I actually got a text message the other day (purporting to be Yahoo - turns out it was them) saying that unusual activity had been seen on my account and they had disabled it until I went to the site on a PC. (I hardly ever use it - so this was a surprise - it is just a catch all for crap sites I may have to sign up for to keep them out of my "real" email). Anyway, I have two factor auth turned on (for Google, MS, and Yahoo) so I was surprised to see this. I guess they used the right password, but couldn't pass the two factor test. Just signing on to my account sent me to a special page saying there was unusual activity and having me input my password and a new password (once only; no "type it twice" thing). The new password had to meet some criteria and their regex or whatever they were using is broken beyond belief. It says it must be between 8 and 32 characters, have upper and lower case, and numbers. However, my old password met most of this already and was 8 chars (it was only missing the upper case character). Adding a "Y" to the end did not pass - because apparently that is not an upper case character. Neither is any other upper case character. It looks like they need all of the character types in the first 8 positions in order to accept it. Very poor coding and design on that page. I finally just had KeePass generate a random PW for me and used that.
I think this is a "score one for two factor" moment - but the poor implementation of the "fix" on Yahoo's part was a turn off.
