Yahoo! Personals dating site has security problems

[mandy]

Yahoo! plans to tighten security on its dating site after a security expert uncovered a method for breaking into members' accounts.

The main problem is that Yahoo! Personals ads contain clues about key personal information - namely birth date and ZIP code - that members also use to reset their passwords. If an intruder obtains that data, the only thing that would block him from changing passwords and accessing accounts are members' secret questions, such as "What's your pet's name?"

In the age of instant messaging and email, answers to such questions are often easy to obtain with a bit of social engineering...

The move highlights how certain "secret questions", a popular security safeguard on the web, can be a weak line of defence against a determined intruder...

full article: http://software.silicon.com/security/0,3...201,00.htm