TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

How Yahoo allowed hackers to hijack my neighbor's e-mail account

27 点作者 Jaigus超过 12 年前

2 条评论

throwaway125超过 12 年前
the gist of it seems to be that yahoo ran a vulnerable wordpress site that allowed the attacker to run javascript from the yahoo domain, allowing them to steal login cookies.<p>That makes me wonder, doesn't yahoo set the http only flag for their session cookies? Is there any reason you may want javascript to access the session cookie?<p>Suppose it's a good time for everyone to verify that their websites properly set http only on any cookies you don't want to access via javascript.
pasbesoin超过 12 年前
Off the top of my head and as anecdote, I've probably received the most spam and/or malicious emails from friends compromised email accounts where those accounts are Yahoo accounts. Hotmail would probably be second.<p>I usually go to the effort to call them up as soon as I can to inform them of the compromise. I've started gently describing the problems with these particular hosts; unfortunately, however, most don't go to the effort to make a change. And several have been compromised multiple times.