Once a user has logged in to Yahoo! (after a redirection from your site) they specifically authorize your application to retrieve certain user data that you've requested. You then get back a token (one hour TTL) that can be used with Yahoo! APIs to get the data. Jeremy Zawodny says that right now only Yahoo! Photos and Yahoo! Mail are supporting BBAuth. Dan Theurer has a post about getting it ready to go.
I'd like to use this in the reputation framework to get information about Yahoo! email addresses (with user permission) to assign then a rating based on how long they'd been in use, the ratio of incoming to outgoing email, etc. I'm not sure that data is available via the API (since it's not available yet).