Privacy advocates welcome Yahoo Mail HTTPS roll-out
Yahoo starts providing users with the option to encrypt their webmail sessions
IDG News Service - Digital rights and privacy advocates have welcomed Yahoo's decision to provide its users with an option to enable HTTPS (HTTP Secure) for their entire webmail sessions.
"We're really happy that Yahoo! is starting 2013 right by letting Yahoo! Mail users use HTTPS to access their e-mail accounts securely," the Electronic Frontier Foundation (EFF) said Monday in a blog post.
In November, the EFF, together with other privacy, security and human rights advocates and organizations, sent a letter to Yahoo CEO Marissa Mayer asking that the company implement full-session HTTPS for its communication services, including email and instant messaging.
HTTPS, a combination of the HTTP and SSL/TLS protocols, encrypts the traffic between Web clients and servers and prevents potential attackers from intercepting and inspecting potentially sensitive communications.
The lack of full-session HTTPS can be exploited by attackers to hijack accounts and intercept traffic on open wireless networks and also enables some governments that control the Internet infrastructure in their countries to spy on the private communications of political activists, members of the press and other individuals.
"Over the last several years, Yahoo! has repeatedly been urged by security experts to adopt HTTPS, but has taken no visible steps to do so," the privacy advocates wrote in their November letter to Marissa Mayer. "Unfortunately, this delay puts your users at risk, which is particularly disturbing since Yahoo! Mail is widely used in many of the world's most politically repressive states. There have been frequent reports of political activists and government critics being shown copies of their email messages as evidence during interrogation sessions, underscoring the importance of providing basic measures to protect the privacy of e-mail."
"Some of us have already been compelled to recommend that users avoid Yahoo! Mail because of its continued lack of essential security protections," they wrote at the time.
On Dec. 11, Yahoo started rolling out a new Yahoo Mail user interface for Web and Windows 8 and released new versions of its Yahoo Mail mobile applications for iPhone and Android.
The new Yahoo webmail interface has a "Turn on SSL" setting in the Mail Options menu. However, the setting is off by default and needs to be manually turned on by users who wish to take advantage of it. "If you're a Yahoo! Mail user, please take this step right away to protect your privacy when reading and writing e-mail," the EFF said Monday.
"Access is encouraged to see that Yahoo! is now supporting HTTPS globally for its mail and messaging services, an important and overdue step for the security and privacy of its users," AccessNow.org, a digital freedom advocacy group that also signed the November letter, said Friday in a blog post. "Pending technical analysis of its implementation, we believe this decision by Yahoo! responds to some of the concerns raised by civil society and security experts, and signals a continuing strengthening of their services' privacy protections."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Gartner Report: A Guide to Gartner's Enterprise Mobile Security Self-Assessment Gartner introduces a model and a Toolkit intended to help mobility and security IT leaders assess their enterprise mobility programs from a security...
- Gartner Report: Containing Mobile Security Risks With the 80/20 Rule IT planners can deliver better mobile protection with higher user satisfaction by segmenting users into risk groups before committing to specific management or...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts