Microsoft Shuts off HTTPS in Hotmail for Over a Dozen Countries
Microsoft appears to have turned off the always-use-HTTPS option in Hotmail for users in more than a dozen countries, including Bahrain, Morocco, Algeria, Syria, Sudan, Iran, Lebanon, Jordan, Congo, Myanmar, Nigeria, Kazakhstan …
Context & Ripple Effects
Hotmail has been Microsoft's global consumer mail franchise since it launched Windows Live Hotmail across international markets in 2007, but the service's recent track record is shaky — outages through 2008 and 2010 ended with Microsoft advising frustrated users to switch to Chrome rather than patching its own webmail code. Now the EFF reports the always-use-HTTPS toggle has disappeared entirely for users in Bahrain, Morocco, Algeria, Syria, Sudan, Iran, Lebanon, Jordan, Congo, Myanmar, Nigeria and Kazakhstan.
Two things make the timing pointed. First, the affected list reads less like a random rollout region and more like a map of states known for monitoring opposition figures, which puts the burden on Microsoft to explain whether this was local-law compliance or something else. Second, it lands days after Microsoft began pushing the NoDo update to Windows Phone 7 handsets — devices whose whole identity is built around a Hotmail-linked account.
First-order effects
- Users in the affected countries who had opted into always-on HTTPS silently lose transport encryption on their webmail, exposing session cookies to network-level interception at cafes, ISPs, or state-run choke points.
- Microsoft immediately faces an attribution problem: with no stated reason, critics including the EFF can frame the cutoff as accommodation of local authorities, and every day of silence hardens that reading.
Second-order effects
- Windows Phone 7's push into emerging markets takes collateral damage — Hotmail is the platform's account backbone, and a security downgrade in precisely the countries Nokia-and-Microsoft distribution targets gives carriers and buyers a reason to hesitate.
- Rival webmail providers gain an easy trust differentiator: advertising unconditional HTTPS everywhere forces Microsoft to either reverse the change or defend a two-tier product.
Third-order effects
- If consumer cloud services begin geo-fencing security features by jurisdiction, encryption stops being a universal property of the product and becomes a negotiated variable — pushing activists toward VPNs and proxies and fueling demands for providers to disclose when governments shape feature availability.
- A pattern of silent regional downgrades would shift the reputational calculus for US-based platforms operating in repressive markets, making 'what does this service do differently in Tehran?' a standard due-diligence question for journalists, NGOs, and diaspora users.
The trend: Consumer web platforms are starting to vary core security features by country, turning the humble HTTPS toggle into a test case for how global services handle surveillance-heavy jurisdictions.