8

NBC News is running this story: "Experts: Don't Delete Your Yahoo! Account". According to the story, if your account's email is linked to your online banking account, deleting your account will allow a hacker to recreate it; so instead, you should change the password and security questions.

They didn't say what experts they consulted or quote any famous security gurus. Has this vulnerability ever been exploited in the wild? Is this sound advice?

Improve this question
2
  • Change your password yes, but deleting the account doesn't serve a purpose in this context.
    – 700 Software
    Commented Dec 16, 2016 at 20:12
  • Keep the account, delete all data, change password, change banking account email. Basically you don't want to delete your email accounts ever, if you used them for important stuff.
    – Samuel Shifterovich
    Commented Dec 16, 2016 at 20:35

2 Answers 2

Reset to default
7

Don't delete your entire account to avoid someone else registering it. Instead, delete saved emails and private information, and leave it with a strong password.

Especially if you used that email address to authenticate with other services (Facebook, online banking, GMail backup address, etc.) or gave it to a lot of people, you should keep it in your possession. Otherwise, an attacker could reclaim the address and simply ask these services for password reset links. Or one of your old contacts might write someday, assuming it's still you who owns the address. You should only delete the account if you can be sure that no entity trusts it anymore, neither your contacts nor any services.

Hence, it would have been sensible of Yahoo to block deleted addresses forever, but in their FAQ they say it's actually possible to register a previously used ID:

Register a previously used ID

A deleted Yahoo account ID may become available for future use, and you’re welcome to try to register it. However, Yahoo can't specify how long until a deleted ID may become available, and we can't guarantee that it will become available.

So, it's good advice to not delete your Yahoo ID to prevent new ownership and instead delete personal information from it to avoid damage in case of a new breach.

Improve this answer
4
  • It's worth noting that Yahoo hopefully has reacted in a way that at least currently excludes the affected accounts from re-registration. I've, however, not seen confirmation of that.
    – Marcus Müller
    Commented Dec 16, 2016 at 22:09
  • Isn't it easy to just remove that address from other services for authentication before deleting the account though? Why tell him to not delete the account when all it takes is making sure it's not used for anything?
    – user541686
    Commented Dec 17, 2016 at 5:29
  • 2
    @Mehrdad Can you always be sure that you removed the address from every associated service? What if the new owner contacts the customer service of, say, a payment site and claims the account was hacked and the email changed so that the customer service "restores" the old address? Even if you technically removed the address everywhere, someone could still trust it. If you can, you should avoid inheriting your email address.
    – Arminius
    Commented Dec 17, 2016 at 5:38
  • @Arminius: Well, I can be sure (I use a password manager with all my accounts), but I can't speak for everyone else. Regarding the social engineering aspect, the hacking excuse goes away if you wait a few months after switching and then delete the account. Not sure if hackers can find other excuses though.
    – user541686
    Commented Dec 17, 2016 at 5:50
3

You will want to maintain control of your account.

At the least, change the password. Then make sure you have a method in place to recover your account, such as using a gmail account or a phone number to get the "forgot password" inquiry.

Two-factor authentication is always a good idea, so even if someone gets your password they will not be able to use it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .