Menu
Facebook and Yahoo prevent use of recycled email addresses to hijack accounts

Facebook and Yahoo prevent use of recycled email addresses to hijack accounts

A new mechanism helps email servers determine if a message was intended for a recycled account's previous owner

Facebook and Yahoo have developed a mechanism to prevent the owners of recycled email addresses from hijacking accounts that were registered on other sites using those addresses in the past.

Last year, Yahoo announced a policy that involves deleting inactive email accounts and making their IDs available again for registration. Microsoft has been doing the same with Outlook.com accounts.

The practice of recycling email addresses has been criticized by security and privacy experts because it opens up the door to abuse. Attackers could register deleted addresses and take over accounts on third-party sites that use them for confirming password change requests. In addition, the recycled addresses might continue to receive messages containing sensitive information that is destined for their previous owners.

Facebook's security team studied the impact of email address recycling for the site's users and has worked with Yahoo to mitigate the potential security risks. Employees from the two companies have developed a mechanism that involves adding a new field in the header of sensitive email messages to include the date since the sender has known the recipient's address.

The email provider can check if the receiving account has changed owners since the date specified in this field, and if it has, it can block the message from being delivered because it was likely intended for a previous owner.

The new field is called Require-Recipient-Valid-Since and is defined as part of an extension to the Simple Mail Transfer Protocol (SMTP) called RRVS. For now the mechanism is used by Facebook and Yahoo, but the new SMTP extension was published as a proposed standard by the Internet Engineering Task Force and can be adopted by others as well.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags Yahooonline safetyMicrosoftsecurityAccess control and authenticationIdentity fraud / theftprivacyFacebook

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments