What does the Yahoo breach teach us?

Most persons active on internet for the last decade or two have a Yahoo email account. While many amongst us may have graduated to Gmail, some retain Yahoo as their primary email account and quite a few have it as their secondary account. Recently, Yahoo announced that 500 million user accounts had been compromised. The large number of records means that 10% of internet users’ email accounts have been affected. The data includes users' names, email addresses, telephone numbers, dates of birth and encrypted passwords. Yahoo claims that this was supposedly done by a nation state actor and the breach had been done way back in 2014. What implications does it have for individual users and what lessons can be learned from this ?

What is the effect?

The most alarming thing about the breach was that two years had passed since the breach and it took so much time for them to detect it, go public and announce it. Yahoo has conveniently deflected the blame from its security failure by claiming it to be done by a nation state actor without naming the country. More alarming is that still many users are not aware of it. Being an InfoSec professional I came to know about the breach first day it was announced and took the necessary precautions for my account. After a week I asked my friends and family who were using Yahoo for their email if they knew anything about the breach and had they done anything about it. Unfortunately none of them were aware of it and had not even taken the basic precautions of changing their password and activating two factor authentication. What does it say about individual’s information security? This frightening state indicates that unless Yahoo takes some drastic action such as locking out their accounts, attackers will have a field day targeting individual users and their other online accounts. This problem is further compounded if users have shared these passwords on other accounts as most people do.

What can Individuals do?

•          Learn and use Multifactor authentication. Multifactor authentication means using more than one method to authenticate by using another factor such as a mobile OTP along with a password.  This should not be difficult as we do use a mobile or email OTP for confirming banking or credit card transactions. This alerts and prevents logging in from new devices or locations. Use it to ensure that your account cannot be accessed from other devices without your permission read mobile OTP. It is not fool proof but not safer. Ironically, Yahoo itself provides Account key service which uses your smartphone to authenticate you.  All key online services such as Google, Facebook, LinkedIn, Twitter and a lot more provide multifactor authentication.
•         Do not share passwords for multiple accounts – Simply because one breach should not lead to other accounts being compromised. Unfortunately this is common practice due to a large number of online accounts.
•        Use a password manager. – Use one such LastPass, 1 Password or Dashlane to make it easier to manage passwords. Also it helps to have stronger passwords, keep unique passwords for all accounts and removes the need to remember passwords.
•        Do not trust organisations to safeguard your security. – Organisations can keep your personal data such as name, address and phone number encrypted but do not do so as it directly affects their advertising revenue model. It is easier to access and use unencrypted text.  Another aspect users have to keep in mind is that even large organisations with large security budgets and best security experts can get affected. Hacks on Sony, MySpace , LinkediN and now Yahoo have proven this fact. Therefore, do not give organisations more information than is needed.

Remember your security is your responsibility.  Don’t leave it to someone else