Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?
And how come Yahoo Mail asks me to tell them my friends and folders names to give it back to me after being stolen?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Now, all this sounds very scary, but it's important in security to understand the level of risk and what your risk appetite is. Nothing is 100% secure - so you have to ask yourself: - How valuable is this data to me? What will it cost me if there is a breach? - What kind of attacker might try and get it? What resources and capabilities do they have?
If the data is not very valuable, and anyone who is likely to want it is not very capable, then you don't need a lot of security.
I'm not sure this is very practical, so here's some simple tips will help you improve the security of your stored email:
It's normally not possible to access your account without your password since it's the most used system for authenticating users. But email providers tend to add a way to recover the access to an account that can lead to take control without the password: the "Security question".
This is a shame in terms of security. Suppose that you defined your mother maiden name as the security question. All I have to do is find your Facebook account (with some luck, you'll leave all the details available to the public), find if your mother is in your friends, and get information about her, including her maiden name and BOOM, I have access to your email account. This has been demonstrated already, including for celebrities like Sarah Palin and it will still be possible as long as such inherently insecure questions exist.
To protect against this you have two possibilities:
Gmail also suggests a better alternative to access your account called two-factor authentication. This way login requires both your password and a code given to you by SMS (or the Google Authenticator app on your phone). Enabling this guarantees you an additional level of security for your account.
Just to point out what has not already been mentioned, the password could be leaked
Or a look-alike site that was in control of a hacker. To prevent visiting look-alikes, always go to the website using a bookmark, to make sure you are on the real thing. You can of course look at the domain name, which is usually a darker color than the rest of the URL. Make sure every letter matches up (for example,
mail.google.com is not the same as
mail.google.com.checkinbox123.example.com, since there are a lot of tricky typos, it is much easier to use a bookmark), the idea is not to get tricked into a look-alike by a link in an email someone sent you, or some other website.
Example Look-alike page, I put this together in under 15 minutes, with a few more hours, I could have it sending passwords a server in my control, and you may not realize it.
If you are using an Outlook or other mail client that downloads the messages to your computer, then of course the messages are copied to your computer, and the password might not be necessary.
And how come yahoo mail ask me to tell them my friends and folders names to give it back to me after stolen?
Please link to where you see this, I would assume it is part of a manual recovery process, and if you can't answer these questions, they can throw your request out. But there may be more rules, I don't know.
No, it's not possible (unless you are one of those people that use the same password for every single account you own). It will be as secure as easy it is to access your account.
Yahoo will ask this information to make sure you are who you pretend to be.
Should this not be obvious:
The integrity of your email security is limited by any weakest link. That includes all of the other answers plus any physical access to any duplicates with key extraction methods for passwords.
So get a security audit by professionals if the content is worth it.
I think Lucas Kauffman made a very important point in his answer: "Be sure Your machine is secure".
I'd like to expand a bit on this, because it is a critical issue that people tend to overlook.
One example of an insecure scenario (and fairly common one) is that domain administrators in a corporate environment have access to employees' computer resources. In this scenario someone could steal your browser cookies (which are typically stored on the hard drive in plain text) and, provided you are logged in on some websites, can basically steal your sessions.
Thus, in the case of web email like Yahoo, someone could be able to access your account to read and even send emails, without knowing your password.
The answer to your question depents on what steps you have taken to secure your account, but do not just depending on a password. Simply put, passwords are the form of security from the past and are just not sufficient any more. If you are truly concerned about your email account, what I would do is look for providers who offer 2FA (two-factor authentication) where you can telesign into your account. I also have contacted some of the organizations to see if they plan on providing 2FA. When I have this, it gives me the confidence that my account won't get hacked and my personal information isn't vulnerable. And this is an option available to you by your provider.