Yahoo catches up with Microsoft, Google on webmail security

Yahoo has started providing webmail users the option of using a secure connection, matching a similar feature Google and Microsoft have offered for several years.

Yahoo’s delay in providing a Secure Sockets Layer (SSL) connection for email sessions has been criticized by privacy groups that argue the cryptographic protocol help prevent hackers from reading messages sent over a Wi-Fi network.

However, the Electronic Frontier Foundation, which sent a letter in November urging Yahoo to implement SSL, praised Yahoo for catching up with rivals. “We’re really happy that Yahoo is starting 2013 right by letting Yahoo Mail users use HTTPS to access their email accounts security,” the digital rights group said in a statement.

HTTPS is the communications protocol layered on top of SSL to add the security capabilities to standard HTTP communications.

In providing SSL, Yahoo has left AOL as the only major email provider without the option. Chester Wisniewski, a senior security adviser for Sophos, said all Web services requiring a log in should provide an HTTPS connection by default.

“It is unacceptable in 2013 for anyone to offer something that you log in to without offering SSL/TLS,” Wisniewski said in an email. But he said Yahoo still hasn’t done it properly. “It should not be an option; it should be required.”

[See related: Email in security hot seat with rise of cloud, BYOD]

Yahoo Web mail users can activate SSL in only a couple of clicks. Within the service, they only need to go to options and select “Make your Yahoo Mail more secure with SSL.”

Google rolled out SSL for Gmail in 2010, after it accused China-based hackers of launching highly sophisticated attacks to eavesdrop on human rights activists.

Indeed, in its letter to Yahoo Chief Executive Marissa Mayer, the EFF said HTTPS communications was needed to protect dissidents. “As individuals who engage with at-risk communities targeted for surveillance and censorship, we see on a daily basis how this negligence (not providing secure connections) endangers human rights activists who fight in some of the most repressive environments to protect the basic freedoms that we take for granted,” the letter said.

Read more about application security in CSOonline’s Application Security section.