Yahoo Gives Out Inactive Usernames Via “Wishlists” & Launches “WatchList” With A $1.99 Fee

Yahoo users who completed a Wishlist for their “dream” Yahoo username/email last month should find out today if they received one of their top five choices. According to the announcement, even if a user didn’t win one of the five usernames they submitted on their Wishlist, Yahoo’s newly launched Watchlist will offer more opportunities to claim a Yahoo ID.

Yahoo’s Watchlist allows users to monitor up to five usernames for three years. The company says that if any of the usernames on a Watchlist become available, the user will have 14 days to claim it. Any users who completed a Wishlist will have access to a Watchlist for free; everyone else must pay a $1.99 fee.

In June, Yahoo announced plans to recycle usernames that have been inactive for at least twelve months, and created the Wishlist for users to submit their top five wanted usernames/email addresses. The company’s plan was to offer “loyal users and new folks” their preferred Yahoo ID by opening access to usernames that were taken, but no longer being used.

Yahoo’s decision to recycle usernames raised many security concerns, with Marketing Land’s Matt McGee pointing out:

The danger is that new owners of these old Yahoo usernames/email addresses, could use the “Forgot Your Password?” tool on any number of websites to learn passwords associated with the old Yahoo username and/or gain access to websites that are associated with it.

To counter security concerns, Yahoo added a new email header called “Require-Recipient-Valid-Since” that lets companies validate a Yahoo email address by comparing the last time it was confirmed by the company against the date the email switched to a new owner. Being that it is a voluntary process, it is by no means a fail-safe system.

While Yahoo claims their approach “is a good solution” for both their users and partners, there is no guarantee that the security measure will be used by companies, or that companies even know it exists.