Yahoo catches up with Microsoft, Google on webmail security

Yahoo has started providing webmail users the option of using a secure connection, matching a similar feature Google and Microsoft have offered for several years.

Yahoo's delay in providing a Secure Sockets Layer (SSL) connection for email sessions has been criticized by privacy groups that argue the cryptographic protocol help prevent hackers from reading messages sent over a Wi-Fi network.

However, the Electronic Frontier Foundation, which sent a letter in November urging Yahoo to implement SSL, praised Yahoo for catching up with rivals. "We're really happy that Yahoo is starting 2013 right by letting Yahoo Mail users use HTTPS to access their email accounts security," the digital rights group said in a statement.

HTTPS is the communications protocol layered on top of SSL to add the security capabilities to standard HTTP communications.

In providing SSL, Yahoo has left AOL as the only major email provider without the option. Chester Wisniewski, a senior security adviser for Sophos, said all Web services requiring a log in should provide an HTTPS connection by default.

"It is unacceptable in 2013 for anyone to offer something that you log in to without offering SSL/TLS," Wisniewski said in an email. But he said Yahoo still hasn't done it properly. "It should not be an option; it should be required."

[See related: Email in security hot seat with rise of cloud, BYOD]

Yahoo Web mail users can activate SSL in only a couple of clicks. Within the service, they only need to go to options and select "Make your Yahoo Mail more secure with SSL."

Google rolled out SSL for Gmail in 2010, after it accused China-based hackers of launching highly sophisticated attacks to eavesdrop on human rights activists.

Indeed, in its letter to Yahoo Chief Executive Marissa Mayer, the EFF said HTTPS communications was needed to protect dissidents. "As individuals who engage with at-risk communities targeted for surveillance and censorship, we see on a daily basis how this negligence (not providing secure connections) endangers human rights activists who fight in some of the most repressive environments to protect the basic freedoms that we take for granted," the letter said.

Read more about application security in CSOonline's Application Security section.

Tags applicationsData Protection | Application SecuritysecurityMicrosoftAccess control and authenticationHTTPSsoftwaredata protectionwebmailYahooGoogle

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Cloud Security and Compliance Solutions

Manage and visualize the security and compliance of VMware, physical, and hybrid-cloud infrastructure from the RSA Archer eGRC Platform.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.