So Yahoo confirmed yesterday that some state-sponsored actor made off with data from at least 500 million accounts, back in 2014, and nobody said a word about it until now. I read the news around 11pm last night on my phone, half asleep, and my first thought wasn't "wow, that's a huge breach" (it is) — it was "wait, do I still have a Yahoo account?"
Turns out I do. Yahoo Mail, registered sometime around 2003, back when I was in school and Hotmail felt too mainstream. I hadn't logged into it in probably six or seven years. I genuinely thought of it as a dead thing, a digital fossil sitting somewhere on a server, harmless because nobody was using it. That's exactly the assumption this breach blows up. An account doesn't have to be active to be valuable. It just has to still exist, with a password and a set of security questions attached to it, and odds are decent that password shows up somewhere else you actually care about.
I spent about forty minutes last night trying to remember the login. Not the password, I knew I'd never get that right, but the actual username, because apparently I had two Yahoo IDs from that era and couldn't remember which one I'd used for what. Found it eventually through an old forum signature I'd left on a now-defunct message board (RIP), of all places. Went through the password reset flow, and Yahoo asked me one of those security questions from 2003. "What is your favorite teacher's name." I have no idea what I put there thirteen years ago. I definitely didn't put a real answer, because even at seventeen I somehow knew you weren't supposed to answer these things honestly. Small mercy, I guess, except it also meant I had no way of guessing it back.
Eventually got in through email verification to a backup address I'd forgotten I'd linked. And there it was: an inbox frozen in amber. Xanga notification emails. A LiveJournal friending confirmation. Something from a message board I used to argue on about, of all things, Firefox extensions. It's a weird feeling, scrolling through your own digital adolescence like that, uninvited, at midnight, because a company got hacked.
The part that actually annoys me isn't the breach itself, it's the two-year gap. Yahoo says this happened in "late 2014," and they're only telling people now, in September 2016. That's not a rounding error, that's a huge stretch of time where anyone reusing a password from that account elsewhere was exposed and had no idea. I get that these investigations take time, and I'm sure their legal and security teams weren't just sitting on their hands. But from where regular users stand, two years of silence looks a lot like "we didn't know how to tell you" more than "we were being careful." Maybe both are true. Doesn't make it less frustrating.
Anyway, this is the part where I tell you to go check whether you've got zombie accounts sitting around, because I bet you do. Not just Yahoo. Think about every service you signed up for once, five, ten years ago, used for a month, and abandoned. MySpace. Some forum. A shopping site you bought one thing from in 2009. If you were reusing passwords back then (I was, everyone was, don't lie), some of those old accounts are still holding a key that might open a door you actually use today.
I've been slowly moving everything into LastPass over the past year, generating a fresh unique password for anything I touch, and finding this old Yahoo account was a good reminder of why that's worth the mild annoyance of setting up. It's tedious work, going through decade-old accounts one by one, deciding which to update and which to just kill outright. I ended up deleting the Yahoo account rather than updating it. Didn't need it, wasn't going to start needing it now, and one fewer thing sitting out there with my name on it felt like the right call.
Still not sure what I put for "favorite teacher," though. Kind of wish I remembered. Would've been a nice bit of closure.