Slashdot Mirror
Microsoft's Hotmail Challenge Backfires
Barence writes "Microsoft challenged the editor of PC Pro to return to Hotmail after six years of using Gmail, to prove that its webmail service had vastly improved — but the challenge backfired when he had his Hotmail account hacked. PC Pro's editor say he was quietly impressed with a number of new Hotmail features, including SkyDrive integration and mailbox clean-up features. He'd even imported his Gmail and contacts into Microsoft's service. But the two-week experiment came to an abrupt end when Hotmail sent a message containing a malicious link to all of his contacts. 'What's even more worrying is that it's not only my webmail that's been compromised, but my Xbox login (which holds my credit card details) and now my PC login too. Because Windows 8 practically forces you to login with your Windows Live/Hotmail details to access features such as the Metro Store, synchronization and SkyDrive,' he writes."
Other than that, would this be an experience you would recommend to others?
Hotmail sent a message containing a malicious link to all of his contacts
It seems to me that it was convincingly demonstrated that Hotmail has a few features that Gmail lacks.
Good job Microsoft!
Because Windows 8 practically forces you to login with your Windows Live/Hotmail details to access features
So the Marketing department got the green light over the Security department during the development of Windows 8. Naturally, it is the Security department's responsibility to ensure that when the Marketing department does something stupid like linking account credentials between two separate administrative domains, it's Security's responsibility to sprinkle magic fairy dust over it.
Okay, I'd like my $80,000 bonus now, and a letter of resignation from the chief designer of the Windows Live security team please. Also, let the marketing department know that we'll need to find someone to spin the bad press away, you know, the usual crap about it being a beta release and then suing him for violating the NDA that says he can only report positive experiences with the beta.
#fuckbeta #iamslashdot #dicemustdie
From the article (but curiously missing from the summary):
(Update: For those of you inquiring about the strength of my Hotmail password – it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun. It’s not the world’s strongest password, and I can feel the parental glare of Davey Winder from 200 miles away, but it wasn’t that weak, either.)
In other words he used a shitty password and got hit by a dictionary attack. Nothing new or interesting here. Move along.
Or did he just use a crappy password or have malware already on his computer? I know it's popular to bash MS, and I dislike the account convergence we are rapidly screaming towards, but blaming the service when it was more likely that he created the vulnerability is just tacky.
From the story: 'For those of you inquiring about the strength of my Hotmail password - it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun.'
It's only recently (Nov. 2010) that hotmail even had the option of using SSL:
http://windowsteamblog.com/windows_live/b/windowslive/archive/2010/11/09/hotmail-security-improves-with-full-session-https-encryption.aspx
And SSL still isn't the default option for hotmail.
Gmail at least had the option for SSL for many many years, and google made SSL the default a few years back (after they got hacked by the Chinese).
Hotmail login same as windows log on and windows store with CC? WOW windows 8 may flop so bad that they have to have a windows 9 next year or a windows 7.5
Why is this in idle? After that blatant dupe earlier...
You are grounded!
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
MS is continually bashed for security reasons, and mocked for being a virus spreading engine etc etc. Those who continually make such silly and baseless allegations, as evidenced by the story above, don't even once think about the alternatives and THEIR security problems.
After dumping Windows and MS products in general a few years ago, I have had a first hand hard lesson in the probelms of 'alternative' OSes, if you can call them that. My problems have been nearly unending since switching to Linux, I mean just last month, or was it the month before, my laptop crashed. This wasn't the first time either, it routinely happens 2-3 times a year.
Think about it people, if you don't use MS, you might not have horrific security problems that compromise all conected devices and identities, but you may have to suffer through a similar fate to me. Be careful what you ask for, and THINK before you whine in public.
-Charlie
...perhaps this will light a fire under Microsoft to get their system a bit more secure (in spite of weak passwords like the one the guy used), and not allow things like spamming all contacts without some second-source notification/response, or some other easy to implement blocks to this sort of behavior.
And the result for consumers will be a more robust system in general (Microsoft Account/WindowsLiveID, as well as HotMail, Win8, XBoxLive, etc).
Failures often spur innovation and improvement. They're not always a bad thing (though this one is particularly embarassing, it may be just that level of embarassment that drives the motiviation to work on solutions to the problem).
- Spryguy
There are three kinds of people in this world: those that can count and those that can't
http://xkcd.com/936/
Truth be told the passwords we actively encourage are no stronger than what he used.
If you want a really strong password, use a sentence of random words. Password length matters far more than password content - this is a simply provable fact - too bad hardly anybody in security realizes it.
Unicode killed the ASCII-art *
This is not the first time I hear about a hotmail account being hacked to send malicious links. I had a few friends with the same problem, always hotmail. It's possible there is a serious security problem with the service. And even if there isn't, logic should be in place to suspend account who start mass emailing their contact lists with suspicious links, it shouldn't be that hard to stop.
His password is 7 lower case characters. It's a wonder his GMail account wasn't hacked ages ago.
Hotmail's default isn't SSL as far i know, and their chat service isn't ssl or encrypted or even able to run encrypted ( unlike google's chat/XMPP). So it isn't exactly safe, not long ago someone was trying an dictionary attack of some sort for days on my MSN messenger account as it prevented me from logging in due to "too many password attempts" . ( when i had not been the one doing those attempts.)
Assuming the attacker knew somehow that the password was exactly 7 letters, and that they were all lower case letters, which shouldn't be the case, it still shouldn't have been possible. 7 letters, 26 possible letters in each location means just over 8 billion possible combinations. If we assume upper and lower case letters plus numbers are tried in the brute force attack, that gives a bit over 5 trillion possibilities. Exactly how many failed attempts are allowed on their web logon before any sort of protection system kicks in. So, yes, I do think it is a design and implementation flaw by Microsoft.
In that case you should also know that pidgin stores the passwords in plaintext in the settings file(at least last time I checked).
and their new layout sucks. Totally. No colors in labels, screen spacing all wasted, hard to look at.
Meanwhile hotmail HAS improved.
I still prefer gmail, but the difference has narrowed mostly because of gmail's steps backwards into "Apple iTunes ripoff "I'm stupid like your grandma" design concepts. They fucked up something great and made it merely OK.
Hotmail's still sucks in many ways, but their inbox os SO much easier to clean out now, that single improvement makes hotmail easier in many ways to use than gmail.
If gmail were to ditch the shitty "everything has to be big and rounded and words have to disappear and be replaced by vague non-descriptive icons" blech, AND institute cleaning like hotmail,. they'd be miles ahead.
Now... if either took the invention of usenet provider Easynews, and allowed a "ranges" feature, they would be golden. If you use easynews, you know what I mean.
If not, it works like this - take a page of 300 items each with individual selection boxes. Click one near then top, one lower, another lower still, and then one more. Click "select ranges"
You get the whole range between your 1st and 2nd selection selected, items afterward are unselected until your NEXT selection, and those between that and the end selection are selected.
Hard to explain, but it's fucking BRILLIANT. No other site I've seen uses that, and it's fucking GREAT.
This space available.
I can think lots of ways that his account could have been compromised that wouldn't be Hotmail's fault. I wish there was more details on how he got hacked exactly.
The main issue now is, how did it get hacked, as millions of users are using hotmail/live-platform daily without problems.. Maybe the reporter was a bit dumb and put his login-account details on a hazy-website for some reason (like an external importing app, or a maulicious App for his phone/tablet/whatever)..
It's not like an account can be hacked that easily (just as easy as a GMail account could be hacked)..
So the hacking of his account doesn't have anything to do with the service itself..
>>>XP was less stable than 2000.
Really? Wasn't XP simply the +0.1 version of Win2000? I would have thought XP would be more stable, like how WinSeven (6.1) is more stable/bugfree than Vista (6.0).
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"