Hacker News Reader

Comment by zacharycohn | Hacker News Reader

Uh... no. They're basically just deleting abandoned accounts and freeing up the name. They wouldn't have access to your data.

View on HN

What about this situation?

A grandmother who has barely learned how to use email died in 2012.

Her friends are all in their 80s and only send 1 email a year.

Someone new registers the account and then... Then, the Holiday season in 2013 roles around and all of a sudden a new person is receiving emails from another person's friends.

At that point, the scams they could pull off would be insanely easy.

Additionally: Any sensitive material intended for the original person would instantly be compromised.

Yahoo is playing a somewhat dangerous game. The better option would have been to buy a domain name similar to Yahoo.com and use that.

[ADDED] Now I'm really mad. I tried logging in and it requires me to send an email to an account I had when I signed up for yahoo 10 years ago to log in because it "doesn't recognize my device". Just like Google there is no way to email them or contact them. Unacceptable. There is no way for me to log in to my account.

"doesn't recognize my device"

Same here. In this case the device is the same browser I've been logging in with daily. The back-up email is one that hasn't existed for a decade, and the "secret questions" for which I generated random number answers and carefully saved don't match.

That's on a mostly throw-away account, so I don't care too much. On a more regularly used account I just checked I was able to log in fine. My email inbox is page upon page of spam that should be easily filtered on their end, but at least I can get in.

They did this a few years ago with rocketmail.com and ymail.com

So if that old woman died and her phone got disconnected, should her phone number also be taken out of the pool of available numbers?

You can contact customer care by visiting http://io.help.yahoo.com/contact/index?locale=en_US&y=PROD_A...

choose,

Product: Yahoo Account category: Password and signin sub-category: My issue doesn't appear on the list

I did that, thanks for posting.

This could also lead to targeted attacks. there are probably a lot of no-longer-used yahoo emails still listed on people's facebook profiles which could possibly be used to pw reset. I don't think it would be a bad idea for facebook to display a notice to people w/ yahoo emails at some point before this come into effect.

didn't they start using @ymail.com a few years ago? have they stopped doing that?

But any emails sent to my old address would be read by the new owner.

Same if you move physical locations and your mail forwarding expires. If you haven't logged in for 12 months, can it really be that important?

You changed addresses but forgot to update your bank to the new email address. Then someone resets the password using the new one and empties your bank account. Passwords are tied to email addresses unfortunately.

Exactly, this is analogous to your home address. Bad things can happen if people send mail to an address you don't live at anymore; it comes with the territory. I think a year is actually a bit short, but there should absolutely be some expiration date on accounts like email addresses. Five years seems like it would be more appropriate. Five years on the internet is an eternity.

Not sure about the home address analogy. I don't know about you, but I don't open mail that doesn't have my name on it, even if it has my address.

Maybe I'm just being naive, but it seems to me that someone getting a letter addressed to you is much less of an issue than someone getting your email.

The risk regarding email isn't that someone gets it, it's that someone dastardly gets it. I think that same exact risk applies in real life.

I can give a real example of this that happened to me. I have a Steam account. Many years ago I created it using a Hotmail email account. I never used Steam for a couple of years. One day last fall I decided I wanted to do a little gaming, but I could not remember my account. I did the password reset but it never came through. I tried logging into my old Hotmail account, but they said it didn't exist. I re-created it, resubmitted the Steam password recovery form, and recovered my account _with_ saved credit card information.

Thanks for sharing. This is terrifying and it's the reason releasing the email addresses is a horrible idea.

The web runs on the assumption that you have access to an email address and you'll never lose control of it. Ignoring that assumption and opening up your old users to identity theft just because you want to reissue short usernames that will again be squatted on is kind of crappy.

Was your credit card still valid? Most cards aren't good for longer than 4 years, and chances are you had a few years on it when you signed up for Steam.

Reply on news.ycombinator.com