Forgot your password?
typodupeerror
Security Yahoo!

Security Expert: Yahoo's Email Encryption Needs Work 123

Posted by samzenpus
from the feeling-secure dept.
itwbennett writes "On Tuesday, Yahoo delivered on a promise that it made in October to enable email encryption for everyone by default by January 8. While this is a great step, the company's HTTPS implementation appears to be inconsistent across servers and even technically insecure in some cases, according to Ivan Ristic, director of application security research at security firm Qualys. For example, some of Yahoo's HTTPS email servers use RC4 as the preferred cipher with most clients. 'RC4 is considered weak, which is why we advise that people either don't use it, or if they feel they must, use it as a last resort,' Ristic said."
This discussion has been archived. No new comments can be posted.

Security Expert: Yahoo's Email Encryption Needs Work

Comments Filter:
  • Ya-what? (Score:5, Insightful)

    by hoifelot (798854) on Thursday January 09, 2014 @03:28AM (#45904821)
    I don't understand how yahoo can be alive today. It's been way behind competitors for about a decade. This type of story fits right in with that picture. Okay, if they are still alive, I guess they must be making money. But I'm happy they are still around. Now and then I find that I need to reconnect with a site I haven't used for years, where I registered with my yahoo address... And in that case, it's nice that I'm able to receive a password reset link. But what's the attraction today, besides that?
    • I should say behind competitor, not competitors. But the question still stands.
      • Microsoft with Bing and Hotmail have been a competitor too...

        • My own opinion has been that Hotmail was far inferior to both Google's and Yahoo's offerings. In that light, Google was the only better alternative. Thus "competitor" :-)
          • Re: Ya-what? (Score:4, Insightful)

            by SQLGuru (980662) on Thursday January 09, 2014 @10:28AM (#45906153) Journal

            The recent revamps to Bing / Outlook.com (nee Live.com nee Hotmail.com) have made it better than Yahoo (in my opinion --- and many tech blogs as well). But what Yahoo has going for it is that the high-inertia crowd has been using it for a while and won't budge from it. I know a lot of tech un-savvy baby boomers who won't leave Yahoo because they don't know how to transfer their information and don't want to lose their history. (It's the same crowd that still pays for AOL.)

            • by Zumbs (1241138)

              But what Yahoo has going for it is that the high-inertia crowd has been using it for a while and won't budge from it. I know a lot of tech un-savvy baby boomers who won't leave Yahoo because they don't know how to transfer their information and don't want to lose their history. (It's the same crowd that still pays for AOL.)

              The main reason not to leave your current provider is that decade worth of friends and contacts who know your email address and will most likely continue to use your old email address for quite a while after you switch. I know from experience: I switched from hotmail 8 years ago, and still get the occasional email from a friend there.

        • I ran into someone yesterday with an MSN address -- the 72-year-old contractor about to repair my sidewalk.

          The only person I deal with regularly using an AOL account is my in-law/accountant -- age 74.

          Sounds like a two horse race to me. Wait, what about webtv?
          • Wait, what about webtv?

            I'm a former webtv/msntv user, last used it in 2002. They shut down the service in September of last year. The addresses were transferred over to outlook.com so you might still see webtv.net addresses.

    • Momentum (Score:5, Insightful)

      by sqrt(2) (786011) on Thursday January 09, 2014 @03:35AM (#45904831) Journal

      It was around at the right time to capture a large percentage of normies just getting online for the first time. These people don't like change. They don't really "like" computers in general. To them they're just tools; very frustrating and obtuse tools. Changing e-mail addresses is far more trouble than it is worth--we can barely get these people to give up Windows XP.

      • Re:Momentum (Score:5, Funny)

        by Arker (91948) on Thursday January 09, 2014 @03:38AM (#45904845) Homepage
        Lots of these people actually think their email account is tied to their computer. They think they would have to get a new computer to change email accounts.
        • Wow is all I can say. I had no idea so many people are so incompetent.
          • Re: (Score:3, Informative)

            You think that's bad? I know someone who has been using Windows daily in their job for 20 years and yet they have never heard of/seen Windows Explorer (not IE) and only found out that start/all programs lets you see what apps you have, a few weeks ago. They save all their IE short cuts to the desktop, not to IE. Basically, their desktop is one huge splat of shortcuts to apps and web pages. They even keep their photos and docs there (mercifully in a folder).
            • by sqrt(2) (786011)

              My favorite simpleton is the one who uses MS Word as their file manager.

              I actually have infinite patience for anyone willing to learn the correct way to do something. When someone just wants me to make their horribly inefficient, kludgy, jerry-rigged, workflow continue to work across OS/software versions, I become very annoyed.

              • My favorite simpleton is the one who uses MS Word as their file manager.

                How?

                • by operagost (62405)
                  I'm going to guess they use the Open File dialog.
                  • I'm so used to Linux I didn't realize that the File Dialog in windows was basically a full featured Explorer window until I tested it just a minute ago.

            • I know someone who has been using Windows daily in their job for 20 years and yet they have never heard of/seen Windows Explorer (not IE)

              What? How can that be? I'm not doubting you, but how did they "do" things without encountering Windows Explorer?

              and only found out that start/all programs lets you see what apps you have, a few weeks ago

              Correct me if I'm wrong, I rarely use Windows, but isn't "All Programs" near the very top of the Start Menu. How did they manage not using that or even clicking on it by accident.

              They save all their IE short cuts to the desktop, not to IE.

              But doesn't that require them to not run IE maximized and drag the address bar to the desktop?

              You have made my head explode out of sheer "Whaaaaat?" today.

              • by SQLGuru (980662)

                If you use the My Computer icon, you get a different view of Windows Explorer. While under the covers, it's the same program, "normals" won't recognize this fact and will never know that they are running Windows Explorer. Besides, your desktop is actually just a special mode of Explorer.exe....."normals" certainly won't know that.

                I would suspect that people who don't know how to navigate files and folders very well don't know how to maximize a window.......so they probably don't run maximized anyway.

              • but how did they "do" things without encountering Windows Explorer?

                Probably same way as sqrt's aquaintence. They'd open Word and use the file/open dialog to look around the filesystem.

                How did they manage not using that or even clicking on it by accident.

                No idea. They didn't seem to use the Start Button much for anything.

                But doesn't that require them to not run IE maximized and drag the address bar to the desktop?

                No, they use file/send to/desktop as a shortcut.

                You have made my head explode

                You should worry,

                • Probably same way as sqrt's aquaintence. They'd open Word and use the file/open dialog to look around the filesystem.

                  But they couldn't do any file manipulation that way, can they? Or can you use Word's file dialog to open things in other applications? (testing) Ah....the Word file dialog is basically a full featured explorer window unlike file dialogs in Linux. That explains it.

                  • by rjstanford (69735)

                    The one benefit to this - one of the very few things that I miss about Windows - is that you can (for example) do file-open and then just as you can paste the FQpath to a file and hit enter to open it, you can post any URL to open it as a file. Handy little shortcut sometimes.

          • Wow is all I can say. I had no idea so many people are so incompetent.

            You've obviously never worked in IT support. Some woman where I worked was complaining was too slow, until my colleague changed the speed of the mouse cursor. Then everything was fast and perfect. She even bought him coffee.

            • Wow is all I can say. I had no idea so many people are so incompetent.

              You've obviously never worked in IT support. Some woman where I worked was complaining *her PC* was too slow, until my colleague changed the speed of the mouse cursor. Then everything was fast and perfect. She even bought him coffee.

              Sorry, fixed.

          • by Krojack (575051)

            These are the same people that think the entire Internet has crashed when they get a 404 error message in IE.

        • Re:Momentum (Score:5, Insightful)

          by Mashiki (184564) <mashiki@gmail. c o m> on Thursday January 09, 2014 @04:02AM (#45904901) Homepage

          Lots of these people actually think their email account is tied to their computer. They think they would have to get a new computer to change email accounts.

          I suppose that's possible. After all, people have long grown up with the address=home. In turn, computer = unique address, and they don't see a mechanism(to transfer-though not needed), for their new computer like they would with a house/apt/etc. Though I will say in the 18 years I've been working with computers I've never seen this.

          • Lots of these people actually think their email account is tied to their computer. They think they would have to get a new computer to change email accounts.

            I suppose that's possible. [snip] Though I will say in the 18 years I've been working with computers I've never seen this.

            You obviously haven't worked very much with people over the age of 60, particularly blue-collar folks who never really had to do much with computers at a job.

            Many older people just simply don't get the idea of the internet at all. They don't understand the difference between stuff that's on their computer vs. stuff stored online. They don't understand the difference between turning on their computer and "going online." They don't understand the difference between running a local application vs. doing s

            • by Mashiki (184564)

              You obviously haven't worked very much with people over the age of 60, particularly blue-collar folks who never really had to do much with computers at a job.

              About 75% of the calls that I used to do before I got out of the "home" side of it was seniors over 65, and blue collar workers. Maybe, there's a fundamental difference between the understanding between Canada and the US, being that in Canada here we have a higher penetration of general technology, computers, internet, and use of said technologies in the workplace.

      • You're absolutely right. I forgot that changing your email address can be a big hurdle/insurmountable task for many people.
      • by Monoman (8745)

        Exactly. The same kind of people still have AOL accounts... heck I know one or two MSN customers too. These "portals" are the Internet to them. Luckily for Y!/AOL their remaining customers are plentiful and don't know how to block ads.

      • I changed my wife from ATT/Yahoo just yesterday. She seldom uses email so when we got ATT Uverse I left here with the att.net email address. It's been constant trouble. I was one of those who adopted Yahoo back about 2003 as a disposable email account for such things as registering software etc. and wound up using it quite a bit for its access anywhere facility. With most ISPs of that time email only worked when you were logged in on their service. I changed to Gmail about 4 years ago when all my Yahoo con
    • Re: (Score:3, Informative)

      by metrix007 (200091)

      Because it leads in Asia, ahead of Google.

    • I've never trusted Google but used them until other options rose to a good enough level to move over to. I currently use Yahoo as their email client is really good and my job forces me to move every few years so I want to maintain the same email address. Google's email is basic but still very good and I think Microsoft's Hotmail has gotten much better so I use that as well.

      BTW, I'm referring to each's webmail.
    • Re:Ya-what? (Score:5, Interesting)

      by TheloniousToady (3343045) on Thursday January 09, 2014 @09:43AM (#45905921)

      OK, I'll bite. There still are a few things they do well. For example, their Finance feature [yahoo.com] is among the best in class of financial information (IMHO).

      I began using their email system as a POP server years ago, mainly because I thought the spam filtering worked very well. At some point, they changed their system so that you had to use their address as the reply address, so I began using that rather than my website's forwarding address. Although that should have alienated me and made me go elsewhere, I stuck with them, so now people are used to replying to the Yahoo address and it's hard to switch to something else.

      I used to use their "classic" (old-fashioned) mail but they forced me and everyone else out of that last year. So, I got used to the new email interface and even generally like it now, but the performance problems still are inexcusable. For example, I sent one email several times the other day after their system said it had failed to send it, then multiple copies of it appeared in my "Sent" list. So, did it go out or not? - who knows?

      Their longstanding "Groups" system still has some attractive features. I tried to find a replacement for it recently for an email list I've run for several years, and I couldn't find any similar free and ready-made (no installation) email group service that allows users to subscribe themselves.

      There seems to be a theme lately of Yahoo changing the cosmetics of their system as often as possible. However, they don't seem to understand that users don't want change unless there is a clear benefit to them. And users also don't want continuous change - they need time to digest each new thing that's foisted on them. Yahoo also seems to be disregarding the impact all these changes have on system performance. Even after tolerating senseless change, I'm just about ready to abandon their email due to its increasingly poor performance.

      I find their search to be OK, though I'm not particularly loyal to it. Honestly, I can't tell much difference between Yahoo/Bing search and Google, so I just use whichever one comes up in the browser I happen to be using. However, my perception is that Google is very slightly better.

      Overall, the challenge for Yahoo is to modernize their systems after years of neglect, while retaining the things that people like about them (in my case: finance, spam filtering, and groups), without impacting quality in terms of performance and security. They might get to the Promised Land one day, but there's a lot of desert to cross first.

      • by Anonymous Coward

        For example, their Finance feature is among the best in class of financial information (IMHO).

        They also run one of (or the?) the most used fantasy sports sites on the net.

      • by Bill Dimm (463823)

        There still are a few things they do well. For example, their Finance feature [yahoo.com] is among the best in class of financial information (IMHO).

        Except that their charts show the price of the stock/fund without adjusting for dividends, i.e. there is no way to graph "adjusted price" or "growth of a $1000 investment." So, when a mutual fund makes a big capital gain payout, which has no economic significance (they hand you a check for $X per share and the share price drops by $X), the chart shows a big dip. If you try to chart two securities together to compare them it is totally misleading because of the economically meaningless dips when there is a

        • When a discussion of financial monitoring gets this detailed on Slashdot it's time for me to cash out of the market.
      • by Zumbs (1241138)

        I used to use their "classic" (old-fashioned) mail but they forced me and everyone else out of that last year.

        You can actually still switch to an even more old-fashioned UI. I know, because I did. The main reason was that their new and "improved" UI hides folders, so you cannot see new mail in your folders unless you actively expand your folders list. Secondary reason was that you could no longer move your mouse over a sender and get a tooltip stating the address of the sender.

      • It seems Yahoo have made IMAP access to email free.
  • Progress. (Score:5, Interesting)

    by ptudor (22537) on Thursday January 09, 2014 @03:53AM (#45904879) Homepage Journal

    It's important to remember that only a year ago RC4 was a recommended solution and TLS1.2 support in browsers like Firefox and older operating systems has been slow to arrive. So I look at this as an important first step, with progressive refinements sure to follow. In the same way that Facebook introduced https in response to Tunisia and slowly made it an option for all users before making it default, Yahoo, while slow in adopting a model of default security, has to walk similar steps. They may have had an SSL-beta-option for the last year, but given their AOL-Like user base, I can understand being conservative in adopting new methods and being liberal in the ciphers they provide. Someone using Chrome in Mavericks may expect support for SPDY3 with AES-GCM, but for a user base that may be using IE6 or FF3 on XP still, for a company that caters to people who will never know what GCM or SHA2 is it best to avoid the headline, "Yahoo Mail is Broken for tens of thousands of users." They'll get there. Thanks for trying, Yahoo.

    Now, can someone at Microsoft turn on STARTTLS? For that matter, I wish NANOG would turn on STARTTLS for inbound connections.

    Also, IPv6... please... IPv6...

    • by Anonymous Coward

      It's important to remember that only a year ago RC4 was a recommended solution and TLS1.2 support in browsers like Firefox and older operating systems has been slow to arrive.

      It was only recommended as a counter to the BEAST attack, which exploited the way block ciphers worked. Since RC4 is a stream cipher it was not subject to this exploit, but a lot of people were uneasy about the recommendation. This is because while it was resilient against BEAST, everyone knew that RC4 was/is on its last legs, but it was the lesser of two evils.

      When a workaround for BEAST was created (n/n-1 record splitting), and implemented in just about every browser, the BEAST attack became mostly moot,

  • by cffrost (885375) on Thursday January 09, 2014 @04:05AM (#45904905) Homepage

    Unfortunately — in Firefox, at least — ciphers can only be toggled, not given a priority. Control over cipher selection (and other HTTPS parameters, such as key length, key exchange, hash (MD5/SHA)., etc.) lies with the server operator. In my own testing, the arbitrated HTTPS parameters are most frequently prioritized in some order without regard to strength, or prioritized from weakest-to-strongest (or perhaps least-to-most expensive to execute).

    In order to retain manageable security, I have only TLS 1.0-1.2 enabled, MD5 disabled, all RC4-employing combos disabled, with the last being switchable via a check box provided by "CipherFox." [github.com] (Additional features of use to "CipherFox" users are provided by "Calomel SSL Validation." [calomel.org]; I recommend both.)

    • So if a website gives you only HTTPS with RC4 or HTTP in clear text as options - why would you choose clear text?

      This is totally illogical. Yes RC4 sucks but it is better than clear text - ANYTHING is better than clear text. The only possible argument for this would be "false sense of security", but if you think average people pay any attention to that padlock in the status bar, you are delusional.

      • Your locig fails as soon as with ROT13 - not better than clear text.
        • by cffrost (885375)

          Your [logic] fails as soon as with ROT13 - not better than clear text.

          I disagree; ROT-whatever would at least help defend one from automated surveillance of plaintext keywords, and very lazy/unmotivated human eavesdroppers.

      • by cffrost (885375) on Thursday January 09, 2014 @09:29AM (#45905849) Homepage

        So if a website gives you only HTTPS with RC4 or HTTP in clear text as options - why would you choose clear text?

        This is totally illogical. Yes RC4 sucks but it is better than clear text - ANYTHING is better than clear text. The only possible argument for this would be "false sense of security", but if you think average people pay any attention to that padlock in the status bar, you are delusional.

        I agree with you wholeheartedly — in fact, I accept some questionable certs in my zeal to transfer ciphertext instead of plaintext.

        However, I neglected to mention in my previous post that I also use EFF's "HTTPS Everywhere," [eff.org] and an extension for that extension called "HTTPS Finder" [google.com] — the former forces HTTPS if the host is known to support it, and the latter forces HTTPS if an HTTPS connection is possible (and creates a new rule for "HTTPS Everywhere"), even with requisite security.ssl3. cipher suites disabled in about:config .

        (I figured anyone knuckle-deep in their browser's HTTPS configuration would be aware of them (and hopefully, using them). I recommend both, emphatically — "HTTPS Everywhere" alone yields a vast improvement in security/privacy, and has the benefit of a very long, expert-managed list of defaults.)

        Thus, if RC4 is needed and I have it disabled, I'll be presented with an "ssl_error_no_cypher_overlap" error page, then I enable RC4 and reload. The only weakness there is in my forgetting to re-disable RC4, but the two extensions I mentioned in my initial post help in this effort, alerting me in various ways if/when I connect to another host using weak security:

        "CipherFox" displays the cipher suite (or configurable portions thereof) in use on the status bar (e.g., it shows me "AES-256 RSA-4096 SHA1" on DDG), as well as providing the "Enable RC4" check-item on the Tools menu.

        "Calomel SSL Validation" displays (on my nav. bar) a color-coded shield that represents a percentage security rating based on weighted factors drawn from the cert and cipher suite, the breakdown of which is displayed via clicking the shield icon.

    • by metrix007 (200091)

      You're foolish.

      RC4 is better than cleartext, which is what you may end up with your configuration.

      The attack to exploit RC4 is also complicated, and unlikely to occur across the internet.

      • by cffrost (885375)

        You're foolish.

        I disagree, but I may be biased.

        RC4 is better than cleartext [...]

        I agree.

        [...] which is what you may end up with your configuration.

        No it isn't — please see my reply to brunes69.

        To anyone who read only my initial post, please note that I use two additional plug-ins which thwart a plaintext connection with any host with which any encrypted connection is possible, including RC4: "HTTPS Everywhere" and "HTTPS Finder" — see my reply to brunes69 for links/further info.

        My apologies to everyone for neglecting to include important info in my initial post, particularly to anyone who got the imp

  • by abies (607076) on Thursday January 09, 2014 @04:26AM (#45904939)

    I wonder, in real world, how big percentage of the attacks are performed by man-in-the-middle (where strength of cypher matters). Between

    1) 3 letter agencies just accessing content directly on Yahoo servers
    2) Somebody hacking router between you and Yahoo (or evesdropping on physical line) and performing very costly cypher break
    3) Having trojan/keylogger/whatever on your machine giving access to everything

    How much point 2 is a problem compared to 1 and 3? People can write a lot about how usage of bad cipher will allow your mails to be cracked in 1 day instead of 5 billion years... but probably 99% of compromised emails are accessed through 1 or 3.

    It is like with optimizing code. You could optimize hotspot where 99% of cpu time is spent, but it is hard. So instead you optimize all things around, making other 1% order of magnitudes faster and then forget than you cannot do anything about remaining 99%...

    • by ptudor (22537)

      I'd add a #4, or #2a, Man-In-The-Middle the certificate. Diginotar's compromise, never the huge bundle of trusted certificates in every browser/OS, makes it easy. Whatever an enterprise can do with GPOs and Websense can happen in the wild too. (I kinda prefer self-signed certificates anymore.)

      Overall I agree, but I still cry out in pain when I see people choosing to use 3DES and disable PFS.

    • by Dagger2 (1177377)

      If it doesn't happen, then good. The encryption is doing what it's supposed to do.

      (I've seen brochures for products that can MITM encrypted Bittorrent connections in order to log what's being transferred, so yes, people will take advantage of weak encryption if it's easy enough to do so.)

    • by Kardos (1348077)

      The reason #2 is not a common problem is because of the strong encryption -- it's a technical problem that is, for the most part, solved. If the encryption becomes easily breakable, #2 would swiftly become a problem again (think coffee-shop wifi operators, nosy employers/schools, etc.). #1 and #3 are social problems, and I agree that they need plenty of attention, however maintaining sufficient encryption to keep #2 closed is definitely not wasted effort.

    • by CastrTroy (595695)
      Yeah, this reminds me of my security professor's opinion on SSL. It's great at what it does, but it pretty much does nothing to stop your credit card number from being stolen. It's a good idea to encrypt your credit card information when sending it to the online store. It's a better idea to come up with a payment system where you don't have to send your credit card info to the online store. Personally, I think that PayPal has done more for payment security than SSL has. At least with PayPal, only they ne
  • by korbulon (2792438) on Thursday January 09, 2014 @05:20AM (#45905081)

    Yahoo reminds me of a journeyman heavyweight boxer taking the champ into deep rounds despite taking a serious beating. He simply will not go down.

    They impress for sheer resilience, if for nothing else.

    • by Virtucon (127420)

      What is keeping Yahoo up? /quote?
      Viagra or Cialis?

    • by VortexCortex (1117377) <VortexCortex AT ... trograde DOT com> on Thursday January 09, 2014 @08:11AM (#45905525)

      In order for me to thrive as a business I merely need to make enough money to pay expenses and employees. I don't have to defeat the heavyweight. I just have to dodge their blows.

      The stock market's demand for growth is untenable. Overextended businesses die; The name for unchecked growth is cancer. I've discovered that business maturity exists. Focusing on improving my services and better ability to meet customer needs / better dialog beats overextension through growth hands down. On the public market I'd be slaughtered. I refuse to grow faster than necessary. This way I can stay more nimble and adjust to changes and new tech faster than my competition. Instead of growing, I concentrated on streamlining agility. Eg: You could invent 50 new platforms tomorrow. In one year, I'll have support for them all without requiring any growth to gain the specialization. I have an excellent platform abstraction layer.

      I'm not partial to Yahoo, but their board has more sane business sense than most. Their retention isn't necessarily impressive, but to dodge blows while in dire need of a tourniquet is commendable. It's caused them to make some compromising business decisions, however.

  • Unfortunately, Iceweasel/Firefox don't indicate what cipher is used by an https connection, so Yahoo gives you a false sense of security with the use of RC4. So do many other websites.

    There should be some indicator of just how secure an HTTPS connection is (maybe shifting the colour of the padlock from red through orange, yellow, and green as the strength of the cipher improves.) One should also be able to select which ciphers are considered valid by their browser.

    • by profplump (309017)

      You can select which ciphers you accept. In Firefox the preference is something like "security.ssl3.rsa_rc4_128_md5" -- I'm sure if you search for RC4 in the about:config page you can find the relevant settings. You can explicitly allow or disallow whatever combination of ciphers you like.

      And it's not a "false sense of security" when the indicator is binary. It's not as descriptive as telling you what cipher is in use, but it's still encrypted and would take a lot of effort to decrypt (weaknesses have been

  • Ivan Ristic; is he the father of Hugh?
  • by daveewart (66895) on Thursday January 09, 2014 @06:13AM (#45905199)

    While the article is correct and uses precise terminology, the summary is wrong to use the term "email encryption". That term is for encrypted email messages using PGP/GPG/S-MIME.

    Yahoo have no framework for email encryption. This article is about use of HTTPS for their webmail service and (a) whether that has been implemented and, if so, (b) whether it has been done correctly.

    The answers to which are: (a) mostly and (b) no.

    • That term is for encrypted email messages using PGP/GPG/S-MIME.

      Yahoo have no framework for email encryption.

      Don't really need a framework if you have POP3 or IMAP access to it, then you can use a "real" e-mail client that DOES have GnuPG or S/MIME support. It should also cure the HTTPS issue.

      • I know Yahoo don't have (nor need) a framework for email encryption. My comment was simply a clarification. :-)

      • by CastrTroy (595695)
        You still need to encrypt the email as it's being sent out to the recipients, and you still need the incoming email to be encrypted as it's getting initially sent to Yahoo's servers. It doesn't matter if it's encrypted when you're reading it if it was already intercepted before it got to your inbox. Simillarly, it doesn't matter if the message you're sending is encrypted between you and Yahoo if Yahoo sends it in plain text to the recipient.
        • Simillarly, it doesn't matter if the message you're sending is encrypted between you and Yahoo if Yahoo sends it in plain text to the recipient.

          Yes I understand that what TFA is referring to is the SSL/TLS encryption between browser or mail client and the website/server

          But what some of us here in this thread are talking about is "client side encryption between sender and recipient If say Bob encrypts an email with GnuPG or S/MIME to Alice it doesn't matter if the Alice's connection to their mail server isn't SSL, the message is still encrypted and gobbledygook to any interceptor.

          For example here is a tiny bit of what an ascii armored encrypted mes

  • Google Chrome 31.0.1650.63 + Gmail: RC4_128...
    • Why are you using a web browser to access gmail when you can use IMAP with a proper email client using proper TLS. Not only that you don't see ads that way and gain the ability to use GnuPG or S/MIME encryption if you want to.

      • I perceived gmail+imap as kind of a hack: strange mappings to labels, double directorys (trash). And the webinterface gives me a more natural feeling for like hangouts and todo list in the sidebar, mail-templates synchroniced and so on. And one gui across device/os borders.
  • Why do people insist on using a web browser to read their mail instead of a proper e-mail client that implements proper TLS and every other feature that an e-mail client has that the web interface doesn't. It's not like people can't access their webmail over proper IMAP or POP3, which has advantages like seeing no advertising and the ability to use GnuPG or S/MIME encryption if one wants.

    • by jader3rd (2222716)

      Why do people insist on using a web browser to read their mail instead of a proper e-mail client

      Because that involves setting up an email client. Most people can't be bothered to do that, and for some strange reason find it annoying when somebody does do it on their behalf.

      • Because that involves setting up an email client.

        But you only have to do it once! Set it and forget it. And people even "normal" users used to have to do it.

        • by jader3rd (2222716)

          But you only have to do it once! Set it and forget it. And people even "normal" users used to have to do it.

          When it comes to effort 0 > 1.

  • I got sick to death of my 10+ year yahoo account being "compromised", just out of the blue. My passwords are always secure using multiple caps/numbers/symbols etc.
    My gmail/hotmail accounts never gave me this hassle.

    Everytime you want to "recover" your account, you have to siv through pages, and pages of crap. Once you confirm your account with another email on file, you then have to provide your current password (which has been compromised and changed) to get in.
    This could all be avoided if Yahoo mail actua

  • With the abundance of older operating systems out there, I think browser code and general websites will still be hampered for quite sometime. For Yahoo and others that means the lowest common denominator needs to be supported for quite sometime. If you're rolling out your own website and can control those variables then certainly you can enforce TLS 1.2 with ciphers that are much stronger than RC4. If you can't control the client side in terms of minimum support that unfortunately means TLS 1.0 and RC4 i

  • As others have said here, encryption from sender to receiver (including all hops in between) is what's really important, and would render encryption at the web/IMAP/POP level unnecessary. SMTP is used between all hops (unless, I assume, a message originates and ends at the same server), and survives from the early days of network computing when all of us who were on the net knew each other. It should not have survived to a public Internet, for reasons that became obvious pretty quickly.

    Lack of security an

  • That would still be insecured. :P

It's been a business doing pleasure with you.

Working...