5 ms·

Also a massive security hole. I needed to do a password reset on my old ebay account, but the hotmail account it was attached to was deleted, so I just created

by px43 6y ago

Also a massive security hole. I needed to do a password reset on my old ebay account, but the hotmail account it was attached to was deleted, so I just created a new hotmail account with the same name, and reset my password. I've done this maybe three or four time, because I haven't used hotmail since high school, so they keep deleting it. A lot of people also have password resets on gmail linked to their old hotmail accounts, so you can just re-create their old hotmail to hijack their current gmail.

spicybright 6y ago
Omg, yikes. Email is the universal "password reset" mechanism for the whole web too. Re-using emails sounds like a bad plan just from the start, surprised services allow that.
- bigiain 6y ago
  To be fair, email account providers - and particularly free ones like hotmail/yahoo/gmail - never agreed to be your partner providing banking/military grade security to the rest of your online accounts. Same as how your telco never agreed to have SMS be a secure protocol for 2FA or password resets.[1] Far from being surprised free email services "allow reusing emails", I'm way more surprised that orgs like banks and PayPal and crypto exchanges allow using email or sms as "secure reset or 2FA" protocols. 1: http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...
- will_pseudonym 6y ago
  I've gotten bitten by Google locking me out of an account because I hadn't logged into it in a long time, and the device that I used to log into it was stolen long ago. Even though I have full access to the recovery email address on that account, because it's an unknown device, Google blocks me from accessing it. In a similar way but a different mechanism, I also had the same thing happen with some accounts which I had opened up using my mobile phone number. I have struggled with mental illness throughout my life, and one of the things that can happen through crises in particular that can have vicious consequences is having no ability to regulate your behavior, in particular your finances, so you easily and quickly wrack up debt, cash out retirement accounts and blow through all that money, and being unable to pay your phone bill (or any other bill) leads you to losing that phone number, and any account which you access through that number. The systems that we use as a society to authenticate identity for access to digital services and systems, is incredibly punishing to people who struggle with mental health issues. It's a bit of an own goal, since some of the potential solutions to it are potentially technical in nature rather than requiring legislative or societal action. That said, the difficulties presented by the digital world to people who struggle with mental illness pale in comparison to those they face in the physical world, and how ineffective the society, governments, and medicine are at helping those people, sometimes hurting them in that process through lack of training, ability, and the flaws in the design of the overall systems.
  - richardfey 6y ago
    Not just for people with mental illnesses, think about our aging population and anybody in general: there are too many signals to regulate a modern functional life, saying that it is stressful by design would be an understatement.
indianhippie 6y ago
Definitely! A while back Yahoo! purged a ton of addresses and allowed individuals to signup with them to get unique/clean email handles. I was able to grab myfirstname@yahoo.com. The address looks neat. Since I’ve had that address, I’ve received password reset emails, bank documents, airline tickets and what not. Massive security hole is an understatement.
- Fifer82 6y ago
  The old yahoo chat days were my favourite internet days. I used to have a great friendship with people in "Hackers Lounge: 1" and everyone used to be 1337 for cracking original names like you said. I got my first name, and a few friends and I had illegals like \\//\\//estside and H a C K e R and .oO(d00t) which weren't compatible with the email service. It's a pity that a generation later, the internet meant facebook and not the kind of inquisitive fun I experienced! (maybe I should have played more sport lol).
cm2012 6y ago
I used to know somebody who would take stuff from old abandoned neopets accounts that way. They would often have their email address in their neopets profile, it would be expired, he would make it and reset the password.
- rwmurrayVT 6y ago
  That's an absolute blast from the past.
djsumdog 6y ago
I don't think Gmail allows this. I explicitly deleted all my old gmail addresses and moved back to my own mail servers in 2013 (due to Snowden/domestic spying .. sad how so few people did anything due to that) and I remember reading that once I deleted the e-mail address, I could never create it again. I made sure I had moved over all the accounts I cared about to my new e-mail address first.
- acruns 6y ago
  This is true of Gmail, once an address or account is deleted by its owner that email address is gone for good.
will4274 6y ago
You're actually talking about a different thing than parent. You can delete account data without recycling the account name. Nowadays, Microsoft still deletes inactive accounts, but they don't recycle the names. Of course, phone numbers are recycled by telephone providers. So that'll be fun in a few years.

by px43 6y ago

spicybright 6y ago

Omg, yikes. Email is the universal "password reset" mechanism for the whole web too. Re-using emails sounds like a bad plan just from the start, surprised services allow that.

bigiain 6y ago
To be fair, email account providers - and particularly free ones like hotmail/yahoo/gmail - never agreed to be your partner providing banking/military grade security to the rest of your online accounts. Same as how your telco never agreed to have SMS be a secure protocol for 2FA or password resets.[1] Far from being surprised free email services "allow reusing emails", I'm way more surprised that orgs like banks and PayPal and crypto exchanges allow using email or sms as "secure reset or 2FA" protocols. 1: http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...
will_pseudonym 6y ago
I've gotten bitten by Google locking me out of an account because I hadn't logged into it in a long time, and the device that I used to log into it was stolen long ago. Even though I have full access to the recovery email address on that account, because it's an unknown device, Google blocks me from accessing it. In a similar way but a different mechanism, I also had the same thing happen with some accounts which I had opened up using my mobile phone number. I have struggled with mental illness throughout my life, and one of the things that can happen through crises in particular that can have vicious consequences is having no ability to regulate your behavior, in particular your finances, so you easily and quickly wrack up debt, cash out retirement accounts and blow through all that money, and being unable to pay your phone bill (or any other bill) leads you to losing that phone number, and any account which you access through that number. The systems that we use as a society to authenticate identity for access to digital services and systems, is incredibly punishing to people who struggle with mental health issues. It's a bit of an own goal, since some of the potential solutions to it are potentially technical in nature rather than requiring legislative or societal action. That said, the difficulties presented by the digital world to people who struggle with mental illness pale in comparison to those they face in the physical world, and how ineffective the society, governments, and medicine are at helping those people, sometimes hurting them in that process through lack of training, ability, and the flaws in the design of the overall systems.
- richardfey 6y ago
  Not just for people with mental illnesses, think about our aging population and anybody in general: there are too many signals to regulate a modern functional life, saying that it is stressful by design would be an understatement.

indianhippie 6y ago

Definitely! A while back Yahoo! purged a ton of addresses and allowed individuals to signup with them to get unique/clean email handles. I was able to grab myfirstname@yahoo.com. The address looks neat. Since I’ve had that address, I’ve received password reset emails, bank documents, airline tickets and what not. Massive security hole is an understatement.

Fifer82 6y ago
The old yahoo chat days were my favourite internet days. I used to have a great friendship with people in "Hackers Lounge: 1" and everyone used to be 1337 for cracking original names like you said. I got my first name, and a few friends and I had illegals like \\//\\//estside and H a C K e R and .oO(d00t) which weren't compatible with the email service. It's a pity that a generation later, the internet meant facebook and not the kind of inquisitive fun I experienced! (maybe I should have played more sport lol).

cm2012 6y ago

I used to know somebody who would take stuff from old abandoned neopets accounts that way. They would often have their email address in their neopets profile, it would be expired, he would make it and reset the password.

rwmurrayVT 6y ago
That's an absolute blast from the past.

djsumdog 6y ago

I don't think Gmail allows this. I explicitly deleted all my old gmail addresses and moved back to my own mail servers in 2013 (due to Snowden/domestic spying .. sad how so few people did anything due to that) and I remember reading that once I deleted the e-mail address, I could never create it again. I made sure I had moved over all the accounts I cared about to my new e-mail address first.

acruns 6y ago
This is true of Gmail, once an address or account is deleted by its owner that email address is gone for good.

will4274 6y ago

You're actually talking about a different thing than parent. You can delete account data without recycling the account name. Nowadays, Microsoft still deletes inactive accounts, but they don't recycle the names. Of course, phone numbers are recycled by telephone providers. So that'll be fun in a few years.