Yahoo plans to tighten security on its dating site after a security expert uncovered a method for breaking into members' accounts.
The main problem is that Yahoo Personals ads contain clues about key personal information--namely birth date and ZIP code--that members also use to reset their passwords. If an intruder obtains that data, the only thing that would block him from changing passwords and accessing accounts are members' secret questions, such as "What's your pet's name?" "What is your favorite pastime?" and "What is your all-time favorite sports team?"
In the age of instant messaging and e-mail, answers to such questions are often easy to obtain with a bit of social engineering, said Bennett Haselton, a freelance programmer and Internet free-speech advocate in Seattle who discovered the weakness. "It's the kind of thing that you could ask someone without arousing their suspicion," Haselton said in an e-mail exchange.
The weakness weighs in low on the risk scale; it involves more effort than the average hack. And there's not much to gain. Yahoo Personals does not disclose credit card numbers or other data that could be used for financial gain on its members' account pages. In fact, most members use a screen alias, which further obscures their identity. "It requires a fair amount of time and work until you actually get into those accounts," said Sacha Faust, a senior research engineer at SPI Dynamics, a computer security firm in Atlanta.
Tools: Post a comment | Link to this news item | Send to a friend | Submit News
Error: You are not logged in.
In order to leave comments to news articles you must be a Cyber Tech Help Member.
Registration is completely free!
Register to become a member
Along with access to leave comments to news articles you will be able to ask any computing questions you might have on the Cyber Tech Help Forums.
