Engineer admits hacking Yahoo accounts searching for images

[raz32dust]

End-to-end encryption is the only foolproof was of preventing this. But if that is not possible, training and audit/alerts is the next best thing.

Training is important because new employees or new college grads might not be aware of truly how egregious it is to view someone's personal data. It really had to be drilled into the culture. By audits and alerts, I mean that if one employee accesses sensitive information, they know that other teammates are getting an alert about it. People do such things when they think nobody will know.

[oyebenny]

I'd actually love to have this implemented client side - i.e if an employee views accesses your info, the client gets an alert.

[JazzXP]

The fact he was able to usually means something is lacking in the backend security. Yes, bad employee, but more encryption and security models are required. Back when I was working on share trading software, this was one of our requirements of the system.

[alfiedotwtf]

Encryption, in email? lol...

This is what happens when end-to-end encryption isn't the default in communications software. All email providers are vulnerable to this bar none.

[Trias11]

Banks routinely hire hit-n-run contractors to manage systems will low level, uncontrolled, unaudited access to mind boggling resources and eye popping access to private customers info.

Email porn? Child play.

[hos234]

Not just contractors. In most parts of the world there will be a 20 year old, with 3 months of "security training" paid less than $1000 a month, running around the data center with keys to the castle.

[d-d]

Everything has to get decrypted at some point, right? I try not to think about what would happen if a Google employee decided to leak everyone's search history.

[tennessee5]

Chris Putnam, who used to work at Facebook, did almost exactly the same thing with videos.

[glandium]

Wait, what? I knew the part where he wormed Facebook and eventually got hired, but I didn't know that. Do you have a source? I only was able to find the part I already know about.

[xenihn]

Holy shit, that's a name I haven't seen in forever. I remember gbs.tv and SA secret santa.

[raxxorrax]

This is probably a common occurrence in the industry, especially at companies that make money with user data. This is at the core of the issue why the recommendation has always been to minimize data exposure from industry experts.

Even if end-to-end encryption would be applied, there will never be 100% security from administrators and developers. You cannot even reasonably audit these systems with current technologies.

And yes, protected HR and user information will regularly leak into IT departments. If the latter is outsourced to third parties, this means data leaks galore.

[SteveNuts]

I truly don't understand how Yahoo still exists. How have they survived this long?

[tempsy]

The updated Yahoo Finance app is really slick, actually.

It actually makes me wonder WTF happened to Google Finance? Why did they essentially abandon it? Charts just show up at the top of the results page but there's no dedicated site anymore.

[taftster]

Fantasy football, NCAA Men's Basketball tournament, and maybe finance.yahoo.com is about it.

[peterhookgen]

I ask myself the same question, especially when it was announced on HN they just spent cash on a new branding logo https://www.underconsideration.com/brandnew/archives/new_log...

[journalctl]

What other service am I supposed to use as a permanent throwaway email account?

[throwaway13000]

When was the last time you changed your email address?

[marsrover]

All the great logos they design keep them in business.

[mixmastamyk]

They’re profitable.

[zarro]

Oh you think this is bad, just imagine all the guys at the NSA

[zantana]

Seriously optic nerve https://www.extremetech.com/extreme/177500-gchq-nsa-secretly... was the equivalent a whole floor of that guy.

[dehrmann]

I'm starting am engineering job at a FAANG in a few weeks. They already had me sign something agreeing to not do anything with the data of someone I know in the course of my work, told me access is monitored, not to make actual changes to people's accounts because hacking isn't distinguishable from admin changes by users, if something accidentally happens, notify a specific group so they can reach out to the user.

It feels like they take privacy really seriously, but at the end of the day, yes, employees do have access to your data, so before giving any company your unencrypted data, think hard about it.

[xenadu02]

Fun story: A GitHub employee renamed my user account because his buddy wanted the name. Nothing was ever done about it.

[jrockway]

Do you have any more details about this?

[andykx]

I strongly doubt that Google harbors any negative feelings for you specifically. Do you have any concrete evidence for your claim?

[lonelappde]

How do you know it was an inside job?

[spedru]

It's sobering to think about this in tandem with the fact that people in the IQ bracket for “engineer” tend to get away with crimes. Honestly, though, at least this can be turned into a concrete example to shoot down “if you don't have anything to hide...” and the like. The banal, lascivious panopticon elicits a real disgust response that might be moving, as opposed to the “shut up you alex jones weirdo” that sticks to talk of the NSA no matter how many Snowdens happen.

[smt88]

Let me try to rephrase this in a simpler way:

This is even more troubling because smart people are less likely to be caught.

At least, like Snowden's leaks, this is proof that privacy extremists aren't conspiracy nuts, and hopefully it will open a few eyes to the real danger of giving up privacy.

Other comments are right: stop using big words and write plain sentences.

[duxup]

Just for the sake of feedback, I found your post confusing.

It's not really clear to me what you are saying exactly.