Windows Live Hotmail's lead program manager, Omar Shahine, attempted to log in to his e-mail account one evening. I say attempted because, well, he failed. So what does a Microsoft employee do when he realizes he's lost everything? He does what any geek would do: he posts on his blog! Here's how the blog entry starts off:
What do you do when some one:
hacks into your account
changes your password
changes your secret question
changes your "alternate email address"
changes all your profile information
sets up mail forwarding to another account
Turn on the exclusive junk filter (deleting all your email)
Deletes your life (email, contacts etc)
Doesn't sound like it would be the happiest moment in his life, does it? It gets worse. Shahine has no clue how the hacker managed to pull off step one. He wonders if the perpetrator may have grabbed his browser's cookies at a WiFi hotspot, but he really doesn't know. He then goes on to saying that his problem is easily solved: "Lucky for me I could make some phone calls and get my account access restored", only to update the blog again with "my account just got hijacked again, minutes ago. Also so did my Gmail account." I must admit that that part made me sit up in my seat. If someone at the very top is having issues with regaining control and access to his account, what chance do the rest of us have?
In the same blog entry, Shahine goes on a little rant about how so much personal information is stored in a person's e-mail inbox, asking the reader to think about what they have archived "in the cloud" and how they would feel if someone else had access to it all. Quite a lot, and not very good, I would have to say. Enough to make me want to reconsider using an e-mail address as much as I currently do. It's actually quite unsettling if I take a minute and let my imagination get the better of me.
Shahine has his account back now, although the aftermath isn't pretty. There is, however, a bright side to this event. Think about it. If this was someone else's e-mail, and I'm sure many people have had their Windows Live/Hotmail e-mail address compromised, chances are this wouldn't be taken as seriously. If that person were to contact Microsoft, they might be lucky enough to get their account back, but nothing would be done in the long run. "Choose a stronger password, and backup your e-mails" is all that would be said.
Hopefully, Shahine will take action. He has the power and the motivation to do so. Maybe there needs to be a way to kill access to an account, so no one can use it—like credit cards allow. Maybe certain settings should only be changeable if the IP address that is used the most frequently and recently is the one accessing the account. Maybe fingerprint readers should be used as e-mail passwords? Microsoft has its own fingerprint reader product, so I'm sure that wouldn't be too difficult to arrange. The solution, which of course will never be perfect, is a combination of various methods; adding only one won't make much of a difference. Either way, there needs to be a lot more work put into security and privacy settings when it comes Windows Live/Hotmail, or any e-mail service for that matter.