Can my email account be accessed without the password? How secure is it?

Question

Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?

And how come Yahoo Mail asks me to tell them my friends and folders names to give it back to me after being stolen?

Answer 1

• Typically, your email provider (Yahoo, for example) can read everything in your email without knowing your password.
• And they will, as required by law and potentially in other circumstances, provide copies to Law Enforcement and Government.
• It is also possible that an attacker could compromise Yahoo's servers and access your email that way.
• And an attacker might be able to get hold of your password in various ways, in which case the attacker can gain access to your email. Or, an attacker might be able to guess the answers to your security questions, which also is sufficient for the attacker to gain access to your email account.
• Lastly, it's important to mention that emails are not just documents on your email server; they're also on the email server of the person who sent it to you, and maybe cached on your client, and maybe on their client, and backed up in various places, and they travel over the network. Lots of copies mean lots of places where an attacker can get hold of a copy. (Your question hints that you might just be storing documents in email without sending them, in which case this is less of an issue.)

Now, all this sounds very scary, but it's important in security to understand the level of risk and what your risk appetite is. Nothing is 100% secure - so you have to ask yourself: - How valuable is this data to me? What will it cost me if there is a breach? - What kind of attacker might try and get it? What resources and capabilities do they have?

If the data is not very valuable, and anyone who is likely to want it is not very capable, then you don't need a lot of security.

I'm not sure this is very practical, so here's some simple tips will help you improve the security of your stored email:

• Choose a good password - not in a dictionary, not a name or a date, as long as possible, with a mixture of lowercase, upper case, symbols.
• Don't use that same password anywhere else; don't write it down or tell anyone, and use something random that isn't connected to you.
• Be careful about your answers to security questions, to make sure that no one will be able to guess them. If it looks like someone might be able to guess one of the answers to one of your security questions, you could consider lying (pick a random answer that will be unguessable), and write it down somewhere in case you ever need it.
• Consider encrypting the documents (with a different password to the one used for your email). There are lots of good tools for this: I like http://www.sophos.com/en-us/products/free-tools/sophos-free-encryption.aspx. Don't rely on built-in passwords in Word or WinZip, use a dedicated encryption tool.

Answer 2

It's normally not possible to access your account without your password since it's the most used system for authenticating users. But email providers tend to add a way to recover the access to an account that can lead to take control without the password: the "Security question".

This is a shame in terms of security. Suppose that you defined your mother maiden name as the security question. All I have to do is find your Facebook account (with some luck, you'll leave all the details available to the public), find if your mother is in your friends, and get information about her, including her maiden name and BOOM, I have access to your email account. This has been demonstrated already, including for celebrities like Sarah Palin and it will still be possible as long as such inherently insecure questions exist.

To protect against this you have two possibilities:

1. Enter a random value for the answer knowing you'll never be able to recover your account using this method, but neither can an attacker.
2. Create your own question/answer and make it difficult enough to not be found on the web.

Gmail also suggests a better alternative to access your account called two-factor authentication. This way login requires both your password and a code given to you by SMS (or the Google Authenticator app on your phone). Enabling this guarantees you an additional level of security for your account.

Answer 3

Just to point out what has not already been mentioned, the password could be leaked

• If there were a keylogger on your machine, then the password would eventually be recorded.
• If the same password was entered into a less secure site that got hacked (@Lucas touched on this)
  (it could be an insider that uses your password, not necessarily a hacker)

• Or a look-alike site that was in control of a hacker. To prevent visiting look-alikes, always go to the website using a bookmark, to make sure you are on the real thing. You can of course look at the domain name, which is usually a darker color than the rest of the URL. Make sure every letter matches up (for example, mail.google.com is not the same as mail.googole.com, or mail.google.com.checkinbox123.example.com, since there are a lot of tricky typos, it is much easier to use a bookmark), the idea is not to get tricked into a look-alike by a link in an email someone sent you, or some other website.

  Example Look-alike page, I put this together in under 15 minutes, with a few more hours, I could have it sending passwords a server in my control, and you may not realize it.

• If you are using an Outlook or other mail client that downloads the messages to your computer, then of course the messages are copied to your computer, and the password might not be necessary.

And how come yahoo mail ask me to tell them my friends and folders names to give it back to me after stolen?

Please link to where you see this, I would assume it is part of a manual recovery process, and if you can't answer these questions, they can throw your request out. But there may be more rules, I don't know.

Answer 4

No, it's not possible (unless you are one of those people that use the same password for every single account you own). It will be as secure as easy it is to access your account.

Yahoo will ask this information to make sure you are who you pretend to be.

Should this not be obvious:

• anyone at Yahoo can access your account
• make sure you are really on Yahoo (verify the SSL certificate)
• Your security questions should be so personal nobody would ever be able to find out what they mean

Be sure:

• Your machine is secure
• Yahoo's SSL certificate hasn't been spoofed
• There aren't any vulnerabilities in your computer or in the servers of Yahoo
• There aren't any MITM attacks (for instance, someone obtained the private key for the Yahoo SSL certificate, obtained access to a router and can so read your emails when he reads the stream)
• There aren't any rogue employees at Yahoo
• You have a very secure password of minimum 16 characters long containing lower and upper case letters and additionally numbers. For extra strength add signs.

Answer 5

The integrity of your email security is limited by any weakest link. That includes all of the other answers plus any physical access to any duplicates with key extraction methods for passwords.

So get a security audit by professionals if the content is worth it.

(CounterPane Internet Security was one such professional group now owned by BT Group)

Answer 6

I think Lucas Kauffman made a very important point in his answer: "Be sure Your machine is secure".

I'd like to expand a bit on this, because it is a critical issue that people tend to overlook.

One example of an insecure scenario (and fairly common one) is that domain administrators in a corporate environment have access to employees' computer resources. In this scenario someone could steal your browser cookies (which are typically stored on the hard drive in plain text) and, provided you are logged in on some websites, can basically steal your sessions.

Thus, in the case of web email like Yahoo, someone could be able to access your account to read and even send emails, without knowing your password.

Answer 7

The answer to your question depents on what steps you have taken to secure your account, but do not just depending on a password. Simply put, passwords are the form of security from the past and are just not sufficient any more. If you are truly concerned about your email account, what I would do is look for providers who offer 2FA (two-factor authentication) where you can telesign into your account. I also have contacted some of the organizations to see if they plan on providing 2FA. When I have this, it gives me the confidence that my account won't get hacked and my personal information isn't vulnerable. And this is an option available to you by your provider.