11 ms·
Microsoft Shuts off HTTPS in Hotmail for Over a Dozen Countries
- tshtf 16y agoI'm surprised the EFF didn't ask Microsoft for a response on this.... If any news release by the EFF deserves a third-party response, this is it.
- ajays 16y agoLooking at the list, I bet they included Congo, Nigeria, etc. to hide the fact that most of the countries in that list are currently in some state of turmoil. It would have looked really ugly if they had done it just for those countries; so they threw in the Congolese and Nigerians too. MSFT has 90,000 employees; surely some of them can speak up about this, and how it jeopardizes the people in those countries who are struggling for freedom?
- zcrar70 16y agowhy would the fact that the countries are in turmoil cause MS to remove HTTPS for hotmail? Do you think that MS has links to the governments of those countries (and is somehow trying to make it easier for the local governments to crack down on dissidents by tapping their email communications)?
- chime 16y ago> Do you think that MS has links to the governments of those countries If MS sells them Windows and Server products, then it is not out of question.
- Vivtek 16y agoI can't tell if you're speaking ironically or not, but just in case you aren't, the answer is clearly "yes". What non-political reason could Microsoft have to select just those specific countries?
- ajays 16y agoI hope you don't take offense, but: I think you're being extremely naive. Here's how the logic works: MSFT does business in these countries. These countries have a sudden desire to monitor some citizens' communications (which include Hotmail accounts). HTTPS prevents this monitoring, so these countries lean on MSFT. Ergo, MSFT shuts down HTTPS access to Hotmail. For a lot of these regimes, it's a matter of survival to crush dissent. MSFT just made that a little bit easier.
- adolph 16y agoI hope you don't take offense, but: I think your argument sounds like a conspiracy fantasy. Let's say there are two options to consider: 1. There is a localization bug that affects the always-https setting. 2. Microsoft wants to do business with those countries and purposefully created a defect in always-https. The first case is very plausible (to me at least). Defects happen, some are more visible than others. The second case is less plausible to me. The current pattern of governments is to request by local-law the ability to monitor/control communications without the citizen knowing. An example similar to this hypothetical that is often in the news is countries that request a Blackberry messaging server in-country. Q: Why would Microsoft collude with these regimes to crush dissent in such an obviously noticed and easily defeated way? A: Because their evil regime assistance unit is incompetent. Q: Why would you choose that over the more simple first case of a localization bug?
- burgerbrain 16y agoSufficiently advanced incompetance is indistingiushable from malice.
- rbanffy 16y ago> Do you think that MS has links to the governments Governments buy truckloads of licenses and get to determine how much tax you pay. I'd say it would be completely unlike Microsoft not to have them. Their sales force is not the kind of people who would leave money on the table. I've seen how government sales are made. There is a lot in common with sausages.
- trotsky 16y agoWhy would only the intelligence services of those respective countries be interested in monitoring their communications in times of unrest? Perhaps with so much to keep up with lately the NSA monitoring equipment is struggling to MITM that many TLS sessions, so MS cut them a break. (mostly kidding...)
- Dilpil 16y agoId be very surprised if more than 100 of those employees were involved in this decision.
- wheels 16y agoThat's almost a list of the countries that US has present embargoes with – close enough anyway to make me think it's not a coincidence. Perhaps they're using strong cryptography and those are the nations which are not approved to export crypto to (and hence, perhaps not supported in local versions of IE)? http://en.wikipedia.org/wiki/United_States_embargoes http://en.wikipedia.org/wiki/United_States_embargoes http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_United_States#Current_status http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...
- tshtf 16y agoLibya is a glaring omission, and there's a war there. There are also countries being blocked that are not on the crypto embargo list. Regardless, a response from Microsoft would be appropriate here.
- rbanffy 16y ago> Libya is a glaring omission, and there's a war there. Maybe not all governments are Microsoft-friendly...
- daeken 16y agoDo you really think this crypto blacklist is a result of internal politics rather than external? If so, why?
- rbanffy 16y agoIsn't the timing a little bit suspicious for many countries on the list? Is Microsoft being pressed by the US government about allowing citizens of those countries to use HTTPS (is allowing HTTPS exporting crypto?)? Are they being pressured not to drop HTTPS for Libyans?
- Natsu 16y agoEl Reg talked to Microsoft and claims it's a bug. Still, why would changing one's country make HTTPS available again? Why those countries? All in all, it really makes them look bad, even if there's an innocent explanation. http://www.theregister.co.uk/2011/03/26/microsoft_https_hotmail_syria/ http://www.theregister.co.uk/2011/03/26/microsoft_https_hotm...
- tomp 16y ago> The good news is that the fix is very easy. Is it just me, or is there a strong correlation between decisions that seem bureaucratic and politically motivated, and are completely ineffective at achieving their purpose (at least for the technical users)? (I have the recent India vs. .xxx news in mind as well.)
- sushilchoudhari 16y agoThis issue has been resolved now as per internal sources :-). The functionality has been returned to previous state, regret any inconvinience
- troels 16y agoUnfortunately, a lot of users aren't very technical. That's why relatively inefficient blockages (Such as removing a site from the DNS record) are often used. They work for the majority and that is good enough.
- sushilchoudhari 16y agoThis issue has been resolved now as per internal sources :-). The functionality has been returned to previous state.
- djcapelis 16y agoThis doesn't really make me feel a lot better. I'm glad they backtracked, but doing so quietly once they got caught does not inspire much faith in their passion to make technology that makes the world a better place.
- rbanffy 16y agoPerhaps the "troublemakers" were successfully identified. No need to continue with this extremely unpopular (among users) thing. Even if not all of them could be identified, the ones who were will certainly cooperate with authorities.
- mhansen 16y agoAny explanation of why this happened?
- Elepsis 16y agoAs most people not on a conspiracy kick guessed: a bug.
- bugsy 16y agoThat's extremely interesting, particularly the specific list of countries. I bet it was not Microsoft who originated the decision to do this.
- jackowayed 16y agoI don't think I buy the conspiracy theories being presented on this thread. What, Microsoft was bullied by the government of Myanmar? Even if these countries said to Microsoft "turn off HTTPS or we're blocking Hotmail", I think they would have opted for the latter. And Google is still serving GMail over SSL to these countries, right? My guess: These are all countries that I would guess have pretty high latency from Microsoft's servers. The SSL handshake requires several roundtrips, as I understand it, which means that high latency would hurt performance significantly.
- rbanffy 16y ago> Even if these countries said to Microsoft "turn off HTTPS or we're blocking Hotmail" What if they said "drop HTTPS and, as soon as this turmoil ends, we will modernize our government IT"?
- deleted 16y ago[deleted]
- marshray 16y ago> which means that high latency would hurt performance significantly Then the users could choose not to use it if they found it annoying. I can't come up with any explanation for this other than a ridiculous level of incompetence or malice.
- vidyesh 16y agoThis is really stupid, Hotmail isn't secure anymore. And how come Microsoft hasn't responded yet ???!!!
- logic_magic 16y agowhy would they do this? Something feel so odd about this.
- riffic 16y agopure evil. see http://en.wikipedia.org/wiki/Banality_of_evil http://en.wikipedia.org/wiki/Banality_of_evil
- ck2 16y agoCountdown to google following after threats from governments. It's just like the blackberry decryption keys being turned over.
- kragen 16y agoWhat happened with the BlackBerry decryption keys? Do you have a link?
- getsat 16y agohttp://www.bbc.co.uk/news/technology-10951607 http://www.bbc.co.uk/news/technology-10951607
- kragen 16y agoAt the time described in that story, RIM was reportedly not handing over the encryption keys to anybody. What happened?
- getsat 16y agoHmm, looks like it's still ongoing: http://www.digitaltrends.com/mobile/india-gives-rim-march-31-email-access-deadline/ http://www.digitaltrends.com/mobile/india-gives-rim-march-31...
- carbonx 16y agoMisleading headline. HTTPS was only shut off if you a) set your location manually, and b) tried to enable a (relatively new) feature to force your account to always connect with HTTPS. It sounds like someone really just stumbled across a bug...and, oh by the way, it's been fixed.
- emilsedgh 16y agoA few days after the iranian goverment and comodo incidence, hotmail removes its https option for iranians. I dont know what the reason is. But its just unacceptable. Hotmail knows Iranian goverment is after sniffing users data. Iranian cracker tried issuing a certificate for Hotmail. Now they remove https option?