I am sure glad I switched to ProtonMail.
Hackers could read non-corporate Outlook.com, Hotmail for six months
31–40 of 59 posts
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#32Storytime! When I worked for MSN/Hotmail around 2000-2003, there were dozens of helpdesk folks who had access to an admin panel to easily view any email and could view/edit PII for anyone with very little (if not zero) accounting or auditing. It was protected by plaintext auth and open to the internet. One employee told me that he caught his wife cheating by reading her mail. Another used it to recover their own stol…
I remember knowing people on IRC who "had friends at Microsoft" who could do this kind of stuff to your MSN account, and I heard of people having their accounts stolen, but I never believed it. Guess there was some truth to it...
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#33I am sure glad I switched to ProtonMail.
Not sure why you were downvoted.
Protonmail stores all your emails encrypted, with the encryption dependent on your password, so something like this couldn't happen there.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#34Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There was no 2fa. There was no auditing. There was no integration with any sort of ticketing system ("you can only access an account if you're working on that specific user's ticket") or paperwork ("reason for access:"). There wasn't a single piece of automated monit…
Sounds like Microsoft...
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#35Storytime! When I worked for MSN/Hotmail around 2000-2003, there were dozens of helpdesk folks who had access to an admin panel to easily view any email and could view/edit PII for anyone with very little (if not zero) accounting or auditing. It was protected by plaintext auth and open to the internet. One employee told me that he caught his wife cheating by reading her mail. Another used it to recover their own stol…
Do you think things like this happen regularly nowadays? Most companies have logging in place but I'd assume there isn't resources to audit those logs unless a compelled by an outside complaint...
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#36This is totally not something that NSA uses by the way.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#37Storytime! When I worked for MSN/Hotmail around 2000-2003, there were dozens of helpdesk folks who had access to an admin panel to easily view any email and could view/edit PII for anyone with very little (if not zero) accounting or auditing. It was protected by plaintext auth and open to the internet. One employee told me that he caught his wife cheating by reading her mail. Another used it to recover their own stol…
In 2002-2003 you could access anyone else's Hotmail account by going to your own Settings page, adding an input field with the ID "SignInName", entering the email address you want to switch to, and clicking Save.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#38[deleted]
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#39This further justifies my decision to use an email provider like Protonmail where only I can decrypt my emails' contents.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#40Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There was no 2fa. There was no auditing. There was no integration with any sort of ticketing system ("you can only access an account if you're working on that specific user's ticket") or paperwork ("reason for access:"). There wasn't a single piece of automated monit…
Not surprised at all. This is the way enterprise systems are.
It's a little depressing to go to work and try to deal with the atrocious stuff I have to deal with, and then think how much of my life is online at companies probably just as bad as my own.