Hotmail wildfire: E-mail breach a smoldering issue for Web-based services

Microsoft apparently has patched the security hole that last week allowed unauthorized users to access 40 million Hotmail accounts, its free Web e-mail service. But while the fire is out, some analysts say the lingering smoke should be a warning of problems that remain in moving services onto the Web.

Microsoft shut down Hotmail after learning of the breach and claimed to have fixed the problem within a few hours. But security expert Charles Curren Wood of Baseline Software said that the Hotmail hack existed "in the wild" for months before it was finally used. Hotmail's apparent simplicity - a line of code recognized by its servers that was intended to save users from having to enter their password every time - points out the inherent Web-based applications conflict between effective security and ease of use.

"You want Web-based services to move fast because people say they're already dealing with too many passwords," said Howard Weiner, an analyst with Brady Investment. "But easy becomes vulnerable pretty fast on the Internet."

The problem is complicated by the fact that outsourced Web services such as e-mail are largely driven by advertising revenue. "They make their money by drawing eyeballs, not by perfecting their security," Weiner said. "The incentive to make applications more bulletproof just isn't there."

The Hotmail hack probably will not amount to more than a public relations problem for Microsoft, said David Ferris, president of messaging consultancy Ferris Research.

But with companies such as Sun Microsystems and Microsoft thinking about moving popular software onto the Internet, the attack shows that much remains to be done before Web-based services can be made secure enough for critical business applications. "Quite simply, this hack would not have been as catastrophic against a conventional, [point of presence] server-based e-mail service," said Weiner. "IT managers will look at this and realize Web-based services are not yet ready for prime time."