Verizon Email Passwords Can Be Seen in Clear Text???

[#1]

Is there a way for me to access my Verizon email via an HTTPS (Secure Socket Layer) connection?  I was shocked to learn that my password was being passed in clear text when I logged in.  I verified this by recording my headers using a Firefox plugin.

[#2]

Have you tried logging in through the My Account page? Go to verizon.net and click on the My Account button.

Not sure if this is exactly what you're looking for, but it's supposedly a "secure" page.

[#3]

the 'clear text' stuff is normal . . . . for most isp's

[#4 · Accepted solution]

---

@antscarpa wrote:

Is there a way for me to access my Verizon email via an HTTPS (Secure Socket Layer) connection?  I was shocked to learn that my password was being passed in clear text when I logged in.  I verified this by recording my headers using a Firefox plugin.

---

Odd, my sign in uses port 443 OK

Main Verizon site https://www22.verizon.com/

From the top bar select My Verizon then Verizon Central and Email and it sends you to

https://sso.verizon.net/ssowebapp/VOLPortalLogin

Some of their pages allow you to enter userid and password via http, try changing the address to https and refresh before entering sign on details.

[#5]

---

@cjacobs001 wrote:

the 'clear text' stuff is normal . . . . for most isp's

---

Pretty sad if that was true.  Pays to check the url before entering any signon info.  If it does not start with https I wouldn't touch it.

[#6]

most don't, so far

[#7]

Thanks to those of you who responded.  So this my be repeating what you all have already stated, but essentially:

If you access:

http://webmail.verizon.net  it is not secure and your password is visible in clear text.  (Verizon should at least provide a link to an SSL login and clearly state that you are vulnerable on this page.)

However, if you access:

https://www.verizon.net/ssowebapp/VOLPortalLogin?TARGET=https://www.verizon.net/ssowebapp/protected/...  then you can login securely.

I can also login through my verizon central page but that actually uses a different ID/PW combination.  I didn't want to manage my entire account but only check my email via the web.

Thanks again.

[#8]

---

@antscarpa wrote:

Thanks to those of you who responded.  So this my be repeating what you all have already stated, but essentially:

If you access:

http://webmail.verizon.net  it is not secure and your password is visible in clear text.  (Verizon should at least provide a link to an SSL login and clearly state that you are vulnerable on this page.)

However, if you access:

https://www.verizon.net/ssowebapp/VOLPortalLogin?TARGET=https://www.verizon.net/ssowebapp/protected/...  then you can login securely.

I can also login through my verizon central page but that actually uses a different ID/PW combination.  I didn't want to manage my entire account but only check my email via the web.

Thanks again.

---

Rolls eyes.

News flash, the page still send the data unsecurly!

Here is a screen shot from Firefix with the add-on SSL Password Warning.

http://i45.tinypic.com/2yya33m.jpg

Bad move Verizon. Do it right or do not do it at all!