Facebook and Yahoo develop RRVS, a new standard for securing recycled email addresses
Facebook and Yahoo Find a New Way to Save the Web's Lost Email Addresses — When Yahoo proposed a plan to reuse mothballed email addresses, a lot of people didn't like it.
Context & Ripple Effects
Address recycling has been a live security problem since Yahoo began reissuing mothballed accounts in 2013, when users immediately surfaced cases where a new owner could receive password resets meant for the old one (Yahoo's recycled-email security surprises). PC World reported around the same time that Microsoft was doing the same thing more quietly with Outlook addresses (Microsoft's quiet Outlook recycling), making this an industry-wide practice rather than one company's experiment.
RRVS is the response: rather than abandoning recycling, Facebook and Yahoo are building a standard so that mail systems can verify whether a recipient owned an address at the time a message was originally sent. The pickup across The Register, ZDNet, Business Insider, PC World and others signals that rivals see it as infrastructure, not a vendor feature.
First-order effects
- Yahoo gets a path to resume or expand address reclamation without repeating the 2013 reset-delivery failures, because senders can now check ownership at original-send time before trusting the inbox.
- Facebook's own notification and account-recovery emails gain a verification hook when they land at addresses that changed hands.
Second-order effects
- Microsoft, already recycling Outlook accounts, faces pressure to adopt RRVS or explain why its reclamation process lacks the same guardrails.
- Other large mailbox providers and bulk senders — the parties whose password-reset and notification flows are most exposed — become the natural next implementers, turning an ad-hoc practice into a compatibility question between providers.
Third-order effects
- If RRVS gains traction, address-lifecycle security moves from user vigilance and provider policy into the protocol layer itself, setting a de facto bar any future recycler must meet.
- The joint Facebook–Yahoo effort also models competitors cooperating on email plumbing standards, a pattern other providers would have to join or risk being flagged as the insecure option.
The trend: Email providers are shifting address recycling from a per-company policy gamble toward shared protocol-level safeguards, with Facebook and Yahoo's RRVS as the first concrete standard.