Menu
Facebook and Yahoo prevent use of recycled email addresses to hijack accounts

Facebook and Yahoo prevent use of recycled email addresses to hijack accounts

A new mechanism helps email servers determine if a message was intended for a recycled account's previous owner

Facebook and Yahoo have developed a mechanism to prevent the owners of recycled email addresses from hijacking accounts that were registered on other sites using those addresses in the past.

Last year, Yahoo announced a policy that involves deleting inactive email accounts and making their IDs available again for registration. Microsoft has been doing the same with Outlook.com accounts.

The practice of recycling email addresses has been criticized by security and privacy experts because it opens up the door to abuse. Attackers could register deleted addresses and take over accounts on third-party sites that use them for confirming password change requests. In addition, the recycled addresses might continue to receive messages containing sensitive information that is destined for their previous owners.

Facebook's security team studied the impact of email address recycling for the site's users and has worked with Yahoo to mitigate the potential security risks. Employees from the two companies have developed a mechanism that involves adding a new field in the header of sensitive email messages to include the date since the sender has known the recipient's address.

The email provider can check if the receiving account has changed owners since the date specified in this field, and if it has, it can block the message from being delivered because it was likely intended for a previous owner.

The new field is called Require-Recipient-Valid-Since and is defined as part of an extension to the Simple Mail Transfer Protocol (SMTP) called RRVS. For now the mechanism is used by Facebook and Yahoo, but the new SMTP extension was published as a proposed standard by the Internet Engineering Task Force and can be adopted by others as well.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Yahooonline safetyMicrosoftsecurityAccess control and authenticationIdentity fraud / theftprivacyFacebook

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments