Hotmail: From Free Webmail Rebellion to the Password That Opened All

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On July 4, 1996, Sabeer Bhatia and Jack Smith launched Hotmail, choosing the date to symbolize freedom from email tied to an internet service provider. The original spelling capitalized the letters H, T, M, and L as a nod to the code of the web. With $310,000 in venture backing from Draper Associates, a staff of nine, and a free inbox of just two megabytes, the service let anyone read their mail from any browser in the world. By December 1997 it had more than eight and a half million subscribers, and Microsoft bought it for an estimated $400 million.

This episode follows what happened after the payday. Microsoft's flagship web property ran on Solaris, Apache, and FreeBSD rather than Windows, and untangling it took years. Security was worse: a two letter password and an editable web address each exposed millions of inboxes. The story then moves through Gmail's 2004 shock, a chaotic run of rebrands ending in Outlook.com, and the privacy fights that turned a symbol of independence into a node of corporate and state surveillance.

• In June 2001 Microsoft announced the migration to Windows 2000 was complete, then had to admit that Hotmail's DNS functions still depended on FreeBSD Unix servers.
• In 1999, typing the password eh granted access to any Hotmail account, likely a leftover developer backdoor. In August 2001, users could read other people's messages simply by editing the URL.
• Beta testers rebelled when Microsoft tried to retire the name for Windows Live Mail, forcing the compromise Windows Live Hotmail in 2007. By 2013, 400 million active users had been moved to Outlook.com.
• After mocking Gmail's ad scanning with its Scroogled campaign, Microsoft was caught in 2014 having read a personal Hotmail inbox to trace leaked Windows 8 trade secrets, and changed its policy under criticism.
• Leaked NSA newsletters reported by the Guardian in 2013 indicated Microsoft had helped the agency get around Outlook.com's encryption by collecting data before it was encrypted.