This is kind of weird, so somebody can sign up for [email protected] and basically start reading emails that are meant for me?
Edit:
Consider a scenario. You know of an old rich eccentric who has been hospitalized in a nursing home or some such, you've interacted with them in the past and they have a Yahoo email.
They haven't logged in for a year, you grab it, now you appear be them to all the people they've emailed with in the past. Including their bank.
I get emails intended for other people all the time. Including financial data, addresses, phone numbers, tons of names and emails in CC fields, etc. I know a guy with a more common name who has made up a ranty blog post that he sends to companies who don't do proper email validation: https://news.ycombinator.com/item?id=5870692
A grandmother who has barely learned how to use email died in 2012.
Her friends are all in their 80s and only send 1 email a year.
Someone new registers the account and then... Then, the Holiday season in 2013 roles around and all of a sudden a new person is receiving emails from another person's friends.
At that point, the scams they could pull off would be insanely easy.
Additionally: Any sensitive material intended for the original person would instantly be compromised.
Yahoo is playing a somewhat dangerous game. The better option would have been to buy a domain name similar to Yahoo.com and use that.
[ADDED] Now I'm really mad. I tried logging in and it requires me to send an email to an account I had when I signed up for yahoo 10 years ago to log in because it "doesn't recognize my device". Just like Google there is no way to email them or contact them. Unacceptable. There is no way for me to log in to my account.
This could also lead to targeted attacks. there are probably a lot of no-longer-used yahoo emails still listed on people's facebook profiles which could possibly be used to pw reset.
I don't think it would be a bad idea for facebook to display a notice to people w/ yahoo emails at some point before this come into effect.
Same here. In this case the device is the same browser I've been logging in with daily. The back-up email is one that hasn't existed for a decade, and the "secret questions" for which I generated random number answers and carefully saved don't match.
That's on a mostly throw-away account, so I don't care too much. On a more regularly used account I just checked I was able to log in fine. My email inbox is page upon page of spam that should be easily filtered on their end, but at least I can get in.
I can give a real example of this that happened to me. I have a Steam account. Many years ago I created it using a Hotmail email account. I never used Steam for a couple of years. One day last fall I decided I wanted to do a little gaming, but I could not remember my account. I did the password reset but it never came through. I tried logging into my old Hotmail account, but they said it didn't exist. I re-created it, resubmitted the Steam password recovery form, and recovered my account _with_ saved credit card information.
Thanks for sharing. This is terrifying and it's the reason releasing the email addresses is a horrible idea.
The web runs on the assumption that you have access to an email address and you'll never lose control of it. Ignoring that assumption and opening up your old users to identity theft just because you want to reissue short usernames that will again be squatted on is kind of crappy.
Was your credit card still valid? Most cards aren't good for longer than 4 years, and chances are you had a few years on it when you signed up for Steam.
You changed addresses but forgot to update your bank to the new email address. Then someone resets the password using the new one and empties your bank account. Passwords are tied to email addresses unfortunately.
Exactly, this is analogous to your home address. Bad things can happen if people send mail to an address you don't live at anymore; it comes with the territory. I think a year is actually a bit short, but there should absolutely be some expiration date on accounts like email addresses. Five years seems like it would be more appropriate. Five years on the internet is an eternity.
Not sure about the home address analogy. I don't know about you, but I don't open mail that doesn't have my name on it, even if it has my address.
Maybe I'm just being naive, but it seems to me that someone getting a letter addressed to you is much less of an issue than someone getting your email.
Edit:
Consider a scenario. You know of an old rich eccentric who has been hospitalized in a nursing home or some such, you've interacted with them in the past and they have a Yahoo email.
They haven't logged in for a year, you grab it, now you appear be them to all the people they've emailed with in the past. Including their bank.