full-disclosure - yahoo mail image verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42074E8A.9020801@xmcopartners.com>
From: thierry.haven at xmcopartners.com (Thierry Haven)
Subject: yahoo mail image verification

After testing the French Yahoo portal, it appears that this flaw 
actually exists. Let's hope they'll fix it soon. However, the impact of 
a bruteforce attempt is minimal if you have a strong password by default 
...

I've submitted this bug to Yahoo for review.

_______________________________________
Thierry Haven - Xmco Partners
Security Consulting / Pentest
web  : http://www.xmcopartners.com


cumhur onat wrote:

>Did you realized that the image verification in yahoo mail which
>appears after some insuccesfull attempts is not working properly,
>becus i can just leave it blank and continue trying, dont tell me that
>it wont work if I enter a true passwrd without the verification code .
>It works i  have tried with 6 accounts and managed to enter the inbox
>after about 40 tries.
>Sorry for my bad english :(
>Hope you understand what I mean...
>Cumhur Onat
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>  
>