Darkoshi

Yahoo Mail (aka OATH) has a new Terms of Service and Privacy Policy starting May 25. The parts of the privacy policy which pertain to how Yahoo may access the information contained in emails disturbs me.

This page appears to have Yahoo's legacy privacy policy, dated June 2017. Based on what that page says, some or all of the policies listed below may not be new, but I'm not sure.

I was wondering if Yahoo's policies are really much different from Google's TOS and Privacy Policy. So I checked.



Google:
Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored.


Yahoo/OATH:
OATH Privacy Center, main
Oath analyzes and stores all communications content, including email content from incoming and outgoing mail. This allows us to deliver, personalize and develop relevant features, content, advertising and Services.


OATH FAQ for Communications Products
Oath’s automated systems may analyze all content (such as Mail and Messenger content including instant messages and SMS messages) to detect, among other things, certain words and phrases (we call them "keywords") within these communications. This analysis may occur on all content as it is sent, received, and when it is stored, including communications content from Services synced with your account.

...
Our automated systems may analyze all communications content (such as Mail and Messenger content including instant messages and SMS messages) and all photos and other content uploaded to your account

...
For example, after automatically removing any information that on its own could reasonably identify the recipient, we may manually review certain commercial communications to develop tools to assist the automated scanning process, improve segmentation and other automated functions and create generic templates of such documents (e.g., using common language to identify the elements of an airline receipt). Oath employees may review the templates to improve our services and our personalization of your experience.

The automated analysis and storage of all content can include information within or about the content you provide, such as photos, attachments and other communications. We may collect information about the photos and videos uploaded, including EXIF data. Exchangeable Image File Format (“EXIF”) data is a record of the settings and other relevant metadata inserted by a camera or device when you take a photo or video, such as camera or device type, aperture, shutter speed, focal length, and location , among other information.

We also may use image recognition algorithms for the purposes bulleted above. For example, the algorithms might identify and tag scenes, color, best crop coordinates, text, actions, objects, or public figures.



It also disturbs me to read how much information Yahoo may be collecting about me from multiple sources:

OATH Privacy Center, main
We collect information from your devices (computers, mobile phones, tablets, etc.), including information about how you interact with our Services and those of our third-party partners and information that allows us to recognize and associate your activity across devices and Services. This information includes device specific identifiers and information such as IP address, cookie information, mobile device and advertising identifiers, browser version, operating system type and version, mobile network information, device settings, and software data. We may recognize your devices to provide you with personalized experiences and advertising across the devices you use.

...
This information also includes the kind of content or ads served, viewed or clicked on; the frequency and duration of your activities; the sites or apps you used before accessing our Services and where you went next; whether you engaged with specific content or ads; and whether you went on to visit an advertiser's website, downloaded an advertiser’s app, purchased a product or service advertised, or took other actions.
...
Information from Others. We collect information about you when we receive it from other users, third-parties, and affiliates, such as:

When you connect your account to third-party services or sign in using a third-party partner (like Facebook or Twitter).
From publicly-available sources.
From advertisers about your experiences or interactions with their offerings.
When we obtain information from third-parties or other companies, such as those that use our Services. This may include your activity on other sites and apps as well as information those third-parties provide to you or us.
We may also receive information from Verizon and will honor the choices Verizon customers have made about the uses of this information when we receive and use this data.

...
We also may use the information we have about you for the following purposes:
...
Associate your activity across our Services and your different devices as well as associate any accounts you may use across Oath Services together. We may associate activity and accounts under a single user ID.



Automated scanning emails for certain keywords is something I was aware that Google has been doing for quite a while. But the idea of mail providers scanning email image attachments, and applying facial recognition to see who is in the images, etc., is new to me*. I know that Facebook does that for images uploaded to its site, but I didn't know that email providers would do it too, for images attached to emails. And I hadn't thought much about how much info so many different companies may be sharing with each other to get a "big picture" about a person's activities, as opposed to each company just maintaining its own small set of data for its own analysis, of what people do on their particular website.

*Updated, 2018/05/20: OATH's pages only specifically mention "image recognition", which must mean to see what is in the photos. So they may or may not use "facial recognition" to see who is in photos. But based on the above, the image recognition may recognize "public figures", so it probably does include facial recognition too.

Forestfen had difficulty logging into her Yahoo Mail account today. She was being prompted to perform an extra sign-in verification step (aka 2-factor authentication). It wasn't simply a prompt advising her to set up 2-factor authentication as I sometimes get; it was actually prompting her to enter a phone number for the security code to be sent to. There was no way of bypassing it.

To Forestfen's knowledge, she hadn't previously turned on 2-factor authentication, nor had she previously entered her phone number on any Yahoo Options page.

This was corroborated by the fact that the extra sign-in verification window had an entry field for her to enter her phone number in. That was the really odd thing about it (though that didn't occur to me until later). Anyone could have entered any phone number, and have been sent a code for logging in.

I tried logging into her email account from a completely different computer, and got the same prompt as she was getting. This at least assured me that the problem wasn't due to malware on her computer.

The prompt had 2 fields, a "Country" drop-down and a "Phone Number" entry field. There were 2 push-buttons - one to receive a phone call, and the other to receive a SMS message. Forestfen first tried the phone call option (she said she got an automated call with a 3-digit number), and then the SMS option (which sent a 5-digit number), and finally got logged in.

The Yahoo Account info page shows "second sign-in verification" is flagged as being in "beta".
I suppose this must be some bug in their logic.

Forestfen is having difficulties with Yahoo's new web-mail interface. Its "Clean, simple design that makes email a breeze" is different from how it was before, and therefore is not simple for her. I'm sure there are many other similarly disgruntled non-tech-savvy users like her.

Last week somehow all her Inbox messages got moved to the Trash folder, and I had to show her how to restore them. It might have happened due to the "Select All" checkbox and the "Delete" button being right next to each other, making it easy to accidentally click both.

I've suggested a few times she switch to Gmail. But her business cards have her Yahoo email address, so she doesn't want to change it.

.

This is from Yahoo Mail's Additional Terms of Service:
By using the Services, you consent to allow Yahoo!’s automated systems to scan and analyze all incoming and outgoing communications content sent and received from your account (such as Mail and Messenger content including instant messages and SMS messages) including those stored in your account to, without limitation, provide personally relevant product features and content, to match and serve targeted advertising and for spam and malware detection and abuse protection. Unless expressly stated otherwise, you will not be allowed to opt out of this feature. If you consent to this ATOS and communicate with non-Yahoo! users using the Services, you are responsible for notifying those users about this feature.

Bold font added by me - I find that last sentence rather objectionable. I wonder if Gmail has something similar in their TOS.

PG Offline is free to use for 30 days, but costs $20 thereafter. It puts the messages into a .mdb format (Access database), and provides for nicely formatted browsing of the messages via the PG Offline tool. But saving it as another format is not straight-forward.

The best way I found is to select "Messages - Show Digest" from the menu to view a certain number of the messages on a single page, then hit CTRL-A and CTRL-C to do a select-all and copy of the text, and then paste it into a text file. The digest window does not always display all the messages correctly, but the data is there* when you paste it into the text file.

The above seems the best option to me; I also tried the below, but it is more complex, and for a group with a lot of messages, it does not seem practical to me to archive them as individual files.

*On further testing, not all of the data is there, after all... some messages seem to be missing the text. Oh well. The *.mdb file can also be opened in MS Excel, but the message texts are not easy to read as they include HTML tags. Also note that the *.mdb file includes the userid/password used for downloading the messages, although in an encrypted format.

---

messages-1.14.tar.gz lets you download messages as individual text files. Each file includes a lengthy section of email-headers, and some odd parts at the end which apparently Yahoo adds.
It requires Perl to run. It also requires the Crypt::SSLeay module, which does not come as part of the ActivePerl package, and is not downloadable from the ActivePerl ppm repository, as they are a Canadian company and do not have the required permit for distributing cryptographic software.

A Windows version of
ActivePerl can be downloaded and installed in order to run the Perl script.

Crypt::SSLeay can be downloaded from the uwinnipeg PPM repository using the PPM tool which comes with the ActivePerl installation. I first tried installing it from the command line, but that did not seem to work.
You may also need to add the Perl\bin installation folder to your PATH environment variable (if you didn't select that option during installation of ActivePerl), so that ssleay32.dll will be found when running the perl script.

Use this command to run the Perl script:
[\perl\bin\]perl -T yahoo2maildir.pl {group name} [{begin message id} [{end message id}]]

NOTE: if you enter the wrong password, you get this misleading message:
[INFO] Successfully logged in as [your userid].
Couldn't get message count

I did a Google search on my Whirlpool refrigerator model #, ED26SSXL (or ED26SSXLNR0), and there is only a single result - a page in Spanish. Isn't that odd? I wonder how old it is; it doesn't look old.

Yahoo has my cursewords page indexed at its new URL. But it only shows up if you search on certain terms, like words from the title. If you search a random group of cursewords listed on the page, it doesn't necessarily show up in the results. That seems odd too; I thought you could do searches like that and find pages with the words. I wonder if Google indexes it better, but Google doesn't have it indexed yet.

I got the outlet fixed after all. The next day already, I was eager to get a new receptacle and try again.


http://www.hammerzone.com/archives/elect/repairs/outlet/replace.htm
This page has a really nice instructions for replacing outlets, with good pictures.


http://forums.mikeholt.com/archive/index.php/t-77654.html
Thread regarding receptacles with backstab versus backwire connections. If using backwire connections, one ought not also connect wires to the screws on the side, because the same screw is used for tightening the connections in back and on the side.
The backwire receptacle I bought had 4 holes each for the black and white wires which was more than adequate.