Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a friend who works in Yahoo and claims that he can hack into anyone's email. Is that really true?

I know its a vague question but I want to know if employees of Yahoo and Google have access to some database through which they can hack into others' email.

share|improve this question

closed as off topic by slhck, Simon Sheehan, haimg, Nifle, random Feb 20 '12 at 17:35

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

4  
Just to add to all the answers: worrying about one's email is probably paranoid, considering that most bank employees can access your account data just as easily - and in that case, ALL data is sensitive. –  UncleZeiv Feb 20 '12 at 16:10
add comment

3 Answers

up vote 13 down vote accepted

Yes

A rouge employee willing to endanger their career/freedom (jail time) with correct access/motivation could illegally access email.

It has happened

I'll use Google as the example here because it actually happened in 2010 where there were 2 alleged employee that breached policy and read emails/chat:

Google acknowledged Wednesday that two employees have been terminated after being caught in separate incidents allegedly spying on user e-mails and chats.

So the same thing could happen at Yahoo, or Microsoft, or any other type of provider that has some kind of administrator access to the infrastructure.

Protect yourself

Never send anything sensitive via email, including (but not limited to) Credit Card info, passwords, your most private deep dark thoughts.

You can encrypt your email if paranoid, but this is not a trivial task:

Having said all that, it's actually not a big worry

Unless an employee at the organisation hosting your email is likely to directly target you and your email, don't worry about it. If you believe you are a target, then you may want to consider reporting their threats of undertaking illegal activities to their employer.

Also there's usually only a few employees who actually have such authority/access to do such a task, from this article:

A small number of GMail related engineers have access to the servers as a matter of necessity to do their jobs; a very small number of people actually access the contents as a matter of necessity to do their jobs, and even then, almost always only the associated metadata.

share|improve this answer
3  
I'd like to reiterate the last part of this response, if someone is threatening you, you need to report them to law enforcement and the employee's organization because public discussions, even if as innocent as this thread, are a huge deal to company's PR and Legal divisions –  Raystafarian Feb 20 '12 at 13:09
3  
PGP or S/MIME encryption of mail is easy task. If not - change your e-mail client –  Lazy Badger Feb 20 '12 at 14:44
add comment

It's not a "hack" if you own the database and can simply read it.

You should always assume that people who provide your email service read your email. They can do it, that's for sure.

If you don't feel comfortable with that, use encryption.

share|improve this answer
    
Is that really true? Is there no law that prevents them from doing it? –  Aki Feb 20 '12 at 12:12
3  
I'm pretty sure there is such a law. But laws are broken all the time. –  Oliver Salzburg Feb 20 '12 at 12:23
2  
This is a fundamental and important truth about all cloud services. The only way to ensure that someone won't abuse your data is to not give them access: either don't store it with them, or encrypt it first and don't give them the key. All the laws and promises in the world may be overruled by a government demand, a hack, or simple employee dishonesty. It can be reasonable to trust a service with your data, but you should know that it really comes down to trust. And that trust may have to extend to third parties, including the government, who can legally (or illegally) demand access. –  Nathan Long Feb 20 '12 at 14:18
    
@Aki If the Terms of Service says they can/may do it, and you agree to that TOS, then, well... (Their Privacy Policy may also get into it, see Raystafarian's answer) –  Izkata Feb 20 '12 at 19:08
add comment

If the workers have access to the mail server - they can access your mail boxes altough mail boxes are usually encrypted as well as the database holding the credentials is usually encrypted unreversibly using normally SHA.

share|improve this answer
3  
mail boxes are usually not encrypted –  Lazy Badger Feb 20 '12 at 14:46
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.