Yahoo, seems to have the worst email security on the planet when they aren't actively writing tools for the NSA to snoop your email. Now they are claiming the "state actor" that hacked 1 billion accounts was able to access email accounts without a password by using forged cookies.
Our outside forensic experts have been investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account.
How is this technically possible? I assume they were forging session cookies? That means they could only attack active sessions and they must know the cryptographic cookie generation scheme? Even knowing the cookie generation scheme, wouldn't it still be guessing... I mean can they generate a session cookie and get it correct the first time or does it take many guesses?
What else can the attacker do with the account. For instance, why did they not change the passwords on the accounts so only they could access them?