Slashdot Mirror
Yahoo To Open Up Email Authentication
Aditi.Tuteja writes, "Yahoo has announced it will give away the browser-based authentication used in its email service, considered to be the company's 'crown jewels.' Yahoo made the announcement ahead of a 24-hour 'Yahoo Hack Day,' where it had invited more than 500 mostly youthful outside programmers to build new applications using Yahoo services. Considering the different needs of its huge user base (257 million people use Yahoo Mail), Yahoo has decided it can't build or buy enough innovation, so they are enlisting the worldwide developer community." The code will be released late in 2006. Yahoo notes that there are 'no security risks' since they keep absolute control of usernames and passwords.
Now if they can just work on all the spammers, and fake porn bots that infest the network, then they may have something going for them. Hiring the world to do thier work. BRILLIANT!
How the hell did I get such bad karma? I blame the meds...
In their struggle to maintain relevance in the face of Google, Yahoo has really done a complete 180 from the days when their main service was a manually-reviewed index of websites. They've had the good sense to keep their noses out of (e.g. Flickr), and they've made some cool products/technologies available to the developer community for free.
Google gets all the press nowadays, but Yahoo's been pretty cool lately as well. Props!
Game... blouses.
How many of those 257 million users are spambots?
...social websites allowing their users to customize the css templates of their profile pages. There would surely be a few good innovations but like 70% of my friends "customized profile pages", most would visually painful enough that.. arrghhh..!! *head explodes*
...but it sounds to me that they're trying to get their work done for free by using OSS devs.
/* Shrugs */
Then again, Yahoo != M$.
(on an unrelated note, the new webmail service is rather slick.)
Does this mean that I'll be finally able to login into Yahoo email with the built-in password handling in Firefox?
If so, I'll believe it when I see it.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
...that the quote-thing in the footer says 'If it ain't broke, don't fix it.'
Matches are only dangerous when used correctly- MurderDeathKill
Geez.... their spam filters are non-existant.
could they not just conform to a standard ?
regards
John Jones
The other thing I'd like to see is full support for Mozilla's Firefox browser as far as Yahoo's Launchcast service is concerned. Don't mention that GreaseMonkey extension. All I want to see is full support. They are doing a fiar job when it comes to video on their news service. But music is still wanting.
Maybe they could also allow users to forward emails from their Yahoo accounts for free. This doesn't sound very innovative, but I know a lot of people who have backed away from Yahoo's emailing system because of this.
This would probably spark a wave of more efficient & integrated Web 2.0 Mashups.
Come on Yahoo...is that authentication code really a crown jewel? I am no coder but really wonder whether that title fits what the subject is here. What if we find that most if not all of this authentication code was lifted from BSD?
... problems with the Yahoo! accounts.
It isn't hard to takeover someone else's account, but if someone out there does so, make sure to get written permission from the person first so you're not committing a crime.
Their forgotten password security system is very lax, and it's fairly easy to gain access to someone's account with a bit of googling. The zip code information, the birthday information, and the secret question information, all can be obtained by someone's personal website usually. Someone will mention where they live, their birthdate, and might have a journal containing their secret question's password.
Yahoo! needs to implement a dual password system, where a master pass can be used to log in and fix one's account if one had it stolen.
Yahoo has announced it will give away the browser-based authentication used in its email service, considered to be the company's 'crown jewels.'
If that's one of their 'crown jewels', would their hosting service be considered the "family jewels"?
Push Button, Receive Bacon
... there are 'no security risks' since they keep absolute control of usernames and passwords.
That's what my bank, credit card company and local government told me before they had a little "incident" with some script kiddies. Maybe the mattress is still the safest place for your money?
Why does the phrase "famous last words" come to me when I hear that. I can almost imagine it being spoken by Hammond in Jurrasic Park when he's talking about how safe the attractions are and that it's impossible for the dinosaurs to breed.
I forsee an explot being developed or maybe someone will just write a new "service" that makes use of Yahoo's systems that also happens to pass the username/pass to a more nafarious author.
Remember, the tool is only as safe as the operator. AOL's search didn't even ask for people to enter their Social Security Numbers.
I'm not saying that Yahoo should've provided IMAP/SMTP in the first place, though it would be nice for any email provider to do that. I'm suggesting that someone should write an IMAP/SMTP proxy for Yahoo mail.
I would be interested in using that -- maybe. As it is, I use my own IMAP server anyway. Which is a nice thing when it comes to services that require a unique email address to set up an account -- I have as many email addresses as I want.
Don't thank God, thank a doctor!
I don't get it. I've been using fetchyahoo for years, and have had to upgrade every few months as Yahoo has f*cked with their system, but it works great. What, exactly, are they 'giving away'?
Ultimately this comes down to who are users going to flock to as their primary id on the internet - and thus users will use it to log into 3rd party applications which lie outside of microsoft/google/yahoo. The bigger question, though, is how come these companies are going to "own" your id instead of federate it.
BTW, Yahoo has offered authentication services through other apps back in March.
It remains to be seen if they can pull this off, but it's nice to see this type of innovation and broad steps coming from somewhere other than Google. I like Google, but they need the competition or they'll start to stagnate. Competition is good!
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
SUNNYDALE, California (Reuters) - Yahoo Inc. (Nasdaq:YHOO - news) is set to allow....
:( Got me all exited and stuff...
Yea I mis-read the first line of the article
Aw Frell this
Technically speaking, Yahoo is giving away "browser-based authentication" for its e-mail service for developers to build new applications. Currently only Yahoo Mail (http://mail.yahoo.com) and certain broadband partners like AT&T (NYSE:T - news) and BT (BT.L) are granted such access to the code.
This will allow people to make custom versions of the basic interface, or look, of e-mail. Other uses may include tapping the information inside a user's e-mail program to create new ways of displaying the information to individual users.
How the hell will browser-based authentication enable users to do all that? Or are they talking about providing an API for outside users?
The old (non-Ajax, non-beta) Yahoo Mail! had a clever login system. There's Javascript that md5-encodes the password and a session salt string, and sends the username and encoded password to the server. The plain password itself is never sent through the network. I doubt that the crown jewels they're talking about, because even I have manage to implement the function on some web-applications I've developed..
What time is it/will be over there? Check with my iPhone app!
What happens to IT staff/ techos that make millions themselves through stock options in the late 90s?
You become lazy rich yuppies (see the yahoo ceos daughter on mtv? gawd) and your brain turns into drivel that cannot
innovate.
Go on a 4week engineering brain storm trip, no girls, no CC cards, no email to your wifes.
That will give you 5 years of engineering brillians between 10 smart people.
How hard is it to kill all the bots/fake accounts? how about killing all accounts with a prefix of 5 or more digits or AAAAA prefixes.
Suspend millions of them, and if there is no real person requesting it be turned back on its a bot, no response in 90 days, rm -rf the damn
account.
Or is yahoo claiming 250 million users, yet its only 90million real people and the rest bots?
Liberty freedom are no1, not dicks in suits.
Man,thats so courageous.Iam surprised how Yahoo is so confident.
Wincopy
The great thing about standards is that there are so many to choose from...
Everyone is born right-handed; only the greatest overcome it
Information Cards / Windows CardSpace attempts to fix this problem:d /default.aspx
http://msdn.microsoft.com/winfx/reference/infocar
It's the brainchild of Kim Cameron: http://www.identityblog.com/
Unlike Passport, Microsoft does not own your identity when you use Information Cards.
HD Trailers
Phishing is a BIG problem with Yahoo (and other big websites) plenty of users lose control of their Yahoo! IDs (granted they are not so bright, as seen by the average IQ of people who responded to this post).
I would hate for a phishing attack on Yahoo to make my site vulnerable. And with more and more websites popping up Yahoo! signups, it just makes it easier for someone to spoof the form on their site and gather passwords.
In the Favor of Y! they have taken good steps against phishing attempts, but it still happens a lot.
The case with Flickr, and I assume all other third party sites that you can use Yahoo logins with, is that you actually get redirected to a yahoo.com domain to login. Even with this code being available, they can't trick experienced users based on that.
... there STILL won't be a voice chat client for the Mac users!
Lee Darrow, C.H.
Chicago, IL
Email authentication involves signing and checking an email message a-la PGP.
...but hey, what do I know? I'm just a 99 year old Grandmother from Soweto, you can email me at sexbabe4eva@yahoo.com to discuss this further :-/
This is 'user authentication' at best but all you're authenticating is that a user has a yahoo account. Unless they offer ID verification, this is pretty useless. Paypal is in a much better position to launch a service like this.
So now if i login to Yahoo, every jerk with a website can read that cookie and know who i am, right?
stuff |
So, you buy a company to get a RIA mail program. You roll out your new e-mail program that looks nice and has lots of features but the performance sucks with all of the JavaScript. Your stuck, people are switching back to the old program or start using GMail instead of Yahoo (I know at least 10 people who have switch back to classic or moved to Google). So how do you salvage this? Make some hoopla around opensourcing. Yeah....
It works pretty well, though I'm not all that big a fan of the process of logging in. The process goes like this:
This all seems reasonable, but I think I'd like to see the ability to set a pref so that you don't have to confirm every time. Other than that it does lower the barrier to entry for a site/service.
You have to choose the level of acccess when you register your app. When I registered the choices were (from memory):