Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 10 down vote favorite

Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?

And how come Yahoo Mail asks me to tell them my friends and folders names to give it back to me after being stolen?

share|improve this question

7 Answers

up vote 24 down vote accepted
  • Typically, your email provider (Yahoo, for example) can read everything in your email without knowing your password.
  • And they will, as required by law and potentially in other circumstances, provide copies to Law Enforcement and Government.
  • It is also possible that an attacker could compromise Yahoo's servers and access your email that way.
  • And an attacker might be able to get hold of your password in various ways, in which case the attacker can gain access to your email. Or, an attacker might be able to guess the answers to your security questions, which also is sufficient for the attacker to gain access to your email account.
  • Lastly, it's important to mention that emails are not just documents on your email server; they're also on the email server of the person who sent it to you, and maybe cached on your client, and maybe on their client, and backed up in various places, and they travel over the network. Lots of copies mean lots of places where an attacker can get hold of a copy. (Your question hints that you might just be storing documents in email without sending them, in which case this is less of an issue.)

Now, all this sounds very scary, but it's important in security to understand the level of risk and what your risk appetite is. Nothing is 100% secure - so you have to ask yourself: - How valuable is this data to me? What will it cost me if there is a breach? - What kind of attacker might try and get it? What resources and capabilities do they have?

If the data is not very valuable, and anyone who is likely to want it is not very capable, then you don't need a lot of security.

I'm not sure this is very practical, so here's some simple tips will help you improve the security of your stored email:

  • Choose a good password - not in a dictionary, not a name or a date, as long as possible, with a mixture of lowercase, upper case, symbols.
  • Don't use that same password anywhere else; don't write it down or tell anyone, and use something random that isn't connected to you.
  • Be careful about your answers to security questions, to make sure that no one will be able to guess them. If it looks like someone might be able to guess one of the answers to one of your security questions, you could consider lying (pick a random answer that will be unguessable), and write it down somewhere in case you ever need it.
  • Consider encrypting the documents (with a different password to the one used for your email). There are lots of good tools for this: I like http://www.sophos.com/en-us/products/free-tools/sophos-free-encryption.aspx. Don't rely on built-in passwords in Word or WinZip, use a dedicated encryption tool.
share|improve this answer
so email provider can read my emails, thats really so scary and how come they didnt mention it any where ? so if i use email to backup my PRIVATE FILES they can just go there and read. thats so much stupidity, thanks for ur answer i guess u answer the question all i was want to know if email provider can read my emails and files stored on its server without knowing the password or not, and they can so will search for some secure backup box somewhere else :(( – rezx May 9 '12 at 17:53
1  
Unless you encrypt your data before transferring it to a third party, you have to expect that whoever runs the service to which you transfer the data can read it. (Doesn't mean that they will.) Using good encryption will mitigate the problem of their ability to read it, but of course they will still be able to access the encrypted files just the same. – Michael Kjörling May 10 '12 at 8:24
4  
@rezx: Yes, they do mention it in the terms & conditions & privacy policy documents on which you clicked the I Agree button while signing up for their service. – Vikrant Chaudhary May 10 '12 at 9:50
@VikrantChaudhary - You assume rezx even read a single sentence of Yahoo's terms and conditions. – Ramhound May 10 '12 at 15:35
@rezx - When you give data to a third party and do not encrypt before giving it to them (HTTPS encryption doesn't count as that's only on the on the transport from your computer to their computer; you need to encrypt your data at your end, and upload it encrypted), you should expect them to be able to trivially read it. The only stupidity is the assumption that they could not read your emails/files. – dr jimbob May 10 '12 at 19:43
show 1 more comment
up vote 4 down vote

It's normally not possible to access your account without your password since it's the most used system for authenticating users.

But email providers tend to add a way to recover the access to an account that can lead to take control without the password : the "Security question".

This is a shame in term of security. Suppose that you defined your mother maiden name as the security question. All I have to do is find your facebook account (with some luck, you'll leave all the details available to the public), find if your mother is in your friends, and get informations about her, including her maiden name and BOUM, I have access to your email account.

This has been used already, including for celebrities like Sarah Pallin and it will still be possible while those stupid questions exists. For this, you have two possibility : either enter random value for the answer, knowing you won't never recover your account using this method (but neither an attacker), or you create your own question/answer, and make it difficult enough to not be found on the web.

GMail also suggest a better alternative to access your account, the two-factor authentification : Your password, and a code given to you by SMS. Enabling this guarantee you a accrued security for your account.

share|improve this answer
This is the reason I don't select questions for which the answer exists on the internet. Only a fool would actually provide an answer to a question with said answer in a public profile. – Ramhound May 10 '12 at 15:36
1  
Ask Sarah Pallin about that :D – Cyril N. May 10 '12 at 16:47
up vote 3 down vote

Just to point out what has not already been mentioned, the password could be leaked

  • If there were a keylogger on your machine, then the password would eventually be recorded.
  • If the same password was entered into a less secure site that got hacked (@Lucas touched on this)
    (it could be an insider that uses your password, not necessarily a hacker)

  • Or a look-alike site that was in control of a hacker. To prevent visiting look-alikes, always go to the website using a bookmark, to make sure you are on the real thing. You can of course look at the domain name, which is usually a darker color than the rest of the URL. Make sure every letter matches up (for example, mail.google.com is not the same as mail.googole.com, or mail.google.com.checkinbox123.example.com, since there are a lot of tricky typos, it is much easier to use a bookmark), the idea is not to get tricked into a look-alike by a link in an email someone sent you, or some other website.

    Example Look-alike page, I put this together in under 15 minutes, with a few more hours, I could have it sending passwords a server in my control, and you may not realize it.

  • If you are using an Outlook or other mail client that downloads the messages to your computer, then of course the messages are copied to your computer, and the password might not be necessary.

And how come yahoo mail ask me to tell them my friends and folders names to give it back to me after stolen?

Please link to where you see this, I would assume it is part of a manual recovery process, and if you can't answer these questions, they can throw your request out. But there may be more rules, I don't know.

share|improve this answer
up vote 2 down vote

No, it's not possible (unless you are one of those people that use the same password for every single account you own). It will be as secure as easy it is to access your account.

Yahoo will ask this information to make sure you are who you pretend to be.

Should this not be obvious:

  • anyone at Yahoo can access your account
  • make sure you are really on Yahoo (verify the SSL certificate)
  • Your security questions should be so personal nobody would ever be able to find out what they mean

Be sure:

  • Your machine is secure
  • Yahoo's SSL certificate hasn't been spoofed
  • There aren't any vulnerabilities in your computer or in the servers of Yahoo
  • There aren't any MITM attacks (for instance, someone obtained the private key for the Yahoo SSL certificate, obtained access to a router and can so read your emails when he reads the stream)
  • There aren't any rogue employees at Yahoo
  • You have a very secure password of minimum 16 characters long containing lower and upper case letters and additionally numbers. For extra strength add signs.
share|improve this answer
@ Lucas Kauffman so my email data will remain secure by my password, but how yahoo mail know my friends and folders if its encrypted? – rezx May 9 '12 at 13:04
Your files aren't encrypted, your password is. – Lucas Kauffman May 9 '12 at 13:08
2  
The passwords are probably hashed, which is better than encryption. Hashing (if done right) means it can't be decrypted, only compared. – George Bailey May 9 '12 at 13:21
That's what I meant oops :s – Lucas Kauffman May 9 '12 at 14:05
1  
What a godawful answer. An attacker could read your email without your password if you have insecure security questions. But also he might have a backdoor (due to a security vulnerability, or a rogue employee, or whatever). Or he could have brute-forced the password. Or you might have logged into a site that looked like yahoo but wasn't. And then (as mentioned) there's password reuse. The point is, saying "No, he can't get in without your password" is both false and meaningless, since you can't know the attacker doesn't have your password! – BlueRaja - Danny Pflughoeft May 9 '12 at 16:05
show 3 more comments
up vote 0 down vote

The integrity of your email security is limited by any weakest link. That includes all of the other answers plus any physical access to any duplicates with key extraction methods for passwords.

So get a security audit by professionals if the content is worth it.

(CounterPane Internet Security was one such professional group now owned by BT Group)

share|improve this answer
up vote 0 down vote

I think Lucas Kauffman made a very important point in his answer: "Be sure Your machine is secure".

I'd like to expand a bit on this, because it is a critical issue that people tend to overlook.

One example of an insecure scenario (and fairly common one) is that domain administrators in a corporate environment have access to employees' computer resources. In this scenario someone could steal your browser cookies (which are typically stored on the hard drive in plain text) and, provided you are logged in on some websites, can basically steal your sessions.

Thus, in the case of web email like Yahoo, someone could be able to access your account to read and even send emails, without knowing your password.

share|improve this answer
up vote -1 down vote

The answer to your question depents on what steps you have taken to secure your account, but do not just depending on a password. Simply put, passwords are the form of security from the past and are just not sufficient any more. If you are truly concerned about your email account, what I would do is look for providers who offer 2FA (two-factor authentication) where you can telesign into your account. I also have contacted some of the organizations to see if they plan on providing 2FA. When I have this, it gives me the confidence that my account won't get hacked and my personal information isn't vulnerable. And this is an option available to you by your provider.

share|improve this answer
2-Factor doesn't address the question, which is "can my mail be read by someone without the password." – Graham Hill May 11 '12 at 11:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.