Time Warner Road Runner web mail not secure

Hi,

I use this site:

http://webmail.tx.rr.com/webedge/do/mail/folder/view

for accessing web mail. It is from Time Warner.

I called their help desk to indicate it is not using https:// and
therefore is not encrypted and not secure. Their response was that it
is a secure site and that it is using encryption.

I have contacted their security department to indicate this and never
got a response back.

I can see that other Time Warner sites use https (e.g. https://webmail.nyc.rr.com/),
but this texas site is not.

I am getting frustrated because they keep insisting it's secure and
encrypted even when it's clearly not so.

Am I wrong about this? How do I get them to fix it?

JP

Re: Time Warner Road Runner web mail not secure

In article <1174571312.643050.273610@l75g2000hse.googlegroups.com>,
SecretSquirrel wrote:
>Hi,
>
>I use this site:
>
>http://webmail.tx.rr.com/webedge/do/mail/folder/view
>
>for accessing web mail. It is from Time Warner.
>
>I called their help desk to indicate it is not using https:// and
>therefore is not encrypted and not secure. Their response was that it
>is a secure site and that it is using encryption.
>
>I have contacted their security department to indicate this and never
>got a response back.
>
>I can see that other Time Warner sites use https (e.g. https://webmail.nyc.rr.com/),
>but this texas site is not.
>
>I am getting frustrated because they keep insisting it's secure and
>encrypted even when it's clearly not so.
>
>Am I wrong about this?

You don't seem to be, unless there's some additional facts here you've
overlooked.

>How do I get them to fix it?
>

If they won't listen to you, you don't. You can't force them do to
anything. I would advise acquiring a different email solution. I
personally dislike webmail to begin with and keep my mail on my own
box, accessed via secure IMAP (I use Dovecot on Debian Linux, and it
works quite well). Webmail is an abortion developed by people who
want to keep you locked into their service instead of using established,
open protocols that do the job well and leave you in control of your
own data.


--
Christopher Mattern

NOTICE
Thank you for noticing this new notice
Your noticing it has been noted
And will be reported to the authorities

Re: Time Warner Road Runner web mail not secure

"SecretSquirrel" writes:

>Hi,

>I use this site:

>http://webmail.tx.rr.com/webedge/do/mail/folder/view

>for accessing web mail. It is from Time Warner.

>I called their help desk to indicate it is not using https:// and
>therefore is not encrypted and not secure. Their response was that it
>is a secure site and that it is using encryption.

>I have contacted their security department to indicate this and never
>got a response back.

>I can see that other Time Warner sites use https (e.g. https://webmail.nyc.rr.com/),
>but this texas site is not.

>I am getting frustrated because they keep insisting it's secure and
>encrypted even when it's clearly not so.

>Am I wrong about this? How do I get them to fix it?

So quit using them.

>JP

Re: Time Warner Road Runner web mail not secure

In article <1174571312.643050.273610@l75g2000hse.googlegroups.com>,
"SecretSquirrel" wrote:

> Hi,
>
> I use this site:
>
> http://webmail.tx.rr.com/webedge/do/mail/folder/view
>
> for accessing web mail. It is from Time Warner.
>
> I called their help desk to indicate it is not using https:// and
> therefore is not encrypted and not secure. Their response was that it
> is a secure site and that it is using encryption.

They're wrong.

In most cases, the explanation is that even though the login page is
downloaded with HTTP, it submits the password with HTTPS. But I just
checked the source of this page and it sends the form to the same server
and protocol that it downloaded it from.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

Re: Time Warner Road Runner web mail not secure

In article <1174571312.643050.273610@l75g2000hse.googlegroups.com>,
SecretSquirrel wrote:
>Hi,
>
>I use this site:
>
>http://webmail.tx.rr.com/webedge/do/mail/folder/view
>
>for accessing web mail. It is from Time Warner.
>
>I called their help desk to indicate it is not using https:// and
>therefore is not encrypted and not secure. Their response was that it
>is a secure site and that it is using encryption.
>
>I have contacted their security department to indicate this and never
>got a response back.
>
>I can see that other Time Warner sites use https (e.g. https://webmail.nyc.rr.com/),
>but this texas site is not.
>
>I am getting frustrated because they keep insisting it's secure and
>encrypted even when it's clearly not so.
>
>Am I wrong about this? How do I get them to fix it?

As others have pointed out, it is likely that the authentication is
using HTTPS. When you log into the webmail interface, watch your
browser to see if it briefly submits something to an "https://...." URL.
Some browsers, such as Firefox, will also show a subtle change in the
appearance of the browser window to indicate that it has switched to
"secure" mode (the appearance of a padlock icon in one corner, or the
changing of the address bar to an alternate color).

The rest of your session, however, will be unencrypted. The support
representative you spoke with on the phone probably did understand
what you were asking, since your question doesn't fit into their
troubleshooting scripts, and they personally probably don't appreciate
the difference.

If you are looking for secure webmail, you're looking in the wrong
place. Road Runner, like most transport ISPs, offers e-mail simply as
an add-on service that they can tout in their marketing materials ("We
offer free e-mail!"). They support it, however, only as much to keep
customers from switching to another service (such as DSL or a competing
cable provider). The poor reputation of most of these companies among
anti-spam advocates should also tip you off that they have very little
interest in security, so long as it doesn't cut into their bottom line
*this* month, or expose them to expensive lawsuits.

I find it is best to pretend that Road Runner doesn't offer e-mail at
all, and simply pay $10/month for a service that (1) provides encryption
on my sessions all the time, and not just during authentication, and (2)
is actually responsive to reasonable customer requests. Talking to
someone who actually cares, and who has a clue, is worth every penny.

--
Gregory Pratt gp@panix.com
East Rutherford, NJ, USA http://www.panix.com/~gp/
"You're only given one little spark of madness. You mustn't lose it."
PGP Key Fingerprint: DC60 FCDE 91E2 3D41 91A3 45DB B474 3D3A 3621 AAFE

Re: Time Warner Road Runner web mail not secure

In article , gp@panix.com (Greg Pratt)
wrote:

> As others have pointed out, it is likely that the authentication is
> using HTTPS. When you log into the webmail interface, watch your
> browser to see if it briefly submits something to an "https://...." URL.
> Some browsers, such as Firefox, will also show a subtle change in the
> appearance of the browser window to indicate that it has switched to
> "secure" mode (the appearance of a padlock icon in one corner, or the
> changing of the address bar to an alternate color).

Didn't you see my reply? This site does NOT submit the authentication
using HTTPS. I checked the HTML page's source.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***