Thanks For The Identity Theft, Yahoo

"It's a valid scenario, but I was starting to think quite unlikely. If I get a a new jrandom@yahoo.com address, I would have to know who that account used to belong to and on which online services it might have been used. If I'm in Boston and the old "jrandom" was in Atlanta, I'd have to first figure that out and then figure out what bank he used, and be lucky enough that he had not updated his email there. And websites like banks and other financial services require more than just an email address to get a password reset. You need to answer some "secret questions" etc."

It's not that hard, actually, considering that most websites you sign up for send periodic marketing emails. You're the new owner, you get a marketing email addressed at the old owner, hit the "forgot my password" link, and you have ownership of the account.

I am always wary of collateral damage arguments, but in a greater-good sense, I almost hope Yahoo do go ahead with this. It's such an obviously bad idea, and enough people probably would suffer significantly as a result, that it might just raise public awareness of why things like good security practices and privacy and data protection matter, and that it can "happen to them", even many years in the future, if they don't take care of how they behave and who they trust today.

Hopefully, Yahoo would also find themselves vulnerable to at least one of the obvious legal attack vectors and wind up paying out a small fortune in compensation to make good on losses due to identity theft and/or frauds committed using false identities they supported. This could be an educational lesson for a lot of businesses that don't take privacy and data protection seriously today because collecting everything you possibly can about everyone is seen almost pure upside with little real cost or risk.

I agree that this is a terrible move, in theory. But in actual practice, I'm not convinced it will be so bad.

Because if you're not using that Yahoo account for e-mail anymore, then you're probably not using it as a sign-in or password recovery e-mail for your banking, Facebook, or anything else important -- because the whole point is, everything that's actually important to you, you're using your current e-mail address. After all, that's where important account notifications go, credit card receipts, bank statements, password resets, etc. -- things which are necessary for you to see.

Of course you'll likely have a bunch of accounts you forgot even existed on random sites you signed up for in the past, with your old Yahoo e-mail address. Most of them will be harmless -- who cares if someone gets access to some random sports forum you once posted on.

The biggest risk I can see is that 1) the new owner chooses to be malicious, 2) successfully locates a site that sends out password-recovery emails with the original passwords in plaintext, which the specific user has an account on, 3) knows the original user's current valid address, 4) tries the old password on the user's new address they use with banking/etc., and it works. But the risk of this would appear to be so small, that it's just lumped in with all the other kinds of "identity theft" weaknesses that already exist (guessing security questions, etc.).

(And then, there's scamming on whatever social networks or forums the old e-mail address had an account on. Although it seems like Facebook etc. is protecting against that? And it's not like spoofing e-mails/accounts is anything new.)

As long as Yahoo is giving significant heavy warning to the e-mail accounts themselves, and months' worth of time -- well if you never check your free e-mail account, it's not unreasonable to expect that it might be deactivated someday. Annoying, but not unreasonable. And if you use the same password for your Facebook, banking, etc. as you did for other random sites you signed up for years ago, then that's a security risk regardless of what Yahoo does.

Legitimate question: how can you have accounts on autopay attached to an e-mail address you haven't checked in 2 years?

You have literally not looked at any of the receipts in 2 years? If you've cancelled any of the credit cards, you had no idea that there was an autopay problem? The merchants had no way of contacting you, because you never checked that email?

That doesn't make any sense to me. Or was it just forwarding the emails to the account you do use, or whatnot? In which case, I assume that Yahoo would be sending emails warning of the upcoming account closure, which you could receive and act on?

:') you just made my day