Initially, Pager had custom text rendering, but then they replaced it with an HTML view. Pager didn't escape message contents, and so it was possible for a message sender to coax the recipient into displaying arbitrary HTML - even fetching images off the web. And more than a decade later, this methuselan workaround lives on: Yahoo chat was not as full of sexually unfulfilled college girls as the spam bots would have you believe.
Before the captchas arrived in 2007 (which did little in any case), Yahoo battled the bots by obfuscating the login protocol. Rinse and repeat - by the end, the protocol had grown to outrageous complexity.
Users created and maintained identities with meaningful usernames and chat handles, or pseudonyms.
“…I am always reminded of how small changes in the details of a digital design have profound unforeseen effects on the experiences of humans who are playing with it…It is impossible to work with information technology without also engaging in social engineering.” -Jaron Lanier  After a relatively quiet and unmourned death, the chatroom as a social space recently returned in the form of Omegle and Chatroulette.
Yahoo chat rooms started life as a Java applet, chugging along in Netscape Navigator 4. But all messages went through Yahoo's servers, so they could fix it server-side: block the attack by rewriting the messages before sending them along.
Support for chat was later added to Pager, their native app, which did its own chugging in Visual Basic. So Yahoo replaced the troublesome opening bracket .
So rather than seeing the obvious chat bot from a random user who’s just added you, it comes from someone you already know. I bet many unsuspecting people do click through: contact: you there? thanks so much me: rest assured I won’t contact: im going to go cook while you do it me: what does a bot cook? me: bot bot bot The link it sends appears to go to a slightly different domain each time (the first was to iqtestingkoia, the second to iqtestinghiki3) It’s also interesting that the bot appears to both initiate chat sessions and respond to them.
me: hey contact: will you do me a quick favor and take an IQ quiz for a project im doing? The first time I saw the attack attempt, the chat was initiated by the bot.