Analysis of 400,000+ Stolen Yahoo! Passwords

[Angrboda]

Bahahahahahahahahaha! That settles it. I'm changing all my passwords to "princess". Oh god, that is too funny. I'll be giggling about this for days.


I had a recent bit of fun with passwords. I have a Barnes & Noble account. I had acquired a new eReader, so I went to synchronize everything and when I went to sign in, it told me there was no account associated with that name and password. Mysteriously, the device seemed to work fine, but not the PC instance. After another attempt, I was informed that the account has been locked out, and I would need to call their 1-800 number. So, I did so, changed my password after getting their one-time-only password reset email, under prompting via phone. A couple weeks later, I go to log into my account, and it's the same thing. I wasn't locked out, so I went through the online password recovery / change process, but each time the result was the same. So I again called the 1-800 number and went through the same process of interactively changing my password again. Every time, the result was the same: no access. Just sort of offhand like, the CSR Rep asks me how many characters my password was. So I count up the characters and answer, "14." She tells me, oh, if your password is longer than 12 characters, stuff like this happens.

No warning on the password forms. No sanity checking of the input. And a support staff which is apparently largely unaware of the issue.

I was so mad I could just spit.