[djstarz]

[QUOTE=justinsayne]

..... So, once you have been hacked no matter how it has been done, Yahoo refuses to work with you to get it back, even though it is they themselves that allow your security information to be changed......

QUOTE]


Actually Yahoo did help me after over a month of emailing back and forth. I simply told them of several groups I had created in the yahoo groups that were innaccessible except by permission and 2 of the groups had at the time of my being hacked into, no members.

Unfortunatly the dumbass hacked many of my friends and once in deleted their accounts.. Made me look bad since he was such an to them when he had control of my account.

I always doubt posts like yours because I had several things going on Yahoo, a web page through geocities, a personals ad (which I had paid for on and off, unfortunately off at the time it happened), chat, email. They did nothing to help and even stopped responding to my email. I can email them now until I'm blue and they don't respond. I'm not the only one who they've done this too. They refuse to take any information from me except the "security information" which they allowed to be changed. They won't even accept the original answers.

As far as social engineering... I guess Yahoo socially engineers their accounts to be stolen...

[ScottGem]

I always doubt posts like yours because I had several things going on yahoo, a web page through geocities, a personals ad (which I had paid for on and off, unfortunately off at the time it happened), chat, email. They did nothing to help and even stopped responding to my email. I can email them now until I'm blue and they don't respond. I'm not the only one who they've done this too. They refuse to take any information from me except the "security information" which they allowed to be changed. They won't even accept the original answers.

As far as social engineering... I guess yahoo socially engineers their accounts to be stolen....

First on social engineering (which is the crux of this issue). Lets say you pay for the best locks on the doors of your house, but then you leave a key under the doormat. And a thief cases your home, notes someone reaching for the key and comes back later to rob the house. Is this the fault of the company that manufacturers the locks? Did the locks fail in any way? Did the lock manufacturer do anything to make it easier for someone to break into the house?

This is the essence of social engineering. Most breakins of computer networks occur because people are tricked into revealing passwords, leave passwords where they can be easily found or use passowrds that are easily guessed or broken. There is a scene from a Clear and Present Danger where CIA techs break a password in minutes by simply guessing obvious possibilities, in that case, it was the person's birthdate but backwards.

No one sets up anything to be social engineered. It's the users who make it easy to for someone to social engineer them. So blaming Yahoo for that is putting the blame in the wrong place. Sure Yahoo could add more levels of security, but that would make it more cumbersome to log in and use the service, which would make people go elsewhere. Or they could add additional security but at a fee.

So Yahoo didn't "allow" anything to be changed. Once someone lets someone into their account they are letting them change things.

That all being said. I do fault Yahoo for not helping the user regain control. I had a situation with a pay service, where my account was compromised. This was done through no fault of my own, but a lapse on the service that allowed someone into the account information database. I had to go through a few layers of security and fax copies of credit card statements showing my paying for the service, but eventually the account was recovered.

This is part of one of the problems with services like Yahoo. Anyone can setup an account with little ort no verification of data. If some verification was required, it would make it easier to recover compromised accounts.

[djstarz]

Of course it didn't help. In response to your letting Yahoo off the hook, while it can be agreed you get what you pay for, if Yahoo pretends to have security, but doesn't, it IS their fault.

In this case, Yahoo does several things that allow for this so-called social engineering. First, part of the security information is your birthdate, then they ask you to fill in your profile which they include your age. Part of the security information. Duh. Then they ask for your city. Well, if they're using your zip code for "security" the "hackers" only need to guess 1 or at least a limited amount of information.

As far as helping you get back your account. Help? They refuse. If you don't have the CURRENT zip code forget it. They get ruder and ruder as you beg them. I gave them IP address information. I even had a static IP at one of the computers I logged in from. I gave them IP range history. I pointed out to them that in their own email that they sent me information me my password had been changed they included an IP address that belonged to an ISP in California. I gave them the ORIGINAL security information and was willing to provide any additional information. They absolutely refused. They acted like I was trying to steal the account. They were rude and after a while, would not even answer my email.

[ScottGem]

Of course it didn't help. In response to your letting yahoo off the hook, while it can be agreed you get what you pay for, if yahoo pretends to have security, but doesn't, it IS their fault.

In this case, yahoo does several things that allow for this so-called social engineering. First, part of the security information is your birthdate, then they ask you to fill in your profile which they include your age. Part of the security information. Duh. Then they ask for your city. Well, if they're using your zip code for "security" the "hackers" only need to guess 1 or at least a limited amount of information.

As far as helping you get back your account. Help? They refuse. If you don't have the CURRENT zip code forget it. They get ruder and ruder as you beg them. I gave them IP address information. I even had a static IP at one of the computers I logged in from. I gave them IP range history. I pointed out to them that in their own email that they sent me information me my password had been changed they included an IP address that belonged to an ISP in California. I gave them the ORIGINAL security information and was willing to provide any additional information. They absolutely refused. They acted like I was trying to steal the account. They were rude and after a while, would not even answer my email.

Obviously Yahoo does have some security, they don't just "pretend" it. How adequate that security is open to interpretation. The security question is only used if you forget your password. If you know the password you can easily change the security info. Very few services I know have anything more. AOL, for example, offer a SecurID for a fee. This generates a random number every minute or so that is synchronized with your account.

Like I said, I fault Yahoo for not helping furthewr, but then I don't know their side of the story. Maybe you are the one trying to get into someone else's account.

My point here is that you have ragged Yahoo for some things that I don't believe are their fault. So I'm defending those points.

[candy_and_company]

Hi
Am new to this site,oh, by the way nice site!
My Yahoo account is not hacked that I know of,but I am locked out of it for 12 hours or so,which Yahoo told me how this is done.It's real easy.Anyone
Can do it. My question is HOW do I prevent this from happening?
This clown (have no idea) locks me out of this account,but I always seem
To get back in after 12 hours or so.Yes. I have other accounts on Yahoo,but this is my main one. Any suggestions? This has been going on now for the
Last 6 months. Yahoo can't get the ISP from who is doing this and ban that
ISP from Yahoo? or if that person has several ISP's from other computer?(work,friends house,etc.)
Thanks!

[LTheobald]

If you think somebody is getting into your account - Change your password and your security question.

Make the password a mix of number & letters and possibly special characters (! $, % etc.) Then don't tell it to anyone.

Also make sure the security question is something that only you will know. For example, "What was the name of my favourite childhood toy?". That question would not be something you would forget. At the same time the only people who will probably know the answer to this are you and your surrounding family - people you can trust.


Might also be worth scanning your PC for any spyware using the links in my signature - just in case.

[ScottGem]

I'm curious as to what do you mean by "locked out". What happens when you try to get in? What error messages do you get? Do you see any activity (like Sent mail or mail marked Read that you didn't read) when you get back in?

[candy_and_company]

Thanks Scott
I get a message"page unavailable" Can't remember what exactly comes up.
When I do get back in all is fine with my e-mails,and I never see anything
Suspious in there. I get the same response from Yahoo,that someone is always trying to get into my account and according to Yahoo,they "lock"
My account for security reasons. Then I have to wait sometimes 12 hours
To get back in. They tell me that if you log on to Yahoo,all you have to do is pretend you have forgotten your password. You click on "forget your ID or password?". You click on that and it takes you to another page where you have to prove "you" are that ID. You fill out things that you did when you joined Yahoo. Such as your birthday,zipcode,and where you live(USA,Canada,)etc. Then you put in your Yahoo name at the bottom of that page. But if someone knows your birthday and zipcode and what country you are from,they can type your Yahoo ID in ,change the password and they go in under your name.Yahoo makes this so simple. Then if you just guess where that person lives or their birthday and zip(any one of those subjects) and
Click on trying to change password about 6 to 8 times,Yahoo figures that someone is trying to log in and it's NOT you,they lock your account for your protection.And after they try 6 to 8 times,the top of the page will say "Temporary locked out to protect your account". I even made up another
ID and tried it,just to test the system. And it worked! Yahoo needs to improve this security at their servers,they even admit to that. So in reality,if you give someone your zipcode,birthdate.and what country to live in,they can actually get into your account and change your password. But in my case they are just guessing,and after a while I am locked out.! LOL.If you can try to read this and try to figure out what I am saying I hope I didn't give others on this site anything that would case grief on others.
Thanks
Candice

[LTheobald]

Page unavaliable doesn't mean you are locked out. That's the error message that's displayed when your internet browser could not find the page it was looking for - either due to troubles with your internet connection or Yahoo's servers being unavaliable.

[ScottGem]

Thanks Scott
I get a message"page unavailable" Can't remember what exactly comes up.
When I do get back in all is fine with my e-mails,and I never see anything
suspious in there. I get the same response from Yahoo,that someone is always trying to get into my account and according to Yahoo,they "lock"
my account for security reasons. Then I have to wait sometimes 12 hours

Ahh now I understand. As LT said I don't think this is due to locking. How do you get to the Internet?

[traka]

https://www.safe-mail.net/


Best email site, no ads !

[NeedKarma]

https://www.safe-mail.net/


Best email site, no ads !

But only 3MB storage is free.

[brooklyn630]

I just dealt with this - it took me four hours to figure out how to contact Yahoo to wrest control of my account back from the hacker. Call 866-562-7219 and ask to speak to customer service. They will work with you to get control of your account.