Yahoo Email 2 factor fail

2 points by biff 10 years ago | 1 comment

So. I had a Yahoo! mail account.

A half-hour ago, I attempted to log into it. It's a long-neglected thing, something I care about on a roughly 12-18 month basis. Gave CmdrTaco well-wishes through it once, back when it was merited, otherwise it largely collected spam and served as my Slashdot contact if I forgot my password.

After attempting to log into my Yahoo! account tonight, after what must be ten+ years of my account's existence, I now receive this: "Traveling somewhere new?", and a link to a hidden e-mail address where a code can be sent to verify, well, me.

I remember my username and password. But, and this might be super-archaic, I also remember a time when this was sufficient to give me access to my account. I haven't a clue where b@p.net is. I've suspicion it was an 11+ year old redirect to an ISP email address I haven't had for 11+ years, and it is of no use to me that I can send a code to it in lieu of them allowing me to log in with, you know, the actual credentials I have and have supplied to them when creating the account.

I post this whining to Hacker News for this: please, don't chase an idea so far that you lose sight of your users' actual needs. In this case, 2-factor only matters if I can be counted on to know both factors.

biff 10 years ago |

I was limited in what I could write in the post, but this was something that just hit me after years of being able to log in with my username/password on Yahoo!.

I'm sure it was a well-intentioned guard against spammers that mercilessly attack Yahoo! accounts, but it's effectively locked me out as a genuine user. I'm definitely miffed because it'll cost me, but at the same time, I implement systems like this for small businesses for a living, and it's a constant thing on my mind how what I do will impact users down the line. I get so nervous about inadvertently pulling something like this!