Yahoo is releasing inactive Yahoo IDs so that users can score a better email address. This means you can finally have albert@yahoo.com instead of albert9330399@yahoo.com, for example. Sounds great, right? It’s actually a spectacularly bad idea. 
 
 In a Tumblr post, the company announced that on July 15, it will be “freeing up” Yahoo email addresses that have been inactive for a year or more. But it’s not just deactivating these accounts, it’s going to offer them to other people. 
 
 In mid July, anyone can have a shot at scoring the Yahoo! ID they want. In mid August, users who staked a claim on certain IDs can come to Yahoo! to discover which one they got. 
 
 This may have seemed like a good way to get people to log in again, or to try to convert new users to a groovy Yahoo address. But it’s a terrible idea. It means that people will be able to claim Yahoo IDs and use them to take over other people’s identities via password resets and other methods. 
 
 For example, someone who uses a Yahoo email address solely as a backup for Gmail, and thus hasn’t logged into it for a long time, would be vulnerable to having that address taken over by a malicious individual who only wanted to ultimately get into the active Gmail address. You can see a chain of events where that could lead to taking over online banking accounts, social media accounts and the like. 
 
 Nor would it be hard to discover some of these inactive addresses. You could, for example, find a dormant Flickr account, which previously required a Yahoo email address. 
 
 The bottom line is that unless it rethinks this policy, this is going to lead to a social engineering gold rush come mid-July. Wired has reached out to Yahoo for comment. 
 
 Update 9:49 PM: Yahoo released a statement saying it has confidence it can make this transition securely. We’ve included it below. ||||| SAN FRANCISCO — Another month, another major security breach. 
 
 Yahoo confirmed Thursday that about 400,000 user names and passwords to Yahoo and other companies were stolen on Wednesday. 
 
 A group of hackers, known as the D33D Company, posted online the user names and passwords for what appeared to be 453,492 accounts belonging to Yahoo, and also Gmail, AOL, Hotmail, Comcast, MSN, SBC Global, Verizon, BellSouth and Live.com users. 
 
 The hackers wrote a brief footnote to the data dump, which has since been taken offline: “We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat.” 
 
 The breach comes just one month after millions of user passwords for LinkedIn, the online social network for professionals, were exposed by hackers who breached its systems. The breaches highlight the ease with which hackers are able to infiltrate systems, even at some of the most widely used and sophisticated technology companies. 
 
 Marcus Carey, a researcher at Rapid7, a security company found that among the data were some 106,000 Gmail e-mail addresses, 55,000 Hotmail e-mail addresses and 25,000 AOL e-mail addresses. Those e-mail accounts were not hacked; instead people had used their e-mail address as user names for a Yahoo service. 
 
 Sucuri, a company that checks for malware, set up a Web site, labs.sucuri.net/?yahooleak, that lets concerned users check if their account details were compromised in the breach. 
 
 Dana Lengkeek, a spokeswoman for Yahoo, said the compromised accounts belonged to Yahoo’s Contributor Network, and that fewer than 5 percent of the passwords posted were still valid. 
 
 Chris Gaither, a spokesman for Google, said Google immediately reset passwords for vulnerable Gmail accounts. 
 
 The hackers claimed to have stolen the passwords using a hacking technique called an SQL injection, which exploits a software vulnerability. 
 
 “We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo users and notifying companies whose user accounts may have been compromised,” Ms. Lengkeek said in the statement. 
 
 Mr. Carey said it was unclear whether Yahoo’s breach had been contained and noted that hackers could still be inside its systems. 
 
 Computer security experts recommended that Yahoo users consider changing their passwords to other sites, as hackers tend to test those passwords across multiple sites. 
 
 They were quick to chastise Yahoo for allowing hackers such an easy way into its systems. “Why haven’t organizations like Yahoo got it yet? SQL injection is a known attack,” said Mark Bower, a vice president at Voltage Security. “If what is stated is true, it’s utter negligence to store passwords in the clear.”
– Got an old Yahoo email address kicking around that you haven't checked in a year or so? Better log in over the next few weeks if you'd like to keep it. Otherwise, Yahoo is going to free it up for someone else. The example it uses is letting someone claim an address of "albert@yahoo.com" rather than "albert9330399@yahoo.com." It may sound like some harmless house-cleaning, but this is a "spectacularly bad idea," writes Mat Honan at Wired. "It means that people will be able to claim Yahoo IDs and use them to take over other people’s identities via password resets and other methods," he writes. If someone has a seldom-used Yahoo account as a backup to Gmail, for example, this raises the possibility that the new owner of the Yahoo address will figure out a way into the Gmail account. Yahoo insists it will take pains to make sure that any recycled ID is safe and secure, but Honan wants the company to rethink this one. Otherwise, "this is going to lead to a social engineering gold rush come mid-July." Click for his full post.