[165414] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: Yahoo is now recycling handles

daemon@ATHENA.MIT.EDU (Mark Seiden)
Wed Sep 4 00:48:45 2013

From: Mark Seiden <mis@seiden.com>
In-Reply-To: <5226B31E.4080903@kenweb.org>
Date: Tue, 3 Sep 2013 21:48:24 -0700
To: ml@kenweb.org
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org


On Sep 3, 2013, at 9:12 PM, ML <ml@kenweb.org> wrote:

> On 9/3/2013 11:57 PM, Scott Howard wrote:
>> Overall this is nothing new - Hotmail has been doing the same thing =
for
>> years.
>>=20
>>  Scott
>>=20
>=20
>=20
> When I used to use Hotmail - Your account was dropped after 30-60 days
> of non-use.
>=20
> Whereas Yahoo kept accounts active forever until recently.
>=20

as an ex yahoo security guy for many years, my recollection is this =
isn't the case.

starting 8-10 years ago accounts which went dormant for extended times =
had actions taken on them.

e.g. free accounts not logged into for a while (order of a year) had =
their old email archived, or maybe even erased,
i am not recalling exactly which...

accounts already in that inactive state could at any point have their =
names reclaimed, but the process of
doing that was (as i recall) a manual and infrequent one.  i remember it =
happening two or three times
over about 8 years, so that would make it a big batch about every year =
or two.

(several kinds of accounts, such as paid accounts, accounts managed for =
partners such as sbc and
rogers, and those deactivated for abuse were kept around forever in the =
deactivated state so they=20
couldn't be ever reregistered and reused for similar abuse.)

(yahoo internally understands the difference between the old account and =
the newly registered eponymous=20
account because account registration date (at the granularity of a week) =
is logically part of the yahoo id=20
whenever ids are used, exported, compared with other ids, looked up or =
stored in databases, etc..)
(it was a fairly common bug we would find in our security reviews for =
programmers to ignore=20
the regweek, for example, when exporting lists of ids for some purpose).

btw:

i don't think it's so unreasonable to treat a free account that hasn't =
been logged into for 2-3 years as
abandoned.   i agree it can have unfortunate side effects (particularly =
domain name takeover
of long-registered names).

in its early days, one of the reasons people switched to gmail was that =
they could get a better name there
than  e.g. blah32975@yahoo.com.

(this was slightly exacerbated because for a number of years if someone =
had  mis@yahoo.com,=20
the cohort address in other ccTlds such as blah32975@yahoo.co.uk was =
also not available to be=20
registered.)

approximately 5 years ago, yahoo split out some populous countries into =
their own name
spaces, which made a lot more names available to be registered.  there =
was a land rush,
in fact, to register "good names", and some people were not-so-amusingly =
trying to sell them.


>=20
> Granted it's been  >15 years since I've used a Hotmail account
> regularly.  Microsoft *may* change their policies more often than =
that.
>=20
>=20



home help back first fref pref prev next nref lref last post