Hacker News Reader

Comment by midnitewarrior | Hacker News Reader

This is a terrible idea!

I have a month to compile a list of the most popular first and last names and popular e-mail names and get a bot ready to register them all.

Once registered, I can then attempt password recovery for these @yahoo.com email addresses at the most popular web sites across the Internet that rely on established identities (ebay.com?).

If JamesSmith@yahoo.com ever used his yahoo id to register an account on EBAY.com, or with another online service, now is my chance to try to steal his online accounts by requesting password resets on these services and assuming his identity.

Now, to build a bot that will do this thousands of times!

Sites with 2 factor authentication may be immune to this, but these identities will now be unrecoverable to somebody who has used his @yahoo address as his recovery e-mail address, even if he doesn't check it often.

View on HN

You're absolutely right. Other services view email as non-transferrable (the "recover my password" feature of almost every website with a login ever is evidence of this). Think of what someone could do if they had access to your email account, even if it's one you haven't used in years.

Someone could turn my life upside down if they had access to the hotmail account that I use to sign up for services that I know will spam me.

Is there anything people can do about that on the service-provider side of it, to limit account compromise via the Yahoo-email-password-reset vector? Short of something like disabling password reset emails to Yahoo addresses, which would cause a different kind of collateral damage?

I've actually run into a few services that won't accept signups from any "free webmail" provider, usually listed as Hotmail/Outlook, Yahoo, and Gmail. I suspect the reason for such policies is worries about spammy new accounts, but the risk of account lapse followed by impersonation might be another reason to favor such a policy. On the other hand, it would also lock out a number of legitimate users who use one of those services as their main or even only email.

1. Scan DNS registrations for administrators with @yahoo.com addresses

2. Claim as many of those E-mail addresses as you can

3. Hold your newly acquired domains hostage for $$$

There's money in that.

Yahoo better act like they know what they are doing. I'm sure their technical team does, but management doesn't always listen to the engineers, sometimes management just says "MAKE IT HAPPEN."

The people that work at Yahoo are not stupid. They will surely have a process in place to prevent a single person from sucking up all the short/popular email names.

Even if that person wasn't doing it for nefarious purposes that would completely defeat Yahoo's whole goal here of getting these names in the hands of users who actually want to use them.

How can you be so sure?

Never attribute to stupidity that which can be explained by indifference.

That's exactly what I first thought. The fact that they don't get this means that I will not be using their services at all going forward.

Yes, Yahoo attempting to do this makes me seriously question their trustworthiness. I know they are trying hard to reinvent themselves, but this is a serious misstep unless they've got a magic trick to somehow deal with these issues that I am unaware of.

At the very least it will cause confusion. At worst, accounts will get hacked.

Reply on news.ycombinator.com