- This topic has 9 replies, 6 voices, and was last updated 20 years, 6 months ago by
.
-
Posts
-
The following is a PM I recieved this morning from tinethle.
tinethle wrote:Hello amy_d_g,I am writing this pm to inform you that I have been made aware of a trick that allows yahoo messenger accounts to use security keys without the need of a credit card.This is not a hack,or any exploit towards yahoo website,it is simply a trick someone has explained to me.I have tested this on several of my own yahoo accounts and I can confirm it does work,I have not tested sbc accounts,btinternet,dot names etc,just normal yahoo accounts.This is not phishing or any type of scam,I myself am aware of the dangers of the internet and as such I am generally very cautious when testing information brought to my attention.You may possibly be aware of this trick alreadly.
Obviously bigblueball yahoo messenger support is for support purposes only,as such I don’t know if such a topic would be suited to these forums.I only bring this to your attention as I feel it might benefit those who are concerned about account security and want to improve their security,and also to verify if such a topic would be permitted on the bigblueball yahoo support forum.
This would effect yahoo fiancially,as the credit cards are used by users who want to purchase yahoo accounts and security keys to secure their accounts and make them invulnerable to any malicious acts,so obviously I would’nt want to put this website into any legal issue with yahoo.
Thank you for your time,and of course you may decide to ignore this pm,but any reply would be greatly appreciated.
(ps)sorry for the message length.
rgds
tinethle.I sent him a reply thanking him for asking before he posted in the forum, and explained that I couldn’t give an answer right away as I know absolutely nothing about these security keys, in fact I don’t think I have ever heard of them before now. I asked him to send me more information and what exactly this ‘trick’ is. At first I thought it was a way to get around a paid service, which would definitely be a no-no, but as I read through Yahoo’s help on the subject, I’m not so sure. I couldn’t find a link to sign up for one of these, so I’m pretty lost. I will try and dig around later for it, but now it’s 6am and I just got home from work an hour ago, so my pillow is calling me… Does anyone have any idea about this?
Hmm, I haven’t heard of much like this myself, but it does sound a little bit close to the line. Personally, I wouldn’t allow the member to post, just to be on the safe side, but hey, it’s not up to me!
I would actually encourage him to forward this message to Yahoo! and certainly NOT post it in the forums. Why open the door to other hackers? Yes, it’s frightening thing…but then Yahoo! needs to be made aware of it so they can fix the bug quickly. If they don’t repsond to one e-mail about it…we ALL write and say we’re from BBB…or…just have Jeff do…he’s the one they may listen to the closest. 🙂 My 2 cents at least. (And very good they did write you before posting it!)
Amy, if he does forward the “trick” to you, please let me know. I have a contact at Yahoo who can probably help this get better attention than someone would get going through the normal channels.
I agree that this kind of information should not be posted in the forums, although if there is any defense against this trick (i.e. not entering certain essential personal information in your profile), that would be probably be good to publish (assuming it doesn’t give away obvious clues on the “trick”).
FWIW, I think Y! Security Key is new-ish.
There is now an option on your A/C info to add/change it. (But as it’s only for wallet.yahoo.com plus some other things I never use, I didn’t bother!).Ok, here is the response I got from him.
tinethle wrote:Hi Amy,thank you for the reply,
The yahoo security key has been around for many years,its purpose is to add an extra layer of protection to yahoo user accounts and yahoo email accounts.It adds the security by using a unique pin number(like an atm machine number)with is stored on yahoo’s database-on a secure server.This means that if an account is hacked or cracked and some of the info on the account is altered and the owner cannot access his account,he can simply email or phone yahoo and provide them with the security key pin number to retreive the account.
the security key is enough proof that you are the owner of that account,the hacker cannot access the security key,as it is not stored on the account itself,but on yahoo’s server or database.
In order to setup a security key,one would need to contact yahoo billing department,by phone or email,and change their original account from a free account to a paid account,its a once off small payment I think(for the security key)and the account is essentially unhackable.
It has come to my attention that a credit card needs to be present on yahoo file in order for the security key to work,so I essentially have setup invalid security keys as I have no proof that the keys are mine,because there is no evidence on file that I purchased my account(or security key)which makes me wonder why it was so easyfor me to setup a security key in the first place when I don’t have a credit card to begin with.
But I have looked in my account information and the change security key is present(listed under change password)which makes me wonder if yahoo do have my key on record,and if my key is valid.I’m not sure at this stage,I will need to look into this more,but thanks for your time,and I apologise for bringing this up when it wasnt 100% confirmed on my part.I’m glad I didnt post this as I would look a fool. lol.
Thank you again
take care
rgds,
tinethle.(ps)again sorry for the message length,and keep up the good work.
Trick explained:
First..go to this link:
http://help.yahoo.com/help/us/skey/skey-01.htmlAt the upper left hand corner of this page please note the area..”forgot security key”…..click here.
Now you are presented with a log in page…log in with your Yahoo ID you want to obtain a security key for.Now..you will be ask once again to verify your password…do so.
You are now presented with a page noting the header:
Yahoo Security Key Sign Up
Choose A Security Key
Now..enter the security key you have chosen and verify it.…[ hint..do not use your regular password as your security key ]
Now you are ask to select a secret question….then to supply an answer to the secret question
Please..use this example for security questions and answers:
Security Question..Favorite City
Security Question Answer:I like cheeto’s..[ no one is going to guess this type of security question answer ]Note your default e-mail address…[use a real e-mail address other than Yahoo]
Note your zip code and country..[it does not need to be your real zip code and may be differant than the one you have noted on your Yahoo account ].Now..print out this page for future reference.
Now simply click the submit button.
Hint:if you get a “page cannot be displayed ” message do not worry..simply use the “go back” feature of your browser.
You are now presented with a page asking you to verify your security key to continue..enter your security key and log in.
Here is the trick…You will receive a “page cannot be displayed message”.. at this point….Do not worry..simply hit the go back feature of your browser.You will then receive a page asking you to enter your security key to continue.
Do not enter your security key at this time…simply go to the top of the page and click the Yahoo icon.You will now be directed to Yahoo’s main page..and as you can see you are still logged in.
Click on the Yahoo Mail icon at the top of the Yahoo page.
Once in your mail account..click the account icon at the top of this page…enter your regular Yahoo password and you are now into your Yahoo account.Please note at this time the area of this page that says”change password”.
Look under this area.
Now you will also have a “Change your Security Key” notation here.You now have a security key…and your Yahoo Account is for all practical purposes unhackable.
Ok, so this isn’t a hack to hijack someone elses account, but a means of supposedly getting a security key without a credit card. The assumption being that having a security key will make your account “hack-proof.”
So, does having a security key make your account hack-proof, and if so, how?
Quote:Security Key
The Yahoo! Security Key is an additional optional layer of security to control access to sensitive information or services on Yahoo!. Users of financial services such as Yahoo! Wallet, PayDirect, Yahoo! Bill Pay, and Money Manager are asked to create a security key during the sign-up process or when you purchase certain services that require a Yahoo! Wallet. Please note that the Security Key automatically “times out” after an hour and requires the user to sign in again to access Security Key protected areas.Having a key will not make you unhackable. The Key is only actually used for certain areas of yahoo as indicated above. Someone can still steal your account if they crack your regular password. The only benefit would be that they could not change your Accounts security key without knowing it or the secret question you created. This would likely prove useful when dealing with Yahoo to recover the account.
Basically it won’t make you unhackable, but it will likely make it much easier to recover your account afterwards. Anyone agree?
Shifter, I think that ia exactly what it is. From what I understand, you have to pay for a key, and this method is a way to get one on your account for free. Tinelthe has agreed not to post it since it would be a violation of forum policies (as a cheat to get a paid service for free) and also because he doesn’t know if it actually works. The key is created with his method, but there is no way to know if it will help in recovering the account like a real key would, other than calling Yahoo up, and I don’t think he wants to try that. More than likely Yahoo would have some sort of record about those people that have paid, and would be able to tell that it is not a valid key.
I honestly don’t even think it’s a cheat. Sure the key is used for paid services, but you’re not actually paying for the key, it’s just a security feature. It’s not required on most Yahoo services, but that doesn’t mean you shouldn’t have it for free. You can’t buy the key on it own (AFAIK) and Yahoo is offering it freely and publicly here – https://global.secure.yahoo.com/config/forgot_secure. I don’t even see this as a trick, more of an unpromoted feature. Yahoo doesn’t see any reason to force you to use a key on unpaid services, so it doesn’t offer it up automatically. And I can’t see any reason as to why the key would be invalid. You don’t have to do anything sneaky to get it, you just have to use the Help system legitimately. I don’t see it as stealing, and I see no reason not to post it. But that’s my opinion, feel free to invalidate it!
- You must be logged in to reply to this topic.