The Register® — Biting the hand that feeds IT

Feeds

Hotmail always-on crypto breaks Microsoft's own apps

Redmond's answer to Firesheep not ready for prime time

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

For the first time in its 13-year history, Microsoft's Hotmail comes with the ability to protect email sessions with secure sockets layer encryption from start to finish.

It's the same always-on encryption Google Mail has offered for more than two years. And it comes with some pretty extreme limitations – namely the inability to protect email that's downloaded using Microsoft apps including Outlook Hotmail Connector (required to use Outlook with Hotmail) and Windows Live Mail. But to hear Microsoft describe the new feature, you'd think it was a cure for the common cold.

“As you saw, with the recent additions of several security features to Hotmail, including Single-Use codes and new account recovery options, building towards the most secure webmail experience is very importance to us,” a spokeswoman, who asked that her name not be published, wrote in an email. “We will continue to incorporate leading-edge security features to better protect our customers. With today's addition of full-session SSL encryption to Hotmail, we are delivering even more secure Hotmail sessions.”

Microsoft's online services have long played second fiddle to those of Google, and judging from Tuesday's announcement, security is no exception. Not only is Gmail's HTTPS encryption turned on by default, it also works flawlessly with a variety of email apps such as Thunderbird, Eudora, and even Microsoft's Outlook. We asked Microsoft to explain why its own SSL doesn't work with its own apps, and whether it might work with other email clients, but all we got was the above-quoted marketing fluff.

That's unfortunate, because unsecured email has been the elephant in the room for more than a decade, making Hotmail users who check their email from public Wi-Fi vulnerable to snoops. For most Reg readers this is old news. But for readers of mainstream publications, it only sank in two weeks ago, with the advent of Firesheep, a Firefox plugin that makes stealing authentication cookies from Facebook, Twitter and, yes, Hotmail, a snap.

Enter Microsoft with a watered-down solution that's certainly better than nothing. But given the fanfare with which it was announced, one wonders if it will give Hotmail users a false sense of security. And that's not much of a selling point, now is it? ®

Agentless Backup is Not a Myth

Standards?

Have they heard of them in Redmond?

If Hotmail and their desktop clients simply used good ol' IMAP and SMTP spiced with a little SSL/TLS, it would Just Work.

Of course that's the problem with Gmail: It's just so damn good and convenient.

Every time I start to worry about the privacy issues with having Google know as much as they do about my virtual comings and goings, they seem to add just one more neat little feature to Gmail...

Oh, I can quit anytime I want to. Really.

(Where's the crack addict icon.)

5
0

hmmm...

----

one wonders if it will give Hotmail users a false sense of security.

----

MS software giving (clueless) users a false sense of security? Say it ain't so!?

3
0

And it bloody doesn't work

As a paying customer I get "Your Windows Live ID can't use HTTPS automatically because this feature is not available for your account type.".

Then genius of this error message is just too much. Not guide on why I've got a unsupported account type or what can be done to help me. Just a big fat sod off.

Add that to a password which can't accept non-numeric characters and you have security and user experience designed by idiots I might finally have to get off my ass and get a decent email account. Ho hum...

2
0

More from The Register

 breaking news
NSA PRISM snoop-gate: Won't someone think of the children, wails Apple
10,000 things probed, mostly about missing kids, Alzheimer patients, we're told
 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights
Speech-to-text drives motorists to distraction
Will talking to you mean I crash into that car up ahead, Siri?
DHS warns of vulns in hospital medical equipment
Has your doctor's anasthesia machine been hacked?
 breaking news
'BadNews is malware' says outfit that found it
Google says code harmless but Lookout says code base is evolving
Panda-peddlers cuffed for chess gambling gambit
More porridge on the menu for Chinese coders after second offence
 breaking news
Yes, maybe we should keep hackers in the clink for YEARS, mulls EU
Watch out black hats, they just might throw away the key
Microsoft borks botnet takedown in Citadel snafu
Stupid Redmond kicked over our honeypots, wail white hats