Verizon Email Passwords Can Be Seen in Clear Text???
antscarpa
Enthusiast - Level 1

Is there a way for me to access my Verizon email via an HTTPS (Secure Socket Layer) connection?  I was shocked to learn that my password was being passed in clear text when I logged in.  I verified this by recording my headers using a Firefox plugin.

0 Likes
1 Solution

Correct answers
Re: Verizon Email Passwords Can Be Seen in Clear Text???
viafax999
Community Leader
Community Leader

@antscarpa wrote:

Is there a way for me to access my Verizon email via an HTTPS (Secure Socket Layer) connection?  I was shocked to learn that my password was being passed in clear text when I logged in.  I verified this by recording my headers using a Firefox plugin.


Odd, my sign in uses port 443 OK

Main Verizon site https://www22.verizon.com/

From the top bar select My Verizon then Verizon Central and Email and it sends you to

https://sso.verizon.net/ssowebapp/VOLPortalLogin

Some of their pages allow you to enter userid and password via http, try changing the address to https and refresh before entering sign on details.

View solution in original post

0 Likes
Re: Verizon Email Passwords Can Be Seen in Clear Text???
somegirl
Champion - Level 3

Have you tried logging in through the My Account page? Go to verizon.net and click on the My Account button.

Not sure if this is exactly what you're looking for, but it's supposedly a "secure" page.

Re: Verizon Email Passwords Can Be Seen in Clear Text???
cjacobs001
Contributor - Level 3

the 'clear text' stuff is normal . . . . for most isp's

0 Likes
Re: Verizon Email Passwords Can Be Seen in Clear Text???
viafax999
Community Leader
Community Leader

@antscarpa wrote:

Is there a way for me to access my Verizon email via an HTTPS (Secure Socket Layer) connection?  I was shocked to learn that my password was being passed in clear text when I logged in.  I verified this by recording my headers using a Firefox plugin.


Odd, my sign in uses port 443 OK

Main Verizon site https://www22.verizon.com/

From the top bar select My Verizon then Verizon Central and Email and it sends you to

https://sso.verizon.net/ssowebapp/VOLPortalLogin

Some of their pages allow you to enter userid and password via http, try changing the address to https and refresh before entering sign on details.

0 Likes
Re: Verizon Email Passwords Can Be Seen in Clear Text???
viafax999
Community Leader
Community Leader

@cjacobs001 wrote:

the 'clear text' stuff is normal . . . . for most isp's


Pretty sad if that was true.  Pays to check the url before entering any signon info.  If it does not start with https I wouldn't touch it.

0 Likes
Re: Verizon Email Passwords Can Be Seen in Clear Text???
cjacobs001
Contributor - Level 3

most don't, so far

0 Likes
Re: Verizon Email Passwords Can Be Seen in Clear Text???
antscarpa
Enthusiast - Level 1

Thanks to those of you who responded.  So this my be repeating what you all have already stated, but essentially:

If you access:

http://webmail.verizon.net  it is not secure and your password is visible in clear text.  (Verizon should at least provide a link to an SSL login and clearly state that you are vulnerable on this page.)

However, if you access:

https://www.verizon.net/ssowebapp/VOLPortalLogin?TARGET=https://www.verizon.net/ssowebapp/protected/...  then you can login securely.

I can also login through my verizon central page but that actually uses a different ID/PW combination.  I didn't want to manage my entire account but only check my email via the web.

Thanks again.

Re: Verizon Email Passwords Can Be Seen in Clear Text???
dslr595148
Community Leader
Community Leader

@antscarpa wrote:

Thanks to those of you who responded.  So this my be repeating what you all have already stated, but essentially:

If you access:

http://webmail.verizon.net  it is not secure and your password is visible in clear text.  (Verizon should at least provide a link to an SSL login and clearly state that you are vulnerable on this page.)

However, if you access:

https://www.verizon.net/ssowebapp/VOLPortalLogin?TARGET=https://www.verizon.net/ssowebapp/protected/...  then you can login securely.

I can also login through my verizon central page but that actually uses a different ID/PW combination.  I didn't want to manage my entire account but only check my email via the web.

Thanks again.


Rolls eyes.

News flash, the page still send the data unsecurly!

Here is a screen shot from Firefix with the add-on SSL Password Warning.

http://i45.tinypic.com/2yya33m.jpg

Bad move Verizon. Do it right or do not do it at all!

0 Likes