Yahoo, seems to have the worst email security on the planet when they aren't actively writing tools for the NSA to snoop your email. Now they are claiming the "state actor" that hacked 1 billion accounts was able to access email accounts without a password by using forged cookies.

Our outside forensic experts have been investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account.

How is this technically possible? I assume they were forging session cookies? That means they could only attack active sessions and they must know the cryptographic cookie generation scheme? Even knowing the cookie generation scheme, wouldn't it still be guessing... I mean can they generate a session cookie and get it correct the first time or does it take many guesses?

What else can the attacker do with the account. For instance, why did they not change the passwords on the accounts so only they could access them?

closed as primarily opinion-based by Xander, Purefan, Matthew, J.A.K., Serge Ballesta Feb 20 '17 at 14:58

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Without having more information, any answer would be entirely speculative and quite likely wrong. There's just not enough detail here to offer an educated guess. – Xander Feb 19 '17 at 22:37
  • It's entirely possible that session cookies are predictive, have weak entropy, or something else that would make forging them easy. But I back Xander's statement that without technical details to base an answer off of, it's speculative and most likely would be incorrect for the scenario. – h4ckNinja Feb 19 '17 at 22:43
  • 1
    According to theregister.co.uk/2017/02/16/yahoo_forged_cookie_hack_risk "...believes ... an unauthorized third party accessed the company's proprietary code to learn how to forge cookies." – Aedazan Feb 19 '17 at 22:44

Browse other questions tagged or ask your own question.