Yahoo is releasing inactive Yahoo IDs so that users can score a better email address. This means you can finally have albert@yahoo.com instead of albert9330399@yahoo.com, for example. Sounds great, right? It’s actually a spectacularly bad idea. 
 
 In a Tumblr post, the company announced that on July 15, it will be “freeing up” Yahoo email addresses that have been inactive for a year or more. But it’s not just deactivating these accounts, it’s going to offer them to other people. 
 
 In mid July, anyone can have a shot at scoring the Yahoo! ID they want. In mid August, users who staked a claim on certain IDs can come to Yahoo! to discover which one they got. 
 
 This may have seemed like a good way to get people to log in again, or to try to convert new users to a groovy Yahoo address. But it’s a terrible idea. It means that people will be able to claim Yahoo IDs and use them to take over other people’s identities via password resets and other methods. 
 
 For example, someone who uses a Yahoo email address solely as a backup for Gmail, and thus hasn’t logged into it for a long time, would be vulnerable to having that address taken over by a malicious individual who only wanted to ultimately get into the active Gmail address. You can see a chain of events where that could lead to taking over online banking accounts, social media accounts and the like. 
 
 Nor would it be hard to discover some of these inactive addresses. You could, for example, find a dormant Flickr account, which previously required a Yahoo email address. 
 
 The bottom line is that unless it rethinks this policy, this is going to lead to a social engineering gold rush come mid-July. Wired has reached out to Yahoo for comment. 
 
 Update 9:49 PM: Yahoo released a statement saying it has confidence it can make this transition securely. We’ve included it below. ||||| If you’ve ever signed up for an account with Yahoo, there’s cause for concern. The company confirmed today, after Recode broke the story last night, that 500 million user accounts were breached in a massive hack. 
 
 That’s larger than the population of the United States and Mexico combined. 
 
 Yahoo says the attack likely included email addresses, passwords, names and phone numbers — not payment card data or bank account information. 
 
 But our email accounts are packed with personal information. We send people we trust our account details for all kinds of services over email, and whether it's as benign as a Netflix password or as potentially devastating as a pornography website login or credit card number, we expect our email accounts to be password-protected and private. 
 
 If you have a Yahoo account, here’s what you should do. 
 
 Change all your passwords 
 
 Not just your Yahoo account. Make a list of all the online accounts where you store sensitive information. Update all your passwords to make them long and strong. Be sure to give each separate account a unique password, too. No repeats. 
 
 The best way to keep track of all your new passwords is with a password manager, which stores all your account details in an encrypted vault on your smartphone and your desktop. You can find some great free or extremely cheap ones online. Do some digging and find an option that works best for you. 
 
 Review old emails, delete sensitive content and disconnect accounts 
 
 If your Yahoo account information is indeed for sale, someone can hack into your email and find information you’d rather keep locked safe. Search your emails for sensitive correspondence, delete liberally and empty the trash folder. 
 
 Then visit the account settings of services you’ve connected to your Yahoo account and disconnect them immediately. 
 
 Switch to Gmail or use encryption 
 
 Gmail is endorsed by security researchers for being a secure service that most people can trust. If you want an airtight layer of protection, you can always setup a PGP key so only the intended recipient can decrypt your emails. 
 
 Enable two-factor authentication for all accounts and update apps 
 
 If you want to log in to your accounts, you should be able to verify you’re the one trying to log in and not someone else. That means employing more than just an easily sharable password to authenticate your login attempt. 
 
 Most services offer the option to text a code to a phone number on file for your account so only a person with both your password and your cellphone can access. Make sure all your apps and services are fully updated to take advantage of any recent security improvements. 
 
 Don’t open shady emails 
 
 Hackers often try to bait people into opening emails or attachments that may contain malware. Don’t open the email if you’re unsure. And if you do open an email and then decide it might be a hacker, do not open the attachments. Delete it.
– Got an old Yahoo email address kicking around that you haven't checked in a year or so? Better log in over the next few weeks if you'd like to keep it. Otherwise, Yahoo is going to free it up for someone else. The example it uses is letting someone claim an address of "albert@yahoo.com" rather than "albert9330399@yahoo.com." It may sound like some harmless house-cleaning, but this is a "spectacularly bad idea," writes Mat Honan at Wired. "It means that people will be able to claim Yahoo IDs and use them to take over other people’s identities via password resets and other methods," he writes. If someone has a seldom-used Yahoo account as a backup to Gmail, for example, this raises the possibility that the new owner of the Yahoo address will figure out a way into the Gmail account. Yahoo insists it will take pains to make sure that any recycled ID is safe and secure, but Honan wants the company to rethink this one. Otherwise, "this is going to lead to a social engineering gold rush come mid-July." Click for his full post.