I have received a warning email from Yahoo regarding data breach that they might had.

...The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases,...

MD5 is famous for his weakness in front of dictionary attack that it is strongly not recommended, so I'm wondering what prevents Yahoo from changing the hashing algorithm ?

  • I propose to close the question because it is primarily opinionated. Probably nobody outside Yahoo knows why they made this big mistake so everything is speculation. Dec 15, 2016 at 17:52
  • I believe for this case speculations & assumptions will generate a fruitful output for the SO community.
    – elsadek
    Dec 15, 2016 at 18:03
  • 2
    I agree with Steffen, but in the interest of pure speculation, I would say because it might have been expensive/time-consuming and Yahoo values money/time over its customers Dec 15, 2016 at 18:08
  • 1
    I think it might be more fruitful if you change the focus of your question away from "why did Yahoo did not change the hash" to "how to migrate passwords from an insecure storage to a secure storage". But there are already questions about this topic so this might be closed as duplicate then. Dec 15, 2016 at 18:08
  • The question you suggest to change to, needs someone who know the actual implementation which nobody outside Yahoo could do.
    – elsadek
    Dec 15, 2016 at 18:24

2 Answers 2


Yahoo says that they began migrating user passwords from MD5 to bcrypt in the summer of 2013 (https://help.yahoo.com/kb/account/SLN27925.html?impressions=true#cont5). However, depending on how these migrations are conducted, user passwords may still be stored as MD5 until the first time a user logs in after the hashing change. So while frequent users might get migrated to the more secure algorithm right away, the people who logged in less frequently would still have a MD5 hash associated with their account until they re-authenticated at the site.

Also keep in mind that Yahoo thinks that this data breach actually happened back in August 2013, and not recently. So either the hash migration hadn't started yet or there were still many users who hadn't been migrated away from the MD5 hashes at that time.

  • 1
    Indeed the email I received from Yahoo few days before mentions that the data breach occurs back in 2013.
    – elsadek
    Dec 15, 2016 at 18:28

There are two theories that make sense:

  1. Instead of upgrading their legacy hashes all at once (which is what you should do when migrating hashes), the Paranoids team dropped the ball and decided to do it opportunistically. This left some MD5 hashes in their database while they upgraded to bcrypt. (It's been reported that they had already switched to bcrypt.) This is the most obvious explanation, and somewhat plausible.

  2. Rumor has it they were storing an MD5 hash so they could detect password reuse by fraud accounts.

If #2 holds any truth, a much better solution would have been a second bcrypt hash with a static salt. This would still be slow for attackers, but allow them to perform their password-reuse detection and catch fraudsters.

In the end, however, it could be neither answer. Only Yahoo knows, and unless they tell us, we can only speculate.

Not the answer you're looking for? Browse other questions tagged or ask your own question.