RE: How to obtain a yahoo username off a computer

["Potter, Tim" <Tim.Potter () clarkconsulting com>]

Hmmm.. Don't know if I should be offended or not :)  But since I'm
paranoid as well, I won't be offended.

Seriously, I appreciate all the responses.  Sniffing traffic has always
been at the top of the list, but I wasn't sure that yahoo usernames
would be passed through in the clear.  We could care less about he
password, we just want to verify this person used this username.  So I
think we'll go down the sniffer route unless that doesn't work for some
reason.
Thanks for your help!

By the way - cookies, .dat files, etc. don't help.  They can tell us
this person has been to Yahoo, but will not reveal the username they
used.  Inside the Yahoo cookie is what looks like an encrypted string
that Yahoo will understand when they log on.

-Tim

-----Original Message-----
From: Curt Seeliger [mailto:seeliger.curt () epa gov] 
Sent: Wednesday, June 11, 2003 6:53 PM
To: security-basics () securityfocus com
Subject: Re: How to obtain a yahoo username off a computer



There's been a variety of helpful responses to the original request now.

There are good reasons for doing what he wants to do, but (and I'm in no

way impuning the original poster by asking this) there are some crummy 
reasons as well.

How do any of you know this isn't part of a stalking, or background info

for more social engineering, or yada? Near as I know, you don't.  Sure, 
this is worst case scenario, but isn't paranoia part of the game?

> -----Original Message-----
> To: security-basics () securityfocus com
> Subject: How to obtain a yahoo username off a computer
>
> Hello!  We have a security issue and need to know who is using a 
> particular Yahoo user ID from within our company.  We are about 90% 
> certain of the person's identity.  This user has been deleting his 
> cookies and temp Internet files.  We want to search his computer to
see
> if Yahoo ID xxxx is somewhere on his computer.   We know the Yahoo
user
> ID - we just need to confirm that this person is using it.  We don't 
> want to contact Yahoo because we don't want to go down the legal road 
> needed to get them to release the info.  Any ideas? Thanks,

-- 
Curt Seeliger, Data Ranger          
CSC, EPA/WED contractor
541/754-4638                      
seeliger.curt () eqa gov           

------------------------------------------------------------------------
---
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top
analysts! The Gartner Group just put Neoteris in the top of its Magic
Quadrant, while InStat has confirmed Neoteris as the leader in
marketshare.
     
Find out why, and see how you can get plug-n-play secure remote access
in about an hour, with no client, server changes, or ongoing
maintenance.
          
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
------------------------------------------------------------------------
----



---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.

Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.

Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------