SAN FRANCISCO -- Yahoo is ditching passwords in favor of a more sophisticated method of verifying users in a major upgrade to its 18-year-old email service. 
 
 The Sunnyvale company on Thursday introduced a "password-free" account key that sends a push notification to mobile devices asking users to confirm their identities before checking their emails. 
 
 The new authentication method, which is optional and part of a broader revamp that makes Yahoo Mail smarter and faster on smartphones, pushes Yahoo to the forefront in email security but also risks alienating longtime users accustomed to logging in with passwords. 
 
 "It's pretty controversial to get rid of passwords because consumers actually like them," said Avivah Litan, a security analyst at research firm Gartner. 
 
 But Litan agreed with Yahoo executives that most passwords are weak and worth replacing because they are easily forgotten, easily compromised and typically shared across multiple personal accounts. 
 
 Yahoo's solution is designed to be simpler than the typical two-factor authentication process, which is safer than conventional passwords but has a learning curve. Yahoo's new process takes little effort, but requires users to have an Internet-connected phone or wristwatch handy, even if they are on a desktop. 
 
 "It takes getting used to," said Jeff Bonforte, Yahoo's head of communications products, in a press event Wednesday in downtown San Francisco. "Patterns die hard.'' 
 
 Advertisement 
 
 Yahoo also uses other tools such as network analytics -- what it knows of a user's typical behavior -- to keep a user logged in unless unusual activity raises a red flag. 
 
 "Everyone will wait and see how it goes," Litan said. "If this goes well, I think a lot of other companies will follow because passwords are so antiquated and create a false sense of security." 
 
 This is Yahoo Mail's first major revision in two years. Yahoo CEO Marissa Mayer, who in her previous job at Google had helped usher in the rise of Gmail, took some cues from that widely popular service in the 2013 redesign but outraged some loyal Yahoo users who were confused and annoyed by the new features. 
 
 Most of Thursday's changes are far more aesthetically subtle, though the computing behind them is powerful. The new tools allow for speedier searching of archived content in the Yahoo Mail application on Apple and Android devices, and automatically suggest after just one or two typed letters the most likely recipients of an email a user is composing. 
 
 "We think we have the most advanced search in a mobile mail client," said Fernando Delgado, a Yahoo senior director of product management. 
 
 Other improvements include a new feature for so-called "me-mailers" -- the roughly 20 percent of Yahoo users who frequently send emails to themselves with to-do lists or other notes -- that helps them create a notebook of their files. There's also a feature that adds icons for every verified user -- company logos for emails from well-known banks, stores, airlines and other services -- and automatically creates initials for everyone else. 
 
 Yahoo Mail, once the leader in Web-based email providers and a crucial springboard for traffic to the company's finance, sports and news websites, has been playing catch-up since Google launched its upstart email service in 2004 and swiftly grew to become the leader. A recent report from market researcher comScore figures show Yahoo Mail and Gmail were equals as recently as 2013, but Gmail now has tens of millions more viewers. 
 
 Another Yahoo upgrade is a "multiple mailbox" manager that places separate email accounts under one umbrella tool, allowing Yahoo Mail users to access their emails from AOL or Microsoft's Hotmail and Outlook.com and giving Yahoo an even larger body of email content to scan for targeted advertising dollars. Gmail is not included in the mix, though ongoing talks with Google could fold it in later, Bonforte said. 
 
 Contact Matt O'Brien at 408-920-5011. Follow him at Twitter.com/Mattoyeah. ||||| If you’ve ever signed up for an account with Yahoo, there’s cause for concern. The company confirmed today, after Recode broke the story last night, that 500 million user accounts were breached in a massive hack. 
 
 That’s larger than the population of the United States and Mexico combined. 
 
 Yahoo says the attack likely included email addresses, passwords, names and phone numbers — not payment card data or bank account information. 
 
 But our email accounts are packed with personal information. We send people we trust our account details for all kinds of services over email, and whether it's as benign as a Netflix password or as potentially devastating as a pornography website login or credit card number, we expect our email accounts to be password-protected and private. 
 
 If you have a Yahoo account, here’s what you should do. 
 
 Change all your passwords 
 
 Not just your Yahoo account. Make a list of all the online accounts where you store sensitive information. Update all your passwords to make them long and strong. Be sure to give each separate account a unique password, too. No repeats. 
 
 The best way to keep track of all your new passwords is with a password manager, which stores all your account details in an encrypted vault on your smartphone and your desktop. You can find some great free or extremely cheap ones online. Do some digging and find an option that works best for you. 
 
 Review old emails, delete sensitive content and disconnect accounts 
 
 If your Yahoo account information is indeed for sale, someone can hack into your email and find information you’d rather keep locked safe. Search your emails for sensitive correspondence, delete liberally and empty the trash folder. 
 
 Then visit the account settings of services you’ve connected to your Yahoo account and disconnect them immediately. 
 
 Switch to Gmail or use encryption 
 
 Gmail is endorsed by security researchers for being a secure service that most people can trust. If you want an airtight layer of protection, you can always setup a PGP key so only the intended recipient can decrypt your emails. 
 
 Enable two-factor authentication for all accounts and update apps 
 
 If you want to log in to your accounts, you should be able to verify you’re the one trying to log in and not someone else. That means employing more than just an easily sharable password to authenticate your login attempt. 
 
 Most services offer the option to text a code to a phone number on file for your account so only a person with both your password and your cellphone can access. Make sure all your apps and services are fully updated to take advantage of any recent security improvements. 
 
 Don’t open shady emails 
 
 Hackers often try to bait people into opening emails or attachments that may contain malware. Don’t open the email if you’re unsure. And if you do open an email and then decide it might be a hacker, do not open the attachments. Delete it. ||||| Yahoo just killed the password. 
 
 The online company today announced a revamped version of its Yahoo Mail app for iOS and Android, allowing users to log into their email accounts securely and without ever having to remember a password or enter one to gain access. 
 
 The password killer, called Yahoo Account Key, works like this: Users enter their user name and are then sent a push alert to their smartphone letting them know someone is trying to log in to their account and from what computer. With one tap, the user can accept and will be taken to their email inbox -- all without ever using a password. 
 
 "Passwords are usually simple to hack and easy to forget. Account Key streamlines the sign-in process with a secure, elegant and easy-to-use interface that makes access as easy as tapping a button," Dylan Casey, vice president of product management at Yahoo said in a blog post. "It’s also more secure than a traditional password because once you activate Account Key -- even if someone gets access to your account info -- they can’t sign in." 
 
 Yahoo rolled out another password killer earlier this year, letting users get SMS codes to use to log into their account instead of having to remember a password.
– Yahoo Mail is turning 18, and it's marking the occasion with a big move: no more passwords. The company announced Thursday it's dumping what one Gartner security analyst calls the "antiquated" process of punching in a password to access messages and replacing it with a push notification sent to a user's mobile device, the San Jose Mercury News reports. Once the user gets the notification, he or she taps once to gain entry to the Yahoo Mail inbox, ABC News notes. "Passwords are usually simple to hack and easy to forget," Dylan Casey, Yahoo VP of product management, writes in a blog post describing the new "Account Key" feature. "Account Key streamlines the sign-in process … [and is] more secure than a traditional password because once you activate Account Key—even if someone gets access to your account info—they can't sign in." The optional authentication method is part of a broader revamp of Yahoo Mail, which includes faster search options of archived mail on Apple and Android devices, an email "umbrella" that allows users to access other email accounts (though not Gmail), and an organizational option for "me-mailers," or people who send themselves reminders via email, per the Mercury News. Some experts, however, feel longtime users may be freaked out without their passwords. "Consumers actually like them," the Gartner analyst tells the Mercury News, though he concedes people often forget their passwords, create weak ones, or use the same one across many accounts, setting them up for hacking. For those who feel the new authentication system isn't secure enough, Casey says it may someday use fingerprints and face recognition for an added layer of protection, Engadget notes.