Yahoo Recycled Emails: Users Find Security Surprises

Some Yahoo users who took advantage of recycled IDs report they're getting emails intended for the old account holders -- including personal data.
Though Yahoo's security measures weren't effective for everyone, Redmon said the company isn't liable for the misdirected personal emails. "Businesses are in trouble when they lose personal information they collected and were entrusted with, but that doesn't fit the Yahoo scenario," he said. "Yahoo hasn't lost or disclosed information they shouldn't have. They're not responsible for the fact that it was disclosed to a third party -- the user is."

Yahoo performed what Redmon calls a "risk shift": Yahoo transferred the burden of responsibility to the customer by requesting that the person log in to ensure the account remained active.

In a statement to InformationWeek, Dylan Casey, senior director of platforms at Yahoo, said that the company has received minimal complaints from recycled-account holders. "We take the security and privacy of our users very seriously. We have heard from a very small number of users who have received emails through other third parties which were intended for the previous account holder," he said. "We are continuing to work with companies to implement the RRVS email header standard that we published to the [Internet Engineering Task Force]."

Today, Yahoo charges $1.99 for you to request up to five usernames on Yahoo's Watch List. Jenkins, who signed up when it was free, said that the hassle of dealing with the misdirected email -- which totals between six and 10 messages a day, in addition to the "boatloads" of junk email -- hasn't been worth it. He's considering shutting down his account.

Harris, whose two Yahoo accounts were merged into one, said it took four phone calls and about four hours with Yahoo customer service to separate the two accounts and close the recycled one. "They were really helpful considering it's a free service, but they had a lot of trouble figuring out how to do it."

Newman said he's actively filtering the former account holder's email with hopes that the volume will eventually decrease. "I'm using the new account mostly for unimportant email because I'd probably go crazy trying to figure out what email is supposed to be mine and theirs," he said. "It's kind of disappointing because it's a great username to have, but I don't want to work this hard for it. Plus, getting someone else's mail just feels gross."

Those peeks into other people's personal lives leave Newman and Jenkins uneasy about Yahoo's continuation with recycled accounts, and concerned for others whose accounts may have closed.

"The most distressing part for me is that because I'm a Web developer, I know how easy it could be to reset all their passwords. It's scary to think about the damage I could do," Newman said. "Just yesterday I got an email confirmation for an apartment application. I could have canceled someone's apartment."

Jenkins said the opportunities for hackers are his biggest concern. "In some ways, the former user should be lucky that I'm getting this email because I would never do anything bad with it. But this whole situation made me nervous about my other email addresses. What happens when I stop using them?"

Editors' Choice
Elizabeth Montalbano, Contributor, Dark Reading
Nate Nelson, Contributing Writer, Dark Reading
Nate Nelson, Contributing Writer, Dark Reading