Security Changes at Pobox

This article was originally published as part of the Pobox blog. Pobox was acquired by Fastmail in 2015.

We are rolling out some new security procedures here at Pobox, to help protect you from unauthorized access, but also to alert you if it should happen.

This week’s changes are in 3 areas. First, we have added email alerts. Updates to your forwarding addresses, password or security question will all trigger an email notification. In the case of forwarding address changes, the notification will be sent to all old forwarding addresses, as well as the ones that have been added.

Should someone make changes to these elements of your account, for any reason, we’ll send an email “receipt” of the action. This can be for innocuous reasons (if you and your spouse share a computer, they may simply not realize that you are logged in to your account, and make updates) or by malicious intent. Either way, the sooner you become aware of a change made to your account, the faster it can be fixed.

The second change is designed to make it harder for an unauthorized person to “verify” themselves with Pobox Customer Service. We have switched from a series of questions, to a multi-point security confirmation. Questions must be answered correctly in multiple categories to receive a password reset URL at a new address. (Password reset requests will always be sent to the current forwarding address as well.)

We encourage you to go update your contact information immediately. We rarely use your contact information (and we never give any other companies or groups access to it), but it is used as one of the elements in our new multi-point verification process. Plus, in a worst case scenario, we can use it to contact you immediately for an emergency with your account.

Please also check and update your security question. Your security question should be something that is hard to guess or find out, but something that doesn’t change. “Who was my favorite teacher in elementary school?” is a good question. “What was my first concert?” is a good question. “How many licks does it take to get to the center of a Tootsie Pop?” is a bad question because you could guess the answer. “My nickname” is a bad question (unless no one really uses it) because anyone who knew you would know it.

Finally, we are making changes to the way your Pobox login sessions work. This may mean that you will be prompted to enter your password somewhat more frequently than you have been in the past.

These changes are being made for the security and protection of your accounts. We appreciate your understanding about the changes, and we hope that you will find them to be valuable improvements to your account!