The Geek Professor » Yahoo

Yahoo Accounts Are Easy to Hijack

Jeremy — Mon, 15 Nov 2010 12:45:37 +0000

There have been some high profile hacks of Sarah Palin and Grady Sizemore, but the issue here is less about Yahoo security and more about what you do with it.

Just make a Privacy Alias and use it for places that want your personal information, but don't really need it. Of course, if you use an encrypted file to store passwords, you don't have to make an alias at all. You can just store completely new made up challenge answers for each site.

Yahoo! Makes Nasty Privacy Change

Jeremy — Thu, 03 Jun 2010 19:43:39 +0000

Apparently Yahoo! is set to publicize everything you do online to all your friends. If you're not excited about this thrilling change, you can opt out with a single button click (so they say), but it doesn't say where or how.

I logged in with an old account and here's what you're looking for:

Once you click that, here's what you'll see:

It will nag you to keep the setting or you won't be able to share everything you do... boo hoo. Click it and party.

Click the checkbox and you should be good until the next major settings change they hope you don't notice.

Note that I clicked around a bit and eventually I did get a screen that warned me about the change and let me opt out. Even if you see that screen, it's not a bad idea to follow the directions I listed above just in case. Anyway, here's what the alert looked like:

Make sure to uncheck each box here the click "Get Started"

City in Montana Demands Your Login Details to be Hired

Jeremy — Tue, 20 Jan 2009 00:31:48 +0000

This is so wrong, I barely know what to say. I sure hope this trend doesn't start to catch on, because a lot of people would give up the information when they're pressured instead of doing the right thing and refusing.

"Please list any and all, current personal or business websites, web pages or memberships on any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc." the form reads. But Bozeman isn't simply interested in finding out where to look for potentially embarrassing personal details; the city wants full disclosure, since the form demands username and password information for each.

This is way worse than all those sickening social networking sites asking for your e-mail address password.

Update

Here is the contact information for the relevant people in the city if you want to ask them why they thought this would be a good idea. And just in case someone were to change the form, here's a copy of the original found on their website:

This is for real... they actually expect you to give up your account details!

One More Reason To Be Against Digital Rights Management (DRM)

Jeremy — Fri, 25 Jul 2008 10:59:57 +0000

From Ars Technica:

Yahoo e-mailed its Yahoo! Music Store customers yesterday, telling them it will be closing for good—and the company will take its DRM license key servers offline on September 30, 2008. Once the Yahoo store goes down and the key servers go offline, existing tracks cannot be authorized to play on new computers. Instead, Yahoo recommends the old, lame, and lossy workaround of burning the files to CD, then reripping them onto the computer. Sure, you’ll lose a bunch of blank CDs, sound quality, and all the metadata, but that’s a small price to pay for the privilege of being able to listen to that music you lawfully acquired. Good thing you didn’t download it illegally or just buy it on CD!

Here’s a brilliant spoof of the Yahoo announcement that was sent to subscribers that I found at Digg.com:

Dear Consumer We would like to thank you for being a customer of the DRM Clothing Store. Unfortunately, DRM’d clothing has not been as successful as we hoped, and we will be discontinuing service effective as of noon today. At the time that we suspend operation, all the DRM’d clothing that you have purchased will spontaneously cease to exist. We appreciate that this may be inconvenient to many of you, particularly to those of you who are currently wearing our DRM’d clothing at, say, a business meeting, a funeral or a formal dinner. The DRM features in our clothing primarily affect the seams and stitching. If you use a sharp knife to separate your DRM’d clothing into separate fabric pieces, and then re-sew the clothing using your own needle and thread, the clothing will continue to function much as it did before. However, you must do so before noon today. We regret the inconvenience caused to our loyal customers and thank you for your custom. We trust you will look back on your time as a customer of the DRM Clothing Store as an exciting adventure in digital living. And to those of you who don’t receive this message in time, and find yourselves standing stark naked in a crowded subway car, trying to protect your modesty with an empty Starbucks cup and a day-old copy of the “New York Post”, we’d just like to say “DRM Clothing – life on the digital edge!” Yours sincerely, DRM Clothing P.S. No refunds will be issued.

Arguing a Yahoo! Account Suspension

Jeremy — Thu, 13 Mar 2008 11:18:06 +0000

I've had a Yahoo! account practically as long as I've been on the Internet. I've practically abandoned the mail because of the amount of spam it recieves every day, but I still use it from time to time and it has a lot of historical and nostalgic value due to the e-mails that are still in there. I've also used my account for the Yahoo! Answers service to help spread information about credit freezes and avoiding scams like lifelock. I'm guessing that last one is why I got a generic letter like this:

Oops Your account has been suspended. If you feel there has been a mistake, please contact us at answers-abuse@cc.yahoo-inc.com. Most likely, your account was suspended in violation of Yahoo! Answers community guidelines. Click here to read the full guidelines In the meantime, feel free to browse Yahoo! Answers * Back to Home

Ok. I'm pissed, but I'll give them a chance to explain themselves and I sent them this:

Your system is saying that my account is suspended and to read the guidelines. First, I've done nothing that would violate any reasonable guidelines and second, the link to your guidelines doesn't work. Third, I need you to re-instate the account and provide a reason for why you suspended it in the first place (assuming this isn't a glitch in the first place).

There was a quick exchange where they mentioned that they can't investigate without knowing the username I was complaining about. Oops. After that, I get this:

Hello, Thank you for writing to Yahoo! Answers. We appreciate your inquiry about your suspension from Yahoo! Answers and/or the deactivation of your Yahoo! ID. We reviewed your case, and decided that your account is not eligible for reinstatement. Once an account is disabled for a violation of the Terms of Service, the subscriber to the account will lose the ability to log in and access the account and its contents (including email and content stored with any other Yahoo! service). The account also will not be reactivated. Should you choose to create a new Yahoo! account, we invite you to read the Yahoo! Terms of Service and Yahoo! Community Guidelines to help ensure your new account is not deactivated. Yahoo! Terms of Service: http://info.yahoo.com/legal/us/yahoo/utos/utos-173.html Yahoo! Community Guidelines: http://answers.yahoo.com/info/community_guidelines.php Thank you again for contacting Yahoo! Answers. Regards, Johnny Yahoo! Customer Care 45742668 For assistance with all Yahoo! services please visit: http://help.yahoo.com/

Yeah. That's not going to work for me. My response (based in part on a very interesting article from the Consumerist that I read yesterday):

Unacceptable. You nebulously say that I have violated something in your terms of service with no justification, no explanation, and no recourse what-so-ever? And I'm supposed to guess which part of your TOS I allegedly violated and try again, abandoning the account I've held with you in good standing for over 10 years? I'm appalled at your complete lack of customer service in this regard. Even if I were to believe that I had legitimately done something wrong, how can you terminate an account with no warning or second chance? I expect that you will cite some technical difficulty in managing second chances, but I assure you it's a trivial process that I can teach your database admins to implement if you'd like. However, I don't expect you to be moved by simple logic so instead I offer this: If you intend to let this situation stand as-is, I will make sure that I tell my story. I am active in the Internet community and will submit this debacle to sites such at The Consumerist, Slashdot, Digg, and more, giving each the chance to hear what Yahoo! is really like. Further, I intend to write to Google offering to be a spokes person on their behalf, using my story as an example of why they are the better choice in all things. I'm sure they'd be interested in having another nail for the coffin. I will give you a period of time to respond to my request before taking any such action and I welcome you to prove me wrong and actually settle this in a reasonable manner. If so, I expect a justification for my expulsion AND immediate reinstatement of my account. Once I am actually aware of what provision of your TOS you claim I violated, I can make adjustments (if necessary). Jeremy

Now let's see what happens.

The Saga

Update 2008.03.18

Not surprising, but I'm baffled that I was right. Yahoo responded with a form letter:

[+] Yahoo's form letter response

Click the + to read it, but it's as bland and purposeless as you'd expect.

I've written an e-mail to "The Consumerist" hoping that they'l take an interest in this story or at least provide me with some advice on how to proceed. Sure I've got ideas, but I'd rather leverage the experience of the pros if possible.

[+] My letter asking for advice from The Consumerist

Click the + to read the e-mail.

[-] My letter asking for advice from The Consumerist

My Yahoo e-mail was the first online free e-mail account I ever had. While I don't use it much now, it has years of historical e-mails that I would rather not lose if I don't have to. However, Yahoo, in their infinite wisdom has disabled my account due to what they claim was a violation of the TOS when using their Yahoo Answers service. I have recently become very active in the Answer boards providing information about identity theft and why you should avoid credit monitoring and insurance (note that I have a very high ratio of "best answers" as well). Chances are they took issue with one of the following: 1) Almost every posting I made links back to my site. They might have considered that self promotion, but if I knew a better site that contained the information I wanted to reference, I would put it. I always fully answered the question only providing the link to my in-depth articles if they wanted to read more. 2) The more likely scenario is that I am a very vocal opponent of Lifelock. They've been getting a lot of press for their insurance service that they bill as "protection" though it doesn't protect anything but Todd Davis's bottom line. Recently, I've been doing daily searches for questions mentioning Lifelock and posting responses explaining why I believed it was a waste of time and money. Either way, they suspended my account with no warning and no justification. I complained via e-mail and recieved form letters again and again, even when I sent them one warning them that I would use my online voice and also offer to be a spokesperson for their competitor (Google in this case). So far, I've recieved nothing but form letters for the most part. Now, I already said I don't value the account THAT much, but the principle of it is driving me batty. It's like being kicked off the bus without warning, without explanation, and with no opportunity to correct whatever behavior I allegedly engaged in. So my question to you and your readers is, what should I do now? I've already blogged about it on my page (http://www.jeremyduffy.com/arguing-a-yahoo-account-suspension/) and will keep a journal of the events as they occur though considering my readership of like 3 people, that's not going to amount to much. I've also contacted one major online news site (that's you). What's next? Local news? Other major news sites? Contact Google as the "Unscrewed" author would have suggested? -Jeremy

Update 2008.04.08

Not getting much traction with some of the things I've tried, but I'm going to file a Better Business Bureau complaint and see what happens. Should be interesting.

[+] My BBB Complaint

Click the + to read my complaint to the BBB

And their response:

The case has been reviewed and has now been forwarded to the business for their response. This business has until April 30, 2008 to respond to your complaint. You may contact our office after April 30, 2008 to check the status of your complaint.

Mua ha ha ha! Forwarded to them for their response. So there.

Update 2008.04.13

Though they told me that I wouldn't be able to access my e-mail I checked today and it turns out that I can. Since I didn't try it before, I can't tell if was able to get to it all along or if this is somehow related to my BBB complaint. If I find out for sure, I'll post it.

Update 2008.04.24

[+] Yahoo's response to the BBB

[+] And my response to that

Update 2008.04.25

The BBB has noted that I said I didn't accept their response, but the BBB has closed the case anyway. Not surprising. Next, to Google:

I have always championed Google services over competitors with one exception: Yahoo Answers. Their interface is, sorry to say, superior to what Google offered. However, I recently had my account cancelled with no warning despite the fact that I was a highly rated contributor who was a subject matter expert in Identity Theft issues. Though they claim I violated their policy, I don't believe them and they have refused to provide any justification what-so-ever. If you are interested in promoting bad press about your competitor, I would be happy to be a spokesperson on your behalf. People should know that a company that treats customers as Yahoo does is not worth getting involved with. You can read about the entire issue here: http://www.jeremyduffy.com/arguing-a-yahoo-account-suspension/

My Advice to Others

When something like this happens, complaining to the Better Business Bureau and consumer protection sites like the Consumerist for publicity are good, but won't probably help. Yahoo has the right to deal with whoever they want and, at best, you can argue that as a company that so aggressively entices people to use their services, they have at least some measure of obligation to treat people fairly, but that's a stretch. In the end, the best possible thing you can do is avoid using Yahoo! services for anything. There are plenty of alternatives out there and I, for one, have no interest in spending time with a company that's willing to drop me at any time for no valid reason at all.