5 ms·

So if a hotmail account expires, they allow just anyone to re-register it as their own email address? That sounds completely irresponsible.

semiquaver 17y ago
Yep. I tried to log into an old hotmail account last month and found that it had expired. I had no problem re-registering it. This is an inexcusable security flaw that should be obvious.
- sriramk 17y ago
  I'm guessing it is because all email providers recyle email ids/usernames after a period of inactivity. I don't know what Hotmail does but if I remember, they have a lockdown period (which is quite long) after which the username becomes available to the general public. I'm pretty sure Yahoo and Gmail do the same thing.
  - blasdel 17y ago
    Gmail accounts use to expire after a year of inactivity, but now will never expire on their own. I'm pretty sure they have never recycled old addresses automatically.
  - semiquaver 17y ago
    http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZXQ9ZW4tVVMmY3U9JnRtdD1Ib3RtYWlsUElNX0ZBUSZmb3JtYXQ9%29/help.aspx?querytype=topic&query=PIM_PROC_CloseAcct.htm http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZ... A free Hotmail account becomes inactive if you do not sign in for 30 days, or within the first 10 days after signing up for an account. Once an account becomes inactive, all messages, folders, and contacts are deleted, but the account name is still reserved. If the account stays inactive for a further 90 days, it is permanently deleted. I'm almost positive that the account I had to recreate was no more than 6-9 months inactive.
    - andreyf 17y ago
      Seriously? If I go traveling without internet access for over 30 days, they delete all of my stuff? Wow, no wonder GMail is kicking their ass :-/
imajes 17y ago
sure. but more irresponsible is that gmail doesn't recognize that the secondary address expired. It's fairly easy (with most MTAs) to structure a smtp session to discover if a recipient still exists. Google should be doing this regularly so they can alert users that they have a potential security risk if that email stops working. more fundamentally, the idea of being able to reset passwords like that is kind of insane. I'm a fan of one of the paypal models- they verify credit cards by sending a unique verification pin to the registered billing address. Not saying that would work here, but it's a nice example of mixing online and real world, and institutes a time lag.
- forgottenpasswd 17y ago
  I'm amused that some commenters (here and at TechCrunch) are accusing Google as the primary fault. I would say the opposite. Gmail is not perfect, but it has plenty of security measures compared to other mail services. For most users, the idea of that kind of password reset is convenient. And it's not easy as you claim nor practical to regularly check the existence of alternate emails, especially with the amount of users Gmail have. And by the way, they already have a new feature wherein you can use your mobile number to retrieve a password reset code. There is a feature in Gmail where you can see other currently and some previously logged in sessions. Perhaps it can be made more visible to the user, but it worked for me and had actually used it once to halt an intrusion (not really hacked, my password was automatically saved from another computer's Firefox). Lastly, another feature that makes me feel safer with Gmail is HTTPS and the ability to force your session to HTTPS whenever you log in.
  - andreyf 17y ago
    Perhaps it can be made more visible to the user It's pretty highly visible, especially when more than one person is logged in at once - it's highlighted you bright yellow. It's a brilliant touch - I check this every once in awhile, but have yet to find anything.

semiquaver 17y ago

Yep. I tried to log into an old hotmail account last month and found that it had expired. I had no problem re-registering it. This is an inexcusable security flaw that should be obvious.

sriramk 17y ago
I'm guessing it is because all email providers recyle email ids/usernames after a period of inactivity. I don't know what Hotmail does but if I remember, they have a lockdown period (which is quite long) after which the username becomes available to the general public. I'm pretty sure Yahoo and Gmail do the same thing.
- blasdel 17y ago
  Gmail accounts use to expire after a year of inactivity, but now will never expire on their own. I'm pretty sure they have never recycled old addresses automatically.
- semiquaver 17y ago
  http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZXQ9ZW4tVVMmY3U9JnRtdD1Ib3RtYWlsUElNX0ZBUSZmb3JtYXQ9%29/help.aspx?querytype=topic&query=PIM_PROC_CloseAcct.htm http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZ... A free Hotmail account becomes inactive if you do not sign in for 30 days, or within the first 10 days after signing up for an account. Once an account becomes inactive, all messages, folders, and contacts are deleted, but the account name is still reserved. If the account stays inactive for a further 90 days, it is permanently deleted. I'm almost positive that the account I had to recreate was no more than 6-9 months inactive.
  - andreyf 17y ago
    Seriously? If I go traveling without internet access for over 30 days, they delete all of my stuff? Wow, no wonder GMail is kicking their ass :-/

imajes 17y ago

sure. but more irresponsible is that gmail doesn't recognize that the secondary address expired. It's fairly easy (with most MTAs) to structure a smtp session to discover if a recipient still exists. Google should be doing this regularly so they can alert users that they have a potential security risk if that email stops working. more fundamentally, the idea of being able to reset passwords like that is kind of insane. I'm a fan of one of the paypal models- they verify credit cards by sending a unique verification pin to the registered billing address. Not saying that would work here, but it's a nice example of mixing online and real world, and institutes a time lag.

forgottenpasswd 17y ago
I'm amused that some commenters (here and at TechCrunch) are accusing Google as the primary fault. I would say the opposite. Gmail is not perfect, but it has plenty of security measures compared to other mail services. For most users, the idea of that kind of password reset is convenient. And it's not easy as you claim nor practical to regularly check the existence of alternate emails, especially with the amount of users Gmail have. And by the way, they already have a new feature wherein you can use your mobile number to retrieve a password reset code. There is a feature in Gmail where you can see other currently and some previously logged in sessions. Perhaps it can be made more visible to the user, but it worked for me and had actually used it once to halt an intrusion (not really hacked, my password was automatically saved from another computer's Firefox). Lastly, another feature that makes me feel safer with Gmail is HTTPS and the ability to force your session to HTTPS whenever you log in.
- andreyf 17y ago
  Perhaps it can be made more visible to the user It's pretty highly visible, especially when more than one person is logged in at once - it's highlighted you bright yellow. It's a brilliant touch - I check this every once in awhile, but have yet to find anything.