Slashdot Mirror
MS Removes HTTPS From Hotmail For Troubled Nations
An anonymous reader writes "Microsoft has removed HTTPS from Hotmail for many US-embargoed or otherwise troubled countries. The current list of countries for which they no longer enable HTTPS is known to include Bahrain, Morocco, Algeria, Syria, Sudan, Iran, Lebanon, Jordan, Congo, Myanmar, Nigeria, Kazakhstan, Uzbekistan, Turkmenistan, Tajikistan, and Kyrgyzstan. Journalists and others whose lives may be in danger due oppressive net monitoring in those countries may wish to use HTTPS everywhere and are also encouraged to migrate to non-Microsoft email providers, like Yahoo and Google." Update: 03/26 17:08 GMT by T : Reader Steve Gula adds the caveat that "Yahoo! only does HTTPS for authentication unless you're a paying member."
I don't know what Microsoft are thinking here but seeing as it's using the country you set in your profile; not any sort of geoip lookup ... the remedy is simple: just change the country in your profile.
Giving up my mod points on the thread to ask... Why?
Seems like the only advantage this holds is Microsoft can later claim "You should have used someone elses service to discuss anti-dictatorship topics, as our services are not secure or private" ??
of the Iranian CA breach?
If they know that certain governments are decrypting SSL, then it's right to not let people think that their data is secure when it's actually not.
"I don't know, therefore Aliens" Wafflebox1
are microsoft trying hard to get themselves closed or what.what next
It was a bug, it has been fixed.
http://www.theregister.co.uk/2011/03/26/microsoft_https_hotmail_syria/
The Microsoft executives who made this decision have worked very hard for their entire adult lives to achieve the position they are in. Many years of hard work in college and climbing the ranks at Microsoft have put them where they are today. So, then, why have they leveraged those years of hard work in the name of oppression?
Shame, shame!
I'm genuinely curious what the logic is. "zOMG the Feds!!!" seems unlikely(because Microsoft doesn't exactly have to crack the SSL connection between you and itself to watch you and provide whatever information they wish...) It also seems somewhat unlikely that they received a "disable SSL or we block you" ultimatum, in silence, from a veritable laundry list of undesirable locations at the same time. Those countries also represent a reasonably broad spectrum of different flavors of repressive fucked-upness, and a fair variety of different levels of "they may be dictators with blood on their hands; but they serve our interests", everything from "They are our good buddies who let us headquarter the 5th fleet" to "we would really prefer if they died in a fire.."
That makes it sort of tricky to assign a foreign-policy based incentive behind Microsoft's activities. Economics, though, isn't obviously more helpful. That list represents one hell of a GDP spread, from "barely subsisting" to "oil plutocracy", so it doesn't seem to be a straightforward 'eh, you guys just aren't worth the SSL costs, fuck it." cutoff.
Any ideas?
Why is summary recommending Yahoo in this instance? Last time I checked (10 mins ago) I couldn't get Yahoo mail to use https on regular pages. It seems Hotmail can still use https in the affected countries - as long as you explicitly type it in the address bar. Or use HTTPS Everywhere. Or choose a different country in your profile. So Hotmail is still better than Yahoo?
Microsoft is blaming a mystery bug for preventing access to the encrypted version of Hotmail, denying that it deliberately blocked access to the service in Syria.
On Friday afternoon, the company told The Reg that Hotmail users who had already enabled the HTTPS version of the popular email service were still able to use it. Only Hotmailers trying to turn on HTTPS for the first time in certain countries and languages were being blocked, Microsoft said.
People trying to connect were greeted with the message: "Your Windows Live ID can't use HTTPS automatically because this feature is not available for your account type."
Microsoft said it still doesn't know what caused the bug, but it has been resolved and the company is investigating the cause. "We do not intentionally limit support by region or geography and this issue was not restricted to any specific region of the world. We apologize for any inconvenience to our customers that this may have caused," a Microsoft spokesperson said.
The company said users in the Bahamas, Cayman Islands, and Fiji were also affected.
Microsoft: Mystery bug blocks Syrian secure Hotmail
Sun worshipers and fat cats hit too [March 26]
Hmm... side with the devil or forfeit a big paycheck... decisions, decisions...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
it was a bug http://www.theregister.co.uk/2011/03/26/microsoft_https_hotmail_syria/
Everyone can unwad their panties now.
My panties? Not mine...I steal 'em from the neighbor's clothesline.
Wait...is this an https connection? Oh, chit...
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"
Probably so they can climb even higher.
Sadly.
Have you ever noticed that when somebody gets caught doing something really unethical, they always say, "I made a mistake" or "It was a bug"?
Any possible motivation escapes me.
A lot of people posting already assume that there's some financial consideration involved; but I can't see that realistically being the case. But the problem is - I can't come up with a logical explanation for this that fits any reasonable supposition.
It would help if Microsoft would say why - we'd have to analyze it and parse the double-speak, obviously, but we'd at least have some meager clue. As it is, it's simply just bizarre.
#DeleteChrome
Why would it only affect those countries? Testing showed that it only affected people with their location set to certain countries and that merely changing the country would allow it to work again.
There may be an innocent explanation for that, but it's DAMN strange and really makes it appear that there's spying going on, somewhere.
Cryptography is banned in China and territories under their control without a permit by the "communist" party regime. They will have keys for the crypto they allow their subjects to use.
Big and compliant foreign firms may apply for an exception but obviously that doesn't mean their operations haven't been breached from within.
Should invading one's peaceful neighbours be opposed, or rewarded with trade deals?
Microsoft execs are just making sure that a large supply of "donated" organs are available whenever they need them.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
are you blindly believing it was a bug because they told you so?
The company said users in the Bahamas, Cayman Islands, and Fiji were also affected.
Next week's headline:
"In unrelated news, local unrest reported in the tropics..."
Yeah, it wasn't a bug. They were out to get people, for.. however short a period of time it was broken. You totally busted those corporatist assholes!
Do you ever get tired of yourself, I mean really?
And your post is another cynical data point in the bandwagon jumping paranoid delusional mindset of the "omg the bad corporations are out to get me!" crowd. This was identified as a bug and has been resolved. Where does all your blathering about morality end up, then? Yes - on the garbage heap.
Yeah, and whenever some stupid asshole jumps to conclusions and blathers a bunch of paranoid delusional bullshit, have you ever noticed they refuse to accept any explanation other than the evil they initially attributed the incident to? Kind of the mindset of Troofers, Birfers, and anti-Evolutionists really. No matter what evidence you put forward, they will never accept anything other than the delusion that gives them their mental high.
They may not want people to risk their lives using their service.
If the certs are already compromised. MITM proxies, prior break-ins etc.
15TW = 15,000 Nuclear Reactors. (Approx. one accident a month.)
Well it certainly doesn't appear to be a good thing, but let's at least clean up the usual more-incendiary-than-it-needs-to-be summary (TUMITINTBFS). A few months ago, MS added a setting to it's Live accounts, where you could set it to use HTTPS automatically.What appears to have happened is that this has been provided for some countries, e.g. the USA, but not for some Middle Eastern and Eastern European countries (including Iran). So this isn't some long-standing feautre that has suddenly been removed. Also, it seems that HTTPS is still available, but can't be set to be automatically enabled. So the feature is not prevented, merely not as convenient.
So not a good thing on MS's part, apparently, but at least lets have some decent information.
Aide-toi, le Ciel t'aidera - Jeanne D'Arc.
One possibility, and quite a good one, is that it helps the USA to spy. After all, a US spy can't just use the local authorities tools, but they can sniff the wireless traffic of the people in an apartment block.
Aide-toi, le Ciel t'aidera - Jeanne D'Arc.
Maybe they are just gaming Google and gmail.
You are being MICROattacked, from various angles, in a SOFT manner.
Apparently it was a bug:
http://www.theregister.co.uk/2011/03/26/microsoft_https_hotmail_syria/
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
They were out to get people, for.. however short a period of time it was broken
It got into the news and was embarassing for them from a PR standpoint, so they did a U-turn. Wouldn't be the first time. (See also, for example, Microsoft's significant assistance to the Russian government in shutting down the opposition there via police raids on opposition organisations for using "pirated" MS software. Complete with falsified statements from Microsoft's representatives that they were using pirate software even when they weren't. They were willing to let that continue right up until it got into the NYT and their reputation took a battering.)
Actually, Morocco didn't ask M$ to suppress access to HTTPS. And in fact, Gmail over HTTPS works perfectly fine there. It looks like Microsoft are just guessing who might want to snoop, and offering that as a feature, without even being asked. Oh, anyone remember the Microsoft Surveillance Guide?
cpghost at Cordula's Web.
Actually, my dog is on the right side of every issue, except sometimes "feed me that" and "walk me now".
--
make install -not war
Most hotmail users do not know what HTTPS is. This move effetively disables cryptography for 90% of the users.
well, 90% of people on Slashdot don't know what HTTPS is - 90% of the other 10% are probably displaying a rather cock-sure, blissful ignorance. Think about it: a message going from country A to country B, two wifi connections that may or may not be encrypted, two governments that may or may not be intruding, two providers that may be cooperating with the former to varying degrees. If you don't know what https, say away from it. Don't tell anybody they're getting 'cryptography' if you're not able to give them a grounding in all the above. Or else you 'cryptography' will only be good for hiding your stuff from your mum.
Heh. Bless her! Well to be fair, she owned up to not knowing something and congratulated someone else on being right. That's a lot more than most people on Slashdot are willing to do. ;)
Aide-toi, le Ciel t'aidera - Jeanne D'Arc.
In what way is Yahoo a non-Microsoft email provider? Non-Hotmail maybe but I am pretty sure they are Microsoft.
This is typical Microsoft behavior, that we have seen time and time again. Google at least had some limits to their cooperation with Chinese government, but Microsoft cooperates preemptively with authoritarian regimes, without even having to be proded, it would seem.
I guess it shows Bill is not running things anymore.....I am not so sure he would have buckled under the pressure of what is going on over there politically to change HIS windows or hotmail to be easier for the feds to access.
M$ always bending over to get the $, why let some country dictate how you should develop your app, I find that useless.