Yahoo Mail switching to HTTPS connections by default in January, four years after GMail
Yahoo to make SSL encryption the default for Webmail users. Finally. — Beginning Jan. 8, Yahoo will enable encryption by default for users logging into its Web-based mail service, the company has told The Washington Post.
Context & Ripple Effects
Google had already moved Gmail to HTTPS by default in 2010, after offering users a way to automatically encrypt Gmail traffic in 2008. Yahoo’s planned change closes that default-security gap for browser-based mail.
The move also arrives after Yahoo drew criticism over its handling of email-account reuse and its $12.50 reward for a reported email-security vulnerability, making a service-wide protection setting more consequential than an optional feature.
First-order effects
- Beginning January 8, Yahoo Mail web users will be placed on HTTPS/SSL connections by default, rather than needing to opt into encrypted access.
- Yahoo makes encrypted browser sessions the standard configuration for its mail service, matching a baseline Gmail established in 2010.
Second-order effects
- Yahoo’s security posture will be judged less on whether encryption is available and more on whether it is enabled by default across the mail experience.
- Webmail providers that still leave connection encryption to user choice face a clearer comparison with Yahoo Mail and Gmail’s default settings.
Third-order effects
- The shift points toward default-on transport encryption becoming a competitive minimum for consumer webmail, with optional security controls losing their value as differentiation.
The trend: Consumer webmail is moving from opt-in HTTPS to encryption as the default access baseline.