Security Expert: Yahoo's Email Encryption Needs Work 123
itwbennett writes "On Tuesday, Yahoo delivered on a promise that it made in October to enable email encryption for everyone by default by January 8. While this is a great step, the company's HTTPS implementation appears to be inconsistent across servers and even technically insecure in some cases, according to Ivan Ristic, director of application security research at security firm Qualys. For example, some of Yahoo's HTTPS email servers use RC4 as the preferred cipher with most clients. 'RC4 is considered weak, which is why we advise that people either don't use it, or if they feel they must, use it as a last resort,' Ristic said."
Ya-what? (Score:5, Insightful)
Re: Ya-what? (Score:1)
Re: (Score:2)
Microsoft with Bing and Hotmail have been a competitor too...
Re: Ya-what? (Score:2)
Re: Ya-what? (Score:4, Insightful)
The recent revamps to Bing / Outlook.com (nee Live.com nee Hotmail.com) have made it better than Yahoo (in my opinion --- and many tech blogs as well). But what Yahoo has going for it is that the high-inertia crowd has been using it for a while and won't budge from it. I know a lot of tech un-savvy baby boomers who won't leave Yahoo because they don't know how to transfer their information and don't want to lose their history. (It's the same crowd that still pays for AOL.)
Re: (Score:3)
But what Yahoo has going for it is that the high-inertia crowd has been using it for a while and won't budge from it. I know a lot of tech un-savvy baby boomers who won't leave Yahoo because they don't know how to transfer their information and don't want to lose their history. (It's the same crowd that still pays for AOL.)
The main reason not to leave your current provider is that decade worth of friends and contacts who know your email address and will most likely continue to use your old email address for quite a while after you switch. I know from experience: I switched from hotmail 8 years ago, and still get the occasional email from a friend there.
Coincidence (Score:3)
The only person I deal with regularly using an AOL account is my in-law/accountant -- age 74.
Sounds like a two horse race to me. Wait, what about webtv?
Re: (Score:3)
Wait, what about webtv?
I'm a former webtv/msntv user, last used it in 2002. They shut down the service in September of last year. The addresses were transferred over to outlook.com so you might still see webtv.net addresses.
Momentum (Score:5, Insightful)
It was around at the right time to capture a large percentage of normies just getting online for the first time. These people don't like change. They don't really "like" computers in general. To them they're just tools; very frustrating and obtuse tools. Changing e-mail addresses is far more trouble than it is worth--we can barely get these people to give up Windows XP.
Re:Momentum (Score:5, Funny)
Re: Momentum (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
My favorite simpleton is the one who uses MS Word as their file manager.
I actually have infinite patience for anyone willing to learn the correct way to do something. When someone just wants me to make their horribly inefficient, kludgy, jerry-rigged, workflow continue to work across OS/software versions, I become very annoyed.
Re: (Score:2)
My favorite simpleton is the one who uses MS Word as their file manager.
How?
Re: (Score:1)
Re: (Score:2)
I'm so used to Linux I didn't realize that the File Dialog in windows was basically a full featured Explorer window until I tested it just a minute ago.
Re: (Score:2)
I know someone who has been using Windows daily in their job for 20 years and yet they have never heard of/seen Windows Explorer (not IE)
What? How can that be? I'm not doubting you, but how did they "do" things without encountering Windows Explorer?
and only found out that start/all programs lets you see what apps you have, a few weeks ago
Correct me if I'm wrong, I rarely use Windows, but isn't "All Programs" near the very top of the Start Menu. How did they manage not using that or even clicking on it by accident.
They save all their IE short cuts to the desktop, not to IE.
But doesn't that require them to not run IE maximized and drag the address bar to the desktop?
You have made my head explode out of sheer "Whaaaaat?" today.
Re: (Score:2)
If you use the My Computer icon, you get a different view of Windows Explorer. While under the covers, it's the same program, "normals" won't recognize this fact and will never know that they are running Windows Explorer. Besides, your desktop is actually just a special mode of Explorer.exe....."normals" certainly won't know that.
I would suspect that people who don't know how to navigate files and folders very well don't know how to maximize a window.......so they probably don't run maximized anyway.
Re: (Score:2)
Probably same way as sqrt's aquaintence. They'd open Word and use the file/open dialog to look around the filesystem.
No idea. They didn't seem to use the Start Button much for anything.
No, they use file/send to/desktop as a shortcut.
You should worry,
Re: (Score:2)
Probably same way as sqrt's aquaintence. They'd open Word and use the file/open dialog to look around the filesystem.
But they couldn't do any file manipulation that way, can they? Or can you use Word's file dialog to open things in other applications? (testing) Ah....the Word file dialog is basically a full featured explorer window unlike file dialogs in Linux. That explains it.
Re: (Score:2)
The one benefit to this - one of the very few things that I miss about Windows - is that you can (for example) do file-open and then just as you can paste the FQpath to a file and hit enter to open it, you can post any URL to open it as a file. Handy little shortcut sometimes.
Re: (Score:2)
Re: (Score:2)
Wow is all I can say. I had no idea so many people are so incompetent.
You've obviously never worked in IT support. Some woman where I worked was complaining was too slow, until my colleague changed the speed of the mouse cursor. Then everything was fast and perfect. She even bought him coffee.
Re: (Score:2)
Wow is all I can say. I had no idea so many people are so incompetent.
You've obviously never worked in IT support. Some woman where I worked was complaining *her PC* was too slow, until my colleague changed the speed of the mouse cursor. Then everything was fast and perfect. She even bought him coffee.
Sorry, fixed.
Re: (Score:2)
These are the same people that think the entire Internet has crashed when they get a 404 error message in IE.
Re: (Score:2)
Re:Momentum (Score:5, Insightful)
Lots of these people actually think their email account is tied to their computer. They think they would have to get a new computer to change email accounts.
I suppose that's possible. After all, people have long grown up with the address=home. In turn, computer = unique address, and they don't see a mechanism(to transfer-though not needed), for their new computer like they would with a house/apt/etc. Though I will say in the 18 years I've been working with computers I've never seen this.
Re: (Score:2)
Lots of these people actually think their email account is tied to their computer. They think they would have to get a new computer to change email accounts.
I suppose that's possible. [snip] Though I will say in the 18 years I've been working with computers I've never seen this.
You obviously haven't worked very much with people over the age of 60, particularly blue-collar folks who never really had to do much with computers at a job.
Many older people just simply don't get the idea of the internet at all. They don't understand the difference between stuff that's on their computer vs. stuff stored online. They don't understand the difference between turning on their computer and "going online." They don't understand the difference between running a local application vs. doing s
Re: (Score:2)
You obviously haven't worked very much with people over the age of 60, particularly blue-collar folks who never really had to do much with computers at a job.
About 75% of the calls that I used to do before I got out of the "home" side of it was seniors over 65, and blue collar workers. Maybe, there's a fundamental difference between the understanding between Canada and the US, being that in Canada here we have a higher penetration of general technology, computers, internet, and use of said technologies in the workplace.
Re: Momentum (Score:2)
Re: (Score:3)
Exactly. The same kind of people still have AOL accounts... heck I know one or two MSN customers too. These "portals" are the Internet to them. Luckily for Y!/AOL their remaining customers are plentiful and don't know how to block ads.
Re: (Score:1)
Re: (Score:3, Informative)
Because it leads in Asia, ahead of Google.
Re: (Score:2)
Re:Ya-what? (Score:5, Interesting)
OK, I'll bite. There still are a few things they do well. For example, their Finance feature [yahoo.com] is among the best in class of financial information (IMHO).
I began using their email system as a POP server years ago, mainly because I thought the spam filtering worked very well. At some point, they changed their system so that you had to use their address as the reply address, so I began using that rather than my website's forwarding address. Although that should have alienated me and made me go elsewhere, I stuck with them, so now people are used to replying to the Yahoo address and it's hard to switch to something else.
I used to use their "classic" (old-fashioned) mail but they forced me and everyone else out of that last year. So, I got used to the new email interface and even generally like it now, but the performance problems still are inexcusable. For example, I sent one email several times the other day after their system said it had failed to send it, then multiple copies of it appeared in my "Sent" list. So, did it go out or not? - who knows?
Their longstanding "Groups" system still has some attractive features. I tried to find a replacement for it recently for an email list I've run for several years, and I couldn't find any similar free and ready-made (no installation) email group service that allows users to subscribe themselves.
There seems to be a theme lately of Yahoo changing the cosmetics of their system as often as possible. However, they don't seem to understand that users don't want change unless there is a clear benefit to them. And users also don't want continuous change - they need time to digest each new thing that's foisted on them. Yahoo also seems to be disregarding the impact all these changes have on system performance. Even after tolerating senseless change, I'm just about ready to abandon their email due to its increasingly poor performance.
I find their search to be OK, though I'm not particularly loyal to it. Honestly, I can't tell much difference between Yahoo/Bing search and Google, so I just use whichever one comes up in the browser I happen to be using. However, my perception is that Google is very slightly better.
Overall, the challenge for Yahoo is to modernize their systems after years of neglect, while retaining the things that people like about them (in my case: finance, spam filtering, and groups), without impacting quality in terms of performance and security. They might get to the Promised Land one day, but there's a lot of desert to cross first.
Re: (Score:1)
For example, their Finance feature is among the best in class of financial information (IMHO).
They also run one of (or the?) the most used fantasy sports sites on the net.
Re: (Score:3)
There still are a few things they do well. For example, their Finance feature [yahoo.com] is among the best in class of financial information (IMHO).
Except that their charts show the price of the stock/fund without adjusting for dividends, i.e. there is no way to graph "adjusted price" or "growth of a $1000 investment." So, when a mutual fund makes a big capital gain payout, which has no economic significance (they hand you a check for $X per share and the share price drops by $X), the chart shows a big dip. If you try to chart two securities together to compare them it is totally misleading because of the economically meaningless dips when there is a
Re: (Score:1)
Re: (Score:2)
I used to use their "classic" (old-fashioned) mail but they forced me and everyone else out of that last year.
You can actually still switch to an even more old-fashioned UI. I know, because I did. The main reason was that their new and "improved" UI hides folders, so you cannot see new mail in your folders unless you actively expand your folders list. Secondary reason was that you could no longer move your mouse over a sender and get a tooltip stating the address of the sender.
Re: (Score:1)
Re: (Score:2)
You can't tell the difference between Yahoo, Bing, and Google. I'm ignoring everything you said now.
OK, I'll bite. What exactly is the difference between Yahoo and Bing? ;-)
Regarding Google, have you ever taken the Bing Test? I have, and the results didn't show any clear preference for me. In fact, I think my minor perceived preference for Google mostly has to do with its simple clean interface, that is, its cosmetics. There's a reason that Yahoo has been systematically updating its cosmetics: people respond to that, whether they realize it or not.
Anyway, even if you do objectively prefer Google for s
Re: (Score:2)
Yahoo Surpasses Google in Web Traffic, Somehow [nytimes.com]
Yahoo Takes Web Traffic Crown From Google — But Is It Winning? [wired.com]
Yahoo Sports
tumblr
Flickr
Fantasy Football
Progress. (Score:5, Interesting)
It's important to remember that only a year ago RC4 was a recommended solution and TLS1.2 support in browsers like Firefox and older operating systems has been slow to arrive. So I look at this as an important first step, with progressive refinements sure to follow. In the same way that Facebook introduced https in response to Tunisia and slowly made it an option for all users before making it default, Yahoo, while slow in adopting a model of default security, has to walk similar steps. They may have had an SSL-beta-option for the last year, but given their AOL-Like user base, I can understand being conservative in adopting new methods and being liberal in the ciphers they provide. Someone using Chrome in Mavericks may expect support for SPDY3 with AES-GCM, but for a user base that may be using IE6 or FF3 on XP still, for a company that caters to people who will never know what GCM or SHA2 is it best to avoid the headline, "Yahoo Mail is Broken for tens of thousands of users." They'll get there. Thanks for trying, Yahoo.
Now, can someone at Microsoft turn on STARTTLS? For that matter, I wish NANOG would turn on STARTTLS for inbound connections.
Also, IPv6... please... IPv6...
RC4, BEAST, perfect forward security, recommendati (Score:3, Informative)
It's important to remember that only a year ago RC4 was a recommended solution and TLS1.2 support in browsers like Firefox and older operating systems has been slow to arrive.
It was only recommended as a counter to the BEAST attack, which exploited the way block ciphers worked. Since RC4 is a stream cipher it was not subject to this exploit, but a lot of people were uneasy about the recommendation. This is because while it was resilient against BEAST, everyone knew that RC4 was/is on its last legs, but it was the lesser of two evils.
When a workaround for BEAST was created (n/n-1 record splitting), and implemented in just about every browser, the BEAST attack became mostly moot,
"[U]se [RC4] as a last resort." (Score:5, Informative)
Unfortunately — in Firefox, at least — ciphers can only be toggled, not given a priority. Control over cipher selection (and other HTTPS parameters, such as key length, key exchange, hash (MD5/SHA)., etc.) lies with the server operator. In my own testing, the arbitrated HTTPS parameters are most frequently prioritized in some order without regard to strength, or prioritized from weakest-to-strongest (or perhaps least-to-most expensive to execute).
In order to retain manageable security, I have only TLS 1.0-1.2 enabled, MD5 disabled, all RC4-employing combos disabled, with the last being switchable via a check box provided by "CipherFox." [github.com] (Additional features of use to "CipherFox" users are provided by "Calomel SSL Validation." [calomel.org]; I recommend both.)
I don't understand this reasoning at all (Score:2)
So if a website gives you only HTTPS with RC4 or HTTP in clear text as options - why would you choose clear text?
This is totally illogical. Yes RC4 sucks but it is better than clear text - ANYTHING is better than clear text. The only possible argument for this would be "false sense of security", but if you think average people pay any attention to that padlock in the status bar, you are delusional.
Re: (Score:2)
Re: (Score:2)
Your [logic] fails as soon as with ROT13 - not better than clear text.
I disagree; ROT-whatever would at least help defend one from automated surveillance of plaintext keywords, and very lazy/unmotivated human eavesdroppers.
Re:I don't understand this reasoning at all (Score:4, Interesting)
So if a website gives you only HTTPS with RC4 or HTTP in clear text as options - why would you choose clear text?
This is totally illogical. Yes RC4 sucks but it is better than clear text - ANYTHING is better than clear text. The only possible argument for this would be "false sense of security", but if you think average people pay any attention to that padlock in the status bar, you are delusional.
I agree with you wholeheartedly — in fact, I accept some questionable certs in my zeal to transfer ciphertext instead of plaintext.
However, I neglected to mention in my previous post that I also use EFF's "HTTPS Everywhere," [eff.org] and an extension for that extension called "HTTPS Finder" [google.com] — the former forces HTTPS if the host is known to support it, and the latter forces HTTPS if an HTTPS connection is possible (and creates a new rule for "HTTPS Everywhere"), even with requisite security.ssl3. cipher suites disabled in about:config .
(I figured anyone knuckle-deep in their browser's HTTPS configuration would be aware of them (and hopefully, using them). I recommend both, emphatically — "HTTPS Everywhere" alone yields a vast improvement in security/privacy, and has the benefit of a very long, expert-managed list of defaults.)
Thus, if RC4 is needed and I have it disabled, I'll be presented with an "ssl_error_no_cypher_overlap" error page, then I enable RC4 and reload. The only weakness there is in my forgetting to re-disable RC4, but the two extensions I mentioned in my initial post help in this effort, alerting me in various ways if/when I connect to another host using weak security:
"CipherFox" displays the cipher suite (or configurable portions thereof) in use on the status bar (e.g., it shows me "AES-256 RSA-4096 SHA1" on DDG), as well as providing the "Enable RC4" check-item on the Tools menu.
"Calomel SSL Validation" displays (on my nav. bar) a color-coded shield that represents a percentage security rating based on weighted factors drawn from the cert and cipher suite, the breakdown of which is displayed via clicking the shield icon.
Re: (Score:1)
You're foolish.
RC4 is better than cleartext, which is what you may end up with your configuration.
The attack to exploit RC4 is also complicated, and unlikely to occur across the internet.
Re: (Score:2)
You're foolish.
I disagree, but I may be biased.
RC4 is better than cleartext [...]
I agree.
[...] which is what you may end up with your configuration.
No it isn't — please see my reply to brunes69.
To anyone who read only my initial post, please note that I use two additional plug-ins which thwart a plaintext connection with any host with which any encrypted connection is possible, including RC4: "HTTPS Everywhere" and "HTTPS Finder" — see my reply to brunes69 for links/further info.
My apologies to everyone for neglecting to include important info in my initial post, particularly to anyone who got the imp
Even good ciphers are mostly useless (Score:5, Insightful)
I wonder, in real world, how big percentage of the attacks are performed by man-in-the-middle (where strength of cypher matters). Between
1) 3 letter agencies just accessing content directly on Yahoo servers
2) Somebody hacking router between you and Yahoo (or evesdropping on physical line) and performing very costly cypher break
3) Having trojan/keylogger/whatever on your machine giving access to everything
How much point 2 is a problem compared to 1 and 3? People can write a lot about how usage of bad cipher will allow your mails to be cracked in 1 day instead of 5 billion years... but probably 99% of compromised emails are accessed through 1 or 3.
It is like with optimizing code. You could optimize hotspot where 99% of cpu time is spent, but it is hard. So instead you optimize all things around, making other 1% order of magnitudes faster and then forget than you cannot do anything about remaining 99%...
Re: (Score:2)
"Scammer intercepts and slightly alters the email"
It is not clear for me that it has happend on the wire, as opposed to compromising mail server or customer machine. Has the scammer really captured the email while it was transmitted over http/smtp connection, performed 'surgery' in realtime and sent it further with modified content?
From the comments section, somebody describes similar situation, but first step was to install keylogger on customer PC. Which means we are in point 3, not point 2 from my list.
Re: (Score:2)
"Scammer intercepts and slightly alters the email"
It is not clear for me that it has happend on the wire, as opposed to compromising mail server or customer machine. Has the scammer really captured the email while it was transmitted over http/smtp connection, performed 'surgery' in realtime and sent it further with modified content?
From the comments section, somebody describes similar situation, but first step was to install keylogger on customer PC. Which means we are in point 3, not point 2 from my list.
So we wait and do nothing. Keyloggers become common. We become aware and virusscanners start to detect them. Criminals look for alternative. Voila! It's just a matter of time before this method becomes cheap enough to implement. Why wait if we can fix this now?
Re: (Score:3)
I'd add a #4, or #2a, Man-In-The-Middle the certificate. Diginotar's compromise, never the huge bundle of trusted certificates in every browser/OS, makes it easy. Whatever an enterprise can do with GPOs and Websense can happen in the wild too. (I kinda prefer self-signed certificates anymore.)
Overall I agree, but I still cry out in pain when I see people choosing to use 3DES and disable PFS.
Re: (Score:2)
If it doesn't happen, then good. The encryption is doing what it's supposed to do.
(I've seen brochures for products that can MITM encrypted Bittorrent connections in order to log what's being transferred, so yes, people will take advantage of weak encryption if it's easy enough to do so.)
Re: (Score:2)
The reason #2 is not a common problem is because of the strong encryption -- it's a technical problem that is, for the most part, solved. If the encryption becomes easily breakable, #2 would swiftly become a problem again (think coffee-shop wifi operators, nosy employers/schools, etc.). #1 and #3 are social problems, and I agree that they need plenty of attention, however maintaining sufficient encryption to keep #2 closed is definitely not wasted effort.
Re: (Score:3)
What is keeping Yahoo up? (Score:4, Interesting)
Yahoo reminds me of a journeyman heavyweight boxer taking the champ into deep rounds despite taking a serious beating. He simply will not go down.
They impress for sheer resilience, if for nothing else.
Re: (Score:2)
What is keeping Yahoo up? /quote?
Viagra or Cialis?
Re:What is keeping Yahoo up? (Score:4, Interesting)
In order for me to thrive as a business I merely need to make enough money to pay expenses and employees. I don't have to defeat the heavyweight. I just have to dodge their blows.
The stock market's demand for growth is untenable. Overextended businesses die; The name for unchecked growth is cancer. I've discovered that business maturity exists. Focusing on improving my services and better ability to meet customer needs / better dialog beats overextension through growth hands down. On the public market I'd be slaughtered. I refuse to grow faster than necessary. This way I can stay more nimble and adjust to changes and new tech faster than my competition. Instead of growing, I concentrated on streamlining agility. Eg: You could invent 50 new platforms tomorrow. In one year, I'll have support for them all without requiring any growth to gain the specialization. I have an excellent platform abstraction layer.
I'm not partial to Yahoo, but their board has more sane business sense than most. Their retention isn't necessarily impressive, but to dodge blows while in dire need of a tourniquet is commendable. It's caused them to make some compromising business decisions, however.
A false sense of security (Score:2)
Unfortunately, Iceweasel/Firefox don't indicate what cipher is used by an https connection, so Yahoo gives you a false sense of security with the use of RC4. So do many other websites.
There should be some indicator of just how secure an HTTPS connection is (maybe shifting the colour of the padlock from red through orange, yellow, and green as the strength of the cipher improves.) One should also be able to select which ciphers are considered valid by their browser.
Re: (Score:2)
You can select which ciphers you accept. In Firefox the preference is something like "security.ssl3.rsa_rc4_128_md5" -- I'm sure if you search for RC4 in the about:config page you can find the relevant settings. You can explicitly allow or disallow whatever combination of ciphers you like.
And it's not a "false sense of security" when the indicator is binary. It's not as descriptive as telling you what cipher is in use, but it's still encrypted and would take a lot of effort to decrypt (weaknesses have been
Mr Ristic (Score:2)
Re: (Score:2)
cousin of Alter?
This is not "email encryption" (Score:5, Informative)
While the article is correct and uses precise terminology, the summary is wrong to use the term "email encryption". That term is for encrypted email messages using PGP/GPG/S-MIME.
Yahoo have no framework for email encryption. This article is about use of HTTPS for their webmail service and (a) whether that has been implemented and, if so, (b) whether it has been done correctly.
The answers to which are: (a) mostly and (b) no.
Re: (Score:2)
That term is for encrypted email messages using PGP/GPG/S-MIME.
Yahoo have no framework for email encryption.
Don't really need a framework if you have POP3 or IMAP access to it, then you can use a "real" e-mail client that DOES have GnuPG or S/MIME support. It should also cure the HTTPS issue.
Re: This is not "email encryption" (Score:2)
I know Yahoo don't have (nor need) a framework for email encryption. My comment was simply a clarification. :-)
Re: (Score:2)
Re: (Score:2)
Simillarly, it doesn't matter if the message you're sending is encrypted between you and Yahoo if Yahoo sends it in plain text to the recipient.
Yes I understand that what TFA is referring to is the SSL/TLS encryption between browser or mail client and the website/server
But what some of us here in this thread are talking about is "client side encryption between sender and recipient If say Bob encrypts an email with GnuPG or S/MIME to Alice it doesn't matter if the Alice's connection to their mail server isn't SSL, the message is still encrypted and gobbledygook to any interceptor.
For example here is a tiny bit of what an ascii armored encrypted mes
yes, right. (Score:1)
Re: (Score:1)
Re: (Score:2)
Why are you using a web browser to access gmail when you can use IMAP with a proper email client using proper TLS. Not only that you don't see ads that way and gain the ability to use GnuPG or S/MIME encryption if you want to.
Re: (Score:1)
Why don't people use "real" e-mail clients? (Score:3)
Why do people insist on using a web browser to read their mail instead of a proper e-mail client that implements proper TLS and every other feature that an e-mail client has that the web interface doesn't. It's not like people can't access their webmail over proper IMAP or POP3, which has advantages like seeing no advertising and the ability to use GnuPG or S/MIME encryption if one wants.
Re: (Score:2)
I remember reading somewhere (I even think it was slashdot) about someone suggesting an addition to the e-mail RFC's a standard for an "set up e-mail" file that one could import into one's email application.
But setting up IMAP or POP3 isn't that difficult, not much different from following a recipe matching field to field. In fact, people used to have to do it.
For example Gmail is simply:
Incoming Mail (IMAP) Server - Requires SSL
imap.gmail.com
Port: 9
Re: (Score:2)
That's a one-time problem though -- it's a barrier, but it's a small one given how frequently mail is used. And modern mail clients are happy to guess virtually all of the settings, at least if your mail server has a standard configuration and you can remember your own email address.
Re: (Score:2)
Yep but the Prius in my driveway solves 100% of my problems.
Yours too I bet.
The funny this is there is a Prius in my driveway, but I do use a real e-mail client.
I understand that most users don't need advanced features but.....
Problem: Users complain about the targeted ads in their webmail tab.
Solution: Using a real e-mail client over POP3/IMAP removes that.
Problem: Users want e-mail privacy
Solution: PGP/GPG or S/MIME with a real client.
Problem: Users worried that an HTML message my do something harmful.
Solution: Use a proper e-mail client that doesn't view the HTML by default.
Re: (Score:2)
Why do people insist on using a web browser to read their mail instead of a proper e-mail client
Because that involves setting up an email client. Most people can't be bothered to do that, and for some strange reason find it annoying when somebody does do it on their behalf.
Re: (Score:2)
Because that involves setting up an email client.
But you only have to do it once! Set it and forget it. And people even "normal" users used to have to do it.
Re: (Score:2)
But you only have to do it once! Set it and forget it. And people even "normal" users used to have to do it.
When it comes to effort 0 > 1.
Re: (Score:2)
Maybe because they don't have admin rights on a work pc, and still want to access their personal email.
Maybe I'm being grumpy but I don't think people should access personal e-mail accounts on their work computer.
and FWIW, yahoo disabled POP3 access on all of their non-paid accounts years ago.
Oh? From what I've read they enabled it back recently.
http://kb.mozillazine.org/Yahoo [mozillazine.org]
I gave up with Yahoo (Score:2)
I got sick to death of my 10+ year yahoo account being "compromised", just out of the blue. My passwords are always secure using multiple caps/numbers/symbols etc.
My gmail/hotmail accounts never gave me this hassle.
Everytime you want to "recover" your account, you have to siv through pages, and pages of crap. Once you confirm your account with another email on file, you then have to provide your current password (which has been compromised and changed) to get in.
This could all be avoided if Yahoo mail actua
Re: (Score:1)
Uh, yeah, what you said..........except that password recovery hasn't worked that way for a long, long time, if ever.
I tried it today, and, still asking me for a password to recover my account....................
Older Systems/XP will be problematic (Score:2)
With the abundance of older operating systems out there, I think browser code and general websites will still be hampered for quite sometime. For Yahoo and others that means the lowest common denominator needs to be supported for quite sometime. If you're rolling out your own website and can control those variables then certainly you can enforce TLS 1.2 with ciphers that are much stronger than RC4. If you can't control the client side in terms of minimum support that unfortunately means TLS 1.0 and RC4 i
E-mail vs ? (Score:1)
As others have said here, encryption from sender to receiver (including all hops in between) is what's really important, and would render encryption at the web/IMAP/POP level unnecessary. SMTP is used between all hops (unless, I assume, a message originates and ends at the same server), and survives from the early days of network computing when all of us who were on the net knew each other. It should not have survived to a public Internet, for reasons that became obvious pretty quickly.
Lack of security an
What about sending and receiving? (Score:2)
That would still be insecured. :P