)

Anonymous Coward | about 8 months ago | (#45457955)

Yahoo CEO Marissa Mayer wrote in a Nov. 18 blog posting. 'I want to reiterate what we have said in the past: Yahoo has never given access to our data centers to the NSA or to any other government agency.

The operative phrase here is "our data centers". A little less than half the data centers that Yahoo have their servers in are not owned by Yahoo, they lease space there. So, Yahoo's data flows in and out of the cage(s) they have their servers in into the house network. You can work it out from there.

Not only that, they don't have to give someone "access to [their] data centers" to pass them data.

Re:Weasel words (0)

Anonymous Coward | about 8 months ago | (#45458115)

You missed the first weasel.. GIVE...

We didn't GIVE access to our data. They TOOK access cuz there's fuckall we can do to stop them.

-
Faces filled with joy and cheer
What a magical time of year
Howdy Ho! It's Weasel Stomping Day

Put your Viking helmet on
Spread that mayonaisse on the lawn
Don't you know it's Weasel Stomping Day

All the little girls and boys
Love that wonderful crunching noise
You'll know what this day's about
When you stomp a weasel's guts right out

So, come along and have a laugh
Snap their weasely spines in half
Grap your boots and stomp your cares away
Hip hip hooray, it's Weasel Stomping Day

People up and down the street
Crushing weasels beneath their feet
Why we do it, who can say?
But it's such a festive holiday

So let the stomping fun begin
Bash their weasely skulls right in
It's tradition, that makes it okay

Hey everyone, it's Weasel Stomping
We'll have some fun on Weasel Stomping
Put down your gun, it's Weasel Stomping Day
Hip Hip Hooray, it's Weasel Stomping Day

Weasel Stomping Day
Hey!

Business 101 (0)

Anonymous Coward | about 8 months ago | (#45457843)

If someone else's PR appears to have been written for you, use it.

Took them way too long (2)

kekx (2828765) | about 8 months ago | (#45457861)

Well, actually it's quite embarrassing that they're only doing this now...

Re:Took them way too long (1)

wrp103 (583277) | about 8 months ago | (#45457999)

Well, actually it's quite embarrassing that they're only doing this now...

I agree. It is amazing what little effort companies make to "protect" their data. They seem to think that having a password is all that is needed.

Open bag (1)

fred911 (83970) | about 8 months ago | (#45457869)

Insert cat.

She's given me 1/2 of what I want to hear (2)

GodfatherofSoul (174979) | about 8 months ago | (#45457877)

Strongly worded without PR-crafted terminology. Now, have you given these entities private information without a warrant?

don't worry (0)

Anonymous Coward | about 8 months ago | (#45457929)

yahoo will still cooperate with china when it comes to exposing dissidents.

Does it even matter... (3, Insightful)

nashv (1479253) | about 8 months ago | (#45457939)

...if they can be forced to turn over encryption keys at the whim of some NSA/government authourity?

Er...what about encryption at REST? (1)

xxxJonBoyxxx (565205) | about 8 months ago | (#45457959)

>> encrypt all data flowing to and from Yahoo

BFD - since all the data is still sitting on servers somewhere, why would this offer any protection at all?

>> introducing this sort of security does add to infrastructure and engineering costs

BFW - welcome to 2008, Yahoo.

Yahoo can't even keep spam out of my inbox (3)

JoeyRox (2711699) | about 8 months ago | (#45457975)

Whereas Google can. When I think cutting-edge technology and encryption Yahoo is the last company that comes to mind.

Re:Yahoo can't even keep spam out of my inbox (3, Interesting)

Dahamma (304068) | about 8 months ago | (#45458093)

While I would have agreed with you two weeks ago, bizarrely, I have recently started getting a ton of spam in my Gmail account - really obvious stuff that should have been filtered. And Yahoo has been almost perfect filtering the same crap. Several people I have talked to have noticed the same thing. It's almost like someone at Google accidentally turned off the spam filter...

Re:Yahoo can't even keep spam out of my inbox (1)

ibsteve2u (1184603) | about 8 months ago | (#45458459)

Maybe Google has decided "Why make it easier to pick out what our customers are interested in - or, for that matter, why reduce the volume of electronic transmissions that must be analyzed? Let the spam flow!".

First po5t (-1)

Anonymous Coward | about 8 months ago | (#45457977)

OS don't fear the May also want Users. BSD/OS ARE A PATHETIC learn what mistakes and I probAbly of Jordan Hubbard

This is great news for Yahoo users (0)

Anonymous Coward | about 8 months ago | (#45457981)

This is fantastic news for Yahoo's users. Not because it will make their data more secure. The government can bust down the door whenever it wants. No, it's great news because it might take some developers off the task of B0rking the UIs and making the site run slow. It's great news because that extra bit of distraction will give users more time to shop for replacements.

liars and dumbasses (0)

Anonymous Coward | about 8 months ago | (#45457995)

so now, post snowden "revelations", with the year 2014 rapidly approaching, yahoo ceo marissa, "not helping the spooks is treason" myers says they are gearing up to use ssl with 2048 keys? also says they didn't help the feds spy on customers. well you don't really have to help them if you don't lift a finger to protect the data until after the fact and then only implement the most basic(possibly completely ineffective) measures. but just like everything else, if the people continue to tolerate it, they will continue to abuse.

Why? (0)

Anonymous Coward | about 8 months ago | (#45458079)

Why bother? Won't Yahoo just give NSA access if they ask for it?

Really. (2)

BrookHarty (9119) | about 8 months ago | (#45458165)

Doesnt do any good, if the law enforcement organizations (etc), have a warrant they can record all traffic from your IP/Phone. Depends on the company, but at AT&T Wireless they could turn on full sniffing from a mobiles internet traffic and record all TCP/UDP and even overlay it with location based service (tower strength triangulation). My boss said they had a group to assist in warrants, but after I setup the servers and routers, I NEVER saw an email, name or department identified, and I worked there for years setting up hardware from old packet data to 3G routers before I left.

So anyways, they record the entire SSL handshake so they can decrypt the session. You too can even try it for yourself in wireshark.

And who knows what is going on at the AT&T datacenters in those secret rooms...

Re:Really. (0)

Anonymous Coward | about 8 months ago | (#45460139)

So anyways, they record the entire SSL handshake so they can decrypt the session. You too can even try it for yourself in wireshark.

What you say it true in general, but it doesn't have to be. Although it isn't guaranteed to be used, SSL supports cipher suites that promise perfect forward secrecy [wikipedia.org] , which means that without a break in the encryption algorithm itself, a passive attacker cannot read the content of the messages because they have no way to access the session key (even given the server's private key) and the session key is never stored. An active attack (MITM) is still possible, but simply recording everything and attempting to decrypt later like it sounds like the NSA may be doing is not. Once again, these cipher suite don't tend to be prioritized in SSL implementations (NSA conspiracy? No one thinks they are worth the slight computational overhead?), so only a small fraction of SSL traffic actually uses them.

This will never work. (1)

DigitAl56K (805623) | about 8 months ago | (#45458243)

That security is going to last as long as it takes to find one exploit against an endpoint that can be used to pull the key out of memory one time.

2048 SSL encryption is REQUIRED (0)

Anonymous Coward | about 8 months ago | (#45458251)

Just for those who don't deal with SSL certificates, as of Jan 1st ALL SSL certificate MUST be a minimum of 2048 bit encryption.
They would have to replace the current certs anyway, smoke and mirrors or just PR?

Ya Who? (0)

AnalogDiehard (199128) | about 8 months ago | (#45458323)

People STILL use Yahoo?!?

Useless (and an obvious deception) (2)

rmckeethen (130580) | about 8 months ago | (#45458343)

Let's be real about this -- if the N.S.A. wants data on any particular Yahoo user, or on all Yahoo users for that matter, it's not going to make one wit of difference if Yahoo encrypts its data or not. All the N.S.A. has to do is issue a national security letter, and Yahoo will cough-up whatever they got. Yahoo's encrypting the data on disk or in transit through their datacenters is little more than a pathetic attempt to lure customer's into believing that Yahoo is doing something to protect their data when, in fact, there's little Yahoo can do to prevent the N.S.A. for getting its hands on your data.

Re:Useless (and an obvious deception) (0)

Anonymous Coward | about 8 months ago | (#45458483)

Better than doing nothing about security. End to end encyption is an obvious desire of everyone who communicates with a specific closed recipient class.

Re:Useless (and an obvious deception) (0)

Anonymous Coward | about 8 months ago | (#45460861)

If the NSA, FBI, etc. wants data on any particular Yahoo user, I'm OK with them having it (pending, of course, just cause and warrants and all that which is, well, a work in progress...) What this will prevent is the NSA getting nearly *all* data for nearly *all* users without even asking. That's a huge step forward.

But didn't NSA compromise SSL already? (1)

jones_supa (887896) | about 8 months ago | (#45458447)

What about the talks about NSA being able to defeat SSL already?[1] [rc3.org] [2] [theregister.co.uk]

SSL on SMTP or not?? (0)

Anonymous Coward | about 8 months ago | (#45458495)

Yahoo doesn't support SSL on their SMTP servers. They did not specifically say that they are going to enable it on their SMTP servers. Maybe they are just talking about HTTPS on their web UI. They need to be more specific. They also need to use perfect forward secrecy, or it's useless. NSA could force them to hand over the SSL private key and it would be like there is no SSL.

Man In The Middle (0)

Anonymous Coward | about 8 months ago | (#45458515)

It is simple. The only way to protect their service is to implement the 2-way authentication. Which means that both the server and the client must have their own PK. Which, surprise surprise, is not implemented by any email/whatever service around. For the obvious reason.

Waste of time - all keys already held (1)

WillAffleckUW (858324) | about 8 months ago | (#45458541)

I agree with someone who suggested one of the early pre-NSA encryption schemes.

You'd be better to roll your own, mind you. Remember, they already have your make files if you used Win 8 or Win 8.1, since it "indexes your local drive for fast search" which is a polite way of saying "spies on you".

Re:Waste of time - all keys already held (1)

currently_awake (1248758) | about 8 months ago | (#45460475)

Most people are not competent to write their own encryption system. It takes a lot of very advanced math and a very careful implementation to make a secure comm system.

But how is the NSA going to fix Flickr's bad UI (1)

themushroom (197365) | about 8 months ago | (#45459065)

if you change the code and lock them out?

now, if they would fix the UI (1)

Ralph Spoilsport (673134) | about 8 months ago | (#45459109)

Yahoo mail's UI is horrific. Besides being ugly, if you have to enlarge text it becomes disuseful... It's a trainwreck of a UI.

Good keys essential (0)

Anonymous Coward | about 8 months ago | (#45459189)

If you've got bad random key generation then it doesn't matter if you use AES256 or not: the NSA will narrow the search space for the key down to a searchable range.

I don't just blame the NSA (1)

msobkow (48369) | about 8 months ago | (#45459469)

I don't just blame the NSA for this situation. The providers are at fault for assuming that leased lines can be run unencrypted between their data centers because they're "private". Any time data enters or leaves a data center, one should assume it is being monitored. Everyone knows that's the most basic tenet of security.

But all these lazy vendors from Google to Yahoo and Microsoft and hundreds of others have taken the easy, lazy way out for years.

We all owe Snowden a big "Thank you" for kicking them all in the ass and getting them to do what they should have done in the first place.

Re:I don't just blame the NSA (1)

currently_awake (1248758) | about 8 months ago | (#45460499)

You are assuming the NSA didn't "suggest" that the lines between data centers be in plain. Also there is no sane reason for the NSA to ever set foot in a yahoo data center. That would introduce a huge speed bump in their access to the data. Much better to just have a direct line in, with full root/admin access to everything.

Bad news (1)

PPH (736903) | about 8 months ago | (#45459611)

I already had trouble understanding Marissa Meyer.

Encryption on webmail by 2014 (0)

Anonymous Coward | about 8 months ago | (#45459839)

Congratulations Yahoo!, you've been outdone only by just about every other player out there. Bravo.

Re:Encryption on webmail by 2014 (0)

Anonymous Coward | about 8 months ago | (#45459865)

My mistake. Apparently there's been an option to enable SSL since at least January of 2013. I apologize.

the most cynical of hypocrisies (0)

Anonymous Coward | about 8 months ago | (#45459903)

The AP, without a hint of irony, posted today: Debunking the perception that the NSA and other U.S. government agencies can easily vacuum up potentially sensitive information about people's online lives is important to Yahoo, Google and other Internet companies because they need Web surfers to regularly use their services so they can sell more of the digital ads that bring in most of their revenue.

Translation: "We must convince people that the NSA and other U.S. government agencies cannot easily vacuum up potentially sensitive information about people's online lives, so that we can continue to easily vacuum up potentially sensitive information about people's online lives!"

Remember, you are not Yahoo's customer; you are the product. They can't afford to spook the merchandise.

Erm, remember Lavabit (1)

Severus Snape (2376318) | about 8 months ago | (#45459977)

All fun and games till your forced to hand over the SSL key and then all that encryption is pointless.

Opportunistic encryption ... (1)

MikeBabcock (65886) | about 8 months ago | (#45460391)

I remember the paranoid rantings of those in the FreeS/WAN community back in the day (that's IPSec software for Linux fyi) about needing opportunistic encryption support and DNS based keys so any two hosts on the Internet could communicate securely and prevent Big Brother from listening.
I also recall that I wished it would work, and set up my own hosts with it, but it never did work well and there just weren't enough participants to hit critical mass.
Thirdly I remember a quote from my old BBS days ... "Its not paranoia if they really /are/ out to get you."

encryption does no good when they hand over the ke (0)

Anonymous Coward | about 8 months ago | (#45460799)

lying asshats. I worked there 2 years. buncha sharks

Better Security (0)

Anonymous Coward | about 8 months ago | (#45460983)

My recommendation is that they hash all of their data. Not only is it harder to recover, but it takes up less space. Win Win.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...