Yahoo! Mail! offers! HTTPS! amid! account! hijack! spree! Yahoo! is now offering to encrypt its webmail service with HTTPS for security-conscious users. Meanwhile, an exploit that allowed anyone to hijack Yahoo! Mail accounts if victims clicked on a link was being flogged to cybercrims for $700. The HTTPS development, which is not enabled by default, affords Yahoo! webmail users …
"Deep Packet Inspection of Secure Socket Layer (DPI-SSL) extends SonicWALL’s Deep Packet Inspection technology to allow for the inspection of encrypted HTTPS traffic and other SSL-based traffic.
The SSL traffic is decrypted transparently, scanned for threats and then re-encrypted and sent along to its destination.
if no threats or vulnerabilities are found. DPI-SSL provides additional security, application control, and data leakage prevention for analyzing encrypted HTTPS and other SSL-based traffic." link
This is installed in a business situation where you can create your own trusted root and deploy it to all the computers in the business. The trusted root is used to sign a wildcard certificate that the sonicwall box uses to do the encryption.
I would guess that if you have that rapport software installed that banks like people to download it would flag this as dodgy since the certs wouldn't match.
When I turned on the SSL on my Yahoo Mail account, Yahoo Mail proceeded to keep asking me to log in when I took any action. I basically got stuck in an endless loop of being forced to log in over and over again without being able to do anything.
The reason this happens, is because Yahoo is mixing SSL and non-SSL content on the page and the SSL content is referencing non-SSL content (and vice-versa). This causes the page loads to fail since most browsers (I was using Firefox) won't allow mixed content and Yahoo interprets this as needing to log in again and puts up a login page.
Basically enabling SSL breaks Yahoo Mail. I managed to get in to the options using an old version of Internet Explorer (which allows non-SSL from SSL) and could turn off SSL. After that I could use Yahoo Mail without issue.
The mobile version already uses SSL and if I need encryption, I just change the http to https after going to the Yahoo Mail page.
Yahoo is such a sick joke I really can't understand how they are staving off bankruptcy. They're main residual value is their email system, and it's the worst of the majors--unless you're a spammer, in which case Yahoo is #1 for helping the spammers.
Where to begin? I guess the way they forcibly split the headers from the email? Even if you want to fight the spammers, Yahoo makes it almost impossible to get a real look at what the spammers are doing. Naked headers are something of a sick joke these days. The spam is almost always coming from throwaway addresses and is just bait for suckers. The real payloads are routed to websites or other email systems.
It's kind of weird. The spammers are holding up giant signs (especially on Yahoo) saying "Look at me! I'm a stinking criminal!" And yet their business models continue to work--or the spam would trail off.
What I want is some effective anti-spammer tools build right into a VALUABLE low-spam email system. I want to go after ALL of the spammers' infrastructure, chase ALL of the spammers' accomplices, and even help and protect ALL of the spammers' victims. They aren't all idiots, after all. Consider the reputable companies who's valuable reputations are "harvested" by the spammers phishing for their trusting customers.
In short, Yahoo should try to turn some of that spammer hatred into Yahoo love. If not, then death to Yahoo only seems fair. Yeah, it will be a big inconvenience for a lot of people--but a BIGGER inconvenience for the spammers.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
