Account takeovers affecting then-vice presidential candidate Sarah Palin, celebrity Xbox gamers, and ISP Comcast have all been pulled off by exploiting weaknesses in the way Yahoo, Microsoft, and other services go about resetting passwords reported as forgotten.