Microsoft Shuts off HTTPS in Hotmail for Over a Dozen Countries

https://www.eff.org/deeplinks/2011/03/microsoft-shuts-https-hotmail-over-dozen-countries

by there • 15 years ago

179 43 15 years ago

tshtf2• 15 years ago

I'm surprised the EFF didn't ask Microsoft for a response on this.... If any news release by the EFF deserves a third-party response, this is it.

ajays2• 15 years ago

Looking at the list, I bet they included Congo, Nigeria, etc. to hide the fact that most of the countries in that list are currently in some state of turmoil. It would have looked really ugly if they had done it just for those countries; so they threw in the Congolese and Nigerians too.

MSFT has 90,000 employees; surely some of them can speak up about this, and how it jeopardizes the people in those countries who are struggling for freedom?

zcrar70• 15 years ago

why would the fact that the countries are in turmoil cause MS to remove HTTPS for hotmail? Do you think that MS has links to the governments of those countries (and is somehow trying to make it easier for the local governments to crack down on dissidents by tapping their email communications)?

chime• 15 years ago

> Do you think that MS has links to the governments of those countries

If MS sells them Windows and Server products, then it is not out of question.

Vivtek• 15 years ago

I can't tell if you're speaking ironically or not, but just in case you aren't, the answer is clearly "yes". What non-political reason could Microsoft have to select just those specific countries?

ajays2• 15 years ago

I hope you don't take offense, but: I think you're being extremely naive.

Here's how the logic works: MSFT does business in these countries. These countries have a sudden desire to monitor some citizens' communications (which include Hotmail accounts). HTTPS prevents this monitoring, so these countries lean on MSFT. Ergo, MSFT shuts down HTTPS access to Hotmail.

For a lot of these regimes, it's a matter of survival to crush dissent. MSFT just made that a little bit easier.

rbanffy5• 15 years ago

> Do you think that MS has links to the governments

Governments buy truckloads of licenses and get to determine how much tax you pay. I'd say it would be completely unlike Microsoft not to have them. Their sales force is not the kind of people who would leave money on the table.

I've seen how government sales are made. There is a lot in common with sausages.

trotsky• 15 years ago

Why would only the intelligence services of those respective countries be interested in monitoring their communications in times of unrest?

Perhaps with so much to keep up with lately the NSA monitoring equipment is struggling to MITM that many TLS sessions, so MS cut them a break.

(mostly kidding...)

Dilpil• 15 years ago

Id be very surprised if more than 100 of those employees were involved in this decision.

wheels• 15 years ago

That's almost a list of the countries that US has present embargoes with – close enough anyway to make me think it's not a coincidence.

Perhaps they're using strong cryptography and those are the nations which are not approved to export crypto to (and hence, perhaps not supported in local versions of IE)?

http://en.wikipedia.org/wiki/United_States_embargoes

http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...

tshtf2• 15 years ago

Libya is a glaring omission, and there's a war there. There are also countries being blocked that are not on the crypto embargo list. Regardless, a response from Microsoft would be appropriate here.

rbanffy5• 15 years ago

> Libya is a glaring omission, and there's a war there.

Maybe not all governments are Microsoft-friendly...

Natsu2• 15 years ago

El Reg talked to Microsoft and claims it's a bug. Still, why would changing one's country make HTTPS available again? Why those countries?

All in all, it really makes them look bad, even if there's an innocent explanation.

http://www.theregister.co.uk/2011/03/26/microsoft_https_hotm...

WalterGR• 15 years ago

Still, why would changing one's country make HTTPS available again?

Despite EFF's headline, it doesn't sound like this made HTTPS unavailable, but rather the "always-use-HTTPS" setting.

Why those countries?

Here's a guess: it was a localization issue.

I bet changing your country changes your default language. And I also bet that the availability of localized strings (i.e. "Is string 8230 available in language X?") affects what options are shown to the user. After all, if a descriptive string isn't available in the user's current language, how do you show them the option?

So what exactly happened? I don't know. Maybe they whacked some part of a localization table. Or rolled back to a previous localization table. Or mangled mappings from "language" to "current localization table". Software is complex.

All in all, it really makes them look bad, even if there's an innocent explanation.

The timing certainly invites theories of maliciousness.

JonnieCache• 15 years ago

Still, why would changing one's country make HTTPS available again?

Could also be to do with geographical regions being on different infrastructure, perhaps with slightly different versions of the code deployed to them. Maybe some broken logic in a proxy or something. All it could take is a couple of bits flipped.

There are many, many possible reasons for glitches like this in a system this large.

tomp• 15 years ago

> The good news is that the fix is very easy.

Is it just me, or is there a strong correlation between decisions that seem bureaucratic and politically motivated, and are completely ineffective at achieving their purpose (at least for the technical users)?

(I have the recent India vs. .xxx news in mind as well.)

sushilchoudhari2• 15 years ago

This issue has been resolved now as per internal sources :-). The functionality has been returned to previous state, regret any inconvinience

troels• 15 years ago

Unfortunately, a lot of users aren't very technical. That's why relatively inefficient blockages (Such as removing a site from the DNS record) are often used. They work for the majority and that is good enough.

sushilchoudhari2• 15 years ago

This issue has been resolved now as per internal sources :-). The functionality has been returned to previous state.

djcapelis• 15 years ago

This doesn't really make me feel a lot better. I'm glad they backtracked, but doing so quietly once they got caught does not inspire much faith in their passion to make technology that makes the world a better place.

rbanffy5• 15 years ago

Perhaps the "troublemakers" were successfully identified. No need to continue with this extremely unpopular (among users) thing.

Even if not all of them could be identified, the ones who were will certainly cooperate with authorities.

mhansen• 15 years ago

Any explanation of why this happened?

Elepsis• 15 years ago

As most people not on a conspiracy kick guessed: a bug.

bugsy• 15 years ago

That's extremely interesting, particularly the specific list of countries.

I bet it was not Microsoft who originated the decision to do this.

jackowayed• 15 years ago

I don't think I buy the conspiracy theories being presented on this thread. What, Microsoft was bullied by the government of Myanmar? Even if these countries said to Microsoft "turn off HTTPS or we're blocking Hotmail", I think they would have opted for the latter. And Google is still serving GMail over SSL to these countries, right?

My guess: These are all countries that I would guess have pretty high latency from Microsoft's servers. The SSL handshake requires several roundtrips, as I understand it, which means that high latency would hurt performance significantly.

rbanffy5• 15 years ago

> Even if these countries said to Microsoft "turn off HTTPS or we're blocking Hotmail"

What if they said "drop HTTPS and, as soon as this turmoil ends, we will modernize our government IT"?

marshray• 15 years ago

> which means that high latency would hurt performance significantly

Then the users could choose not to use it if they found it annoying.

I can't come up with any explanation for this other than a ridiculous level of incompetence or malice.

vidyesh• 15 years ago

This is really stupid, Hotmail isn't secure anymore. And how come Microsoft hasn't responded yet ???!!!

logic_magic• 15 years ago

why would they do this? Something feel so odd about this.

riffic• 15 years ago

pure evil. see http://en.wikipedia.org/wiki/Banality_of_evil

ck2• 15 years ago

Countdown to google following after threats from governments.

It's just like the blackberry decryption keys being turned over.

kragen2• 15 years ago

What happened with the BlackBerry decryption keys? Do you have a link?

getsat2• 15 years ago

http://www.bbc.co.uk/news/technology-10951607

carbonx• 15 years ago

Misleading headline. HTTPS was only shut off if you a) set your location manually, and b) tried to enable a (relatively new) feature to force your account to always connect with HTTPS. It sounds like someone really just stumbled across a bug...and, oh by the way, it's been fixed.

emilsedgh• 15 years ago

A few days after the iranian goverment and comodo incidence, hotmail removes its https option for iranians.

I dont know what the reason is. But its just unacceptable. Hotmail knows Iranian goverment is after sniffing users data. Iranian cracker tried issuing a certificate for Hotmail. Now they remove https option?

Microsoft Shuts off HTTPS in Hotmail for Over a Dozen Countries

Related Stories