Slashdot Mirror
US Congress Bans Members From Using Yahoo Mail (bbc.co.uk)
A week after we learned that the House of Represantives had banned its members from using Google's appshot.com, more details about the blockage have surfaced. Reader Big Hairy Ian writes: A series of ransomware attacks on the House of Representatives has led U.S. Congress to ban members from using Yahoo Mail, according to a leaked email. Both Yahoo Mail and Gmail are named in the 30 April email, published on Thursday by Gizmodo, saying the attacks had increased "in the past 48 hours". Yahoo Mail will be blocked "until further notice" it adds. Ransomware encrypts victims' files and demands a ransom be paid for unlocking. In this particular instance, I think it isn't all of Yahoo Mail's fault. People need to be wary of the links they click on.
This desperate attempt proves they have nothing on Hillary.
If you know how to use them. Like a lot of problems in the US, education could probably help solve them, at least a little.
In this particular instance, I think it isn't all of Yahoo Mail's fault. People need to be wary of the links they click on.
That's not how Congress rolls. They refuse to take personal responsibility for everything and they have the authority to make someone else pay for their incompetence and/or corruption.
To be frank however, I cannot see any sane reason why our elected officials are not using official government email accounts supported by official government IT workers. It's not like congress doesn't know where to find the money to do it. Why on Earth they would be using Yahoo accounts while on the job is a mystery without a responsible answer.
This reeks of an incompetent public school sysadmin who bullshitted his way in to a public service position now making draconian/hamfisted policy changes because he lacks the education to take a less brute force approach.
I'd still blame Yahoo for allowing this sort of thing. I've been warning people for MONTHS now to 100% stop using their search engine because random search results will redirect to a bogus Microsoft support virus infection message. It's a little difficult to train users to hover over the link and ignore the first 75 characters to see where it is actually pointing to- assuming they have the link details at the bottom.
Why is it that people who are provided accounts by their employer/organization insist on using "free" services ? I can't imagine NOT using my work provided address for work stuff, and whatever personal address I use on whatever provider for personal stuff...
Don't blame me, I voted for Kodos
"Your email service has been banned. A generous contribution to the Congressional Don't Forget The Children fund can reverse this ban."
- Sincerely, Congress
...is why non-government webmail is allowed on government computers? Should be blocked entirely. If it's a government computer, then it's for government business, and emails for government business should be sent on government accounts that are saved should they be needed for FOIA act requests down the line. If people want to use personal email, they should do it on personal devices.
As a user of both Yahoo mail and Live, it's notable that my junk folder in Yahoo is stuffed with phising emails - easily identified by the difference between the visible sender and the originating email address. By contrast my live junk folder has virtually none.
So why doesn't Yahoo make the effort to kill off the dangerous junk?
I get more bogus phishing emails from hijacked Yahoo accounts than from anywhere else - they are always from someone who had me in their Yahoo contacts at some point, and now they are sending me a file that I need to check out. I recognize them for what they are, but I can see someone who's not as careful getting a file from a user that they think they know and trust, and opening the file.
I don't know why Yahoo mail is so easy to compromise, but I definitely don't get so many hijacked Gmail accounts sending me stuff. It's always Yahoo.
Cubicle Politics 101: "Don't complain without supplying alternatives". The public-sector alternatives are not so great either.
Table-ized A.I.
...and Commander Taco evidently banned the use of spellcheck on Slashdot.
My previous internet provider (AT&Something) uses Yahoo for their email provider. You could check email using either their domain or Yahoos domain using your username/password. I changed my password via one domain, but using the other resulted in both the old and new password working. I couldn't get the old password deleted no matter what I tried. Inquires went unanswered.
All internet advertising is immoral and should be made illegal. The inventor of the pop-up window needs to be shot, hung and quartered. Any less actions will be regarded as criminal collusion.
Just block the bad sites.
Simple and fast. I have added it to my firewall DNS, so all equipment is protected without local changes.
Yes, because it's SO HARD to just hop to a new domain.
After setting up a tablet for my father this weekend I discovered that Verizon is apparently using Yahoo for all of it's email now, so if they are a Verizon customer that's gonna be a bit of a pain.
Why modern browsers even allows users to download and execute binaries any more confounds me. The app repository idea is something long overdue for all desktop OSs as well, where all of the SHA verification can be done and so forth. It would be a good idea to apply some access rules to ban users from executing any executable in their user writable directories like their home directory. It also makes little sense that we insist installers run as super user when all they need to do is install a few files, yet they have to have access to the entire system. I would suggest running such installers at least in a filesystem overlay of some kind or a more of a complete sandbox or jail. Older Windows versions did not encourage users to use a non priveleged account for browsing. Still, even the prompt to request an administrator password is too much of a risk for them to install something. All installers should be default be run in a "fake root" environment such as the filesystem overlay.
Rather than Yahoo Mail being a particular attack vector for ransomware, is it not more likely that users who use a relatively old and unsophisticated email service are also more likely to indiscriminately click through on a dodgy email?
is the FBI going to investigate the house of representatives for its use of corporate email when they had access to government email but chose to use their own preferred email due to convenience?
quick...provide the house's IT director/staff with immunity to get to the bottom of this!
Both are free services. One kills the dangerous spam, one doesn't.
If it's any consolation, at least the man behind pop-up ads apologized.
http://www.independent.co.uk/life-style/gadgets-and-tech/news/man-who-invented-pop-ups-ads-im-sorry-9670809.html
Funny how this came on the heels of a wide spread outage at yahoo mail last night.
Stay sentient. Don't drink bad milk.
What about the one that invented the pop under?
Minimum threshold fixed. Thanks!
IIRC, It was Netscape that started all this back in the 90s. I was on a mailing list, and suddenly HTML markup started appearing on the list. HTML added nothing to mail then, and I would submit that it adds nothing of value to mail now. No good ever comes from clicking on links or viewing images inline with mail. NONE. Mail is text. Attachments are data. You could cut down on a lot of shenanigans by going back to that. If they download an attachment, it's totally the user's fault.
Yahoo Mail is simply a vehicle that doesn't appear to me to be any more or less secure than most other delivery vehicles. Yesterday we dealt with some ransomware that came in the form of an email from an employee's spouse that had a link to a landscaping company, and that landscaping company's website had a link (probably an ad) to a malicious site that delivered the ransomware. The employee's spouse contacted their IT, who reported not seeing any ransomware, which is why I'm thinking it was an ad on the landscaping company's website rather than the website itself that had the malware.
Telling Congress "don't use Yahoo Mail, it isn't safe, use official email instead" is giving them the wrong idea that they're safe to click on anything they get in the official email, and doesn't do anything to mitigate the danger of malicious websites. Their official mail might or might not be any better about scanning attachments for viruses. Their official mail would hopefully be better about prevent account hacks, though - it seems that's a fairly common thing for Yahoo Mail.
Huh, maybe they should run their own mail servers...
Do Congresscritters not have standard-issue .gov email addresses, with in-house servers (exchange, apache, lotus, whatever)??
Or is congress saying that members can't use Yahoo at home for receiving recipes from their mom, participating in fantasy football, and/or signing up for Cat Facts.
This signature is false.
"appshot" looks an awful lot like "asshat".
If they fall for some garbage email its their fault, not the provider. If they are so incompetent they fall for some scam it isn't yahoo or googles fault. I guess they will tell people to quit using AT&T or Verizon if they fall for some tech support phone scam.
No, bsmt is not bull shit mail transfer protocol. It is basement mail server protocol, as in you keep your own server in your basement. Is that allowed?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Users all of them. I'm not normally rude but I feel like sometimes I should sit over my users' shoulders and watch them while they work on the computer. This goes for Congress, the NSA already has a live-stream of US congressional PCs why can't they just reach out and stop Congressman Ryan before he clicks on that box with the dancing hooker.
The GP is suggesting that no government or corporate computer or account should ever be used for personal business.
The problem isn't Yahoo. Or any other mail service either.
The problem is using the wrong software.
Use Windows? Expect the worst.
Eventually you might learn not to use Windows.
This is hardly a surprising action. Instead of addressing the behavior of people, the solution will be to attack a problem with technology. Its 'easier' then trying to fix people.
They should be explicitly banned from using anything other than the official email for official duties and only while using supplied equipment. Personal and business communications should be partitioned off from one another. This is how it *should* be but that's not how reality works.
Keep the Classic Slashdot.
I am referring to "jratcliffe's" attitude expressed in the above posting.
According to him a government computer should only be used for government business and nothing else. He would probably to you taking that few minutes to go out to the car to check your personal phone.