topic Re: Serious security concern – Sky Yahoo Mail application passwords cannot be revoked in Email

Serious security concern – Sky Yahoo Mail application passwords cannot be revoked

JamesHamilton — Sun, 11 Oct 2026 06:32:49 GMT

I would like to raise what I believe is a very serious security issue affecting Sky Yahoo Mail customers, potentially including many thousands of users.

Historically, Sky Yahoo Mail customers were provided with automatically generated 16-character application passwords (app passwords) to allow email clients such as Thunderbird and Outlook to access their mailboxes.

These application passwords provide access to email accounts independently of the customer's normal Sky ID password.

The serious concern is that Sky customers no longer appear to have any facility to change, manage or, most importantly, REVOKE these application passwords.

Consider the implications.

If a customer's computer is compromised by malware, stolen, or accessed by a malicious third party, any stored application passwords could potentially be extracted.

An attacker obtaining one of these credentials could then use it to access the customer's email account from another device, potentially reading private correspondence and intercepting sensitive information, including password-reset messages for other online services.

Even after discovering that their credentials have been compromised, the legitimate account holder appears to have no means of invalidating the stolen application password.

Changing the normal Sky ID password does not appear to invalidate previously generated application passwords.

This means that an attacker could potentially retain access to someone's email account, despite the account holder knowing that their security has been compromised and taking reasonable steps to protect it.

I find this extremely concerning.

The ability to revoke compromised authentication credentials is a fundamental requirement of account security. A customer should never be placed in a position where they cannot prevent continued unauthorised access to their own email.

Yahoo's published documentation describes facilities for managing and deleting application passwords. However, accessing Yahoo's account-security settings with a Sky Yahoo account redirects to Sky's account-management pages, where no equivalent functionality appears to be available.

I would therefore like Sky to answer three specific questions:

How can a Sky Yahoo Mail customer immediately revoke an application password that may have been compromised?
If customers cannot revoke application passwords themselves, can Sky's technical or security teams revoke them on request?
If no such facility currently exists, is Sky aware of this security issue, and what measures are being taken to rectify it?

I am requesting that this matter be escalated to Sky's senior Information Security team and the technical personnel responsible for Sky Yahoo Mail authentication.

This is not a routine email configuration problem or a request for assistance setting up an email client. It concerns the potentially ongoing validity of authentication credentials that customers appear to have no means of invalidating.

The consequences of compromised email access can extend far beyond the mailbox itself, potentially affecting financial, personal and other online accounts.

I would particularly welcome an authoritative response from a Sky employee with responsibility for, or direct access to, the relevant security team.

If no effective means of revoking these credentials exists, I believe this warrants urgent investigation and remediation.

I suspect this issue affects a considerable number of longstanding Sky Yahoo Mail customers, many of whom may be entirely unaware of the implications.

Re: Serious security concern – Sky Yahoo Mail application passwords cannot be revoked

GD1 — Sun, 11 Oct 2026 08:31:28 GMT

@JamesHamilton Nothing is going to happen on the back of a community post, no one will escalate your issue to anyone as no one here or reading the community has any idea who you are.

In case you're not aware or have not read the about section this is a customer helps customer community, you are not contacting Sky customer services by posting here.

Re: Serious security concern – Sky Yahoo Mail application passwords cannot be revoked

Mark39 — Sun, 11 Oct 2026 10:02:51 GMT

@JamesHamilton the ability to generate new app passwords has been removed, which may be an indication that Sky are aware. The underlying security relies on a strong password as login was required in order to generate an app password.

Re: Serious security concern – Sky Yahoo Mail application passwords cannot be revoked

JamesHamilton — Sun, 11 Oct 2026 10:38:42 GMT

Hi @GD1 and @Mark39,

Thank you both for your replies. I appreciate you taking the time to respond, but I think you're missing the point of my concern.

I fully accept that the original application passwords were generated securely, and that a strong account password was required to obtain them. That isn't the issue.

The issue is that these application passwords remain valid credentials in their own right, yet Sky appears to have removed the means of managing or revoking them.

If one of these passwords were compromised, an unauthorised person could potentially continue accessing my email without knowing my main Sky password. Changing that main password does not necessarily invalidate previously generated application passwords.

This is precisely why password rotation and revocation are fundamental security requirements. A credential can be extremely strong when created, but that doesn't help if it subsequently becomes compromised and the account holder has no means of invalidating it.

Removing the facility to generate new application passwords is one thing. Apparently removing the ability to revoke existing passwords is quite another.

I'm not suggesting that my passwords have been compromised. My concern is that, should this ever happen, I appear to have no way of protecting my account by revoking the affected credentials.

So the question remains: how does a Sky customer revoke an existing application password that is no longer trusted?

I appreciate that neither of you is a Sky employee, but I hope you can understand why I consider this a legitimate security concern rather than simply an inconvenience.

Re: Serious security concern – Sky Yahoo Mail application passwords cannot be revoked

Mark39 — Sun, 11 Oct 2026 12:24:33 GMT

@JamesHamilton nope, didn't miss the point of what you're saying. By all means pose your question to Sky.

Re: Serious security concern – Sky Yahoo Mail application passwords cannot be revoked

jayach — Sun, 11 Oct 2026 12:26:01 GMT

@JamesHamilton

I share your concern, and at one time we did have the ability to administer our app passwords, but that was removed as (apparently) it was considered a security risk. (crazy I know)

As it has been a long time risk, and as it is no longer possible to generate them, I doubt Sky will be willing to do anything about it.

If pressured I suspect they would probably just close the email service.

Let sleeping dogs lie, would be my recommendation.