Problem with hotmail.com?

[tphil]

Last few days, been having a problem with my Hotmail accounts. (Number of times I've said that, why do I keep using them

Initially, all of them returned 'bad connection'. I logged on directly, and a couple had some silly questionnaire page which was probably the issue. Anyway, all the Hotmail.co.uk ones now work fine. But the Hotmail.com one doesn't. Will occasionally work, but rarely. Same 'bad connection' message. Can log on directly with no problem.

Is set to IMAP, and obviously was working fine before and I haven't changed anything. Any ideas guys?

Trev

[Jeff]

I can't say I've noticed any particular problems with Hotmail/imap recently. It very likely has to do with geographical location, though. And it's too bad that their server doesn't return ping results because that could provide us with useful information. However, if you do ping the server, what server name do you get? That is:
- Open a command/dos prompt (type 'command' into the start menu to find it)
- type:
ping imap-mail.outlook.com

and you'll get something like:

Pinging imap.glbdns2.microsoft.com [207.46.11.202] with 32 bytes of data:
Request timed out.

Ping statistics for 207.46.11.202:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Control-C

and this is the information (highlighted above) I'm interested in:
imap.glbdns2.microsoft.com [207.46.11.202]


Otherwise, as long as you ensure that "IDLE/push" is enabled for the account, there's not much more you can do. If it becomes a nuisance, you can try using POP3 instead, as that is often more reliable. Be aware: POP Peeper will have to re-download any/all messages when you change the protocol. And, if you post back sometime in the future and we see you're using POP3, we'll probably try to convince you to use IMAP instead

[tphil]

Hi Jeff. Info was:

imap.glbdns2.microsoft.com [65.55.174.70]

And still no change at present. All the hm.uk ones fine, the one hm.com hasn't logged on through PP for days now.

And yep - I switched from POP3 to IMAP ages ago because it wouldn't work with POP3 lol! It's my own fault for keeping a hm email I suppose

Trev

[tphil]

OK.... well I think this may be me being thick, or something.

I tried to switch it to POP3, which didn't work, but when I switched it back to IMAP it did, sort of. Except it wanted me to do the O2 auth bit again, fair enough, I did, authorising it to use this app (PP).

Then straight away I got an email, apparently from Apple, wanting me to put the code in the email into the 'authorisation page'. Not that there was an 'authorisation page', or even a link to one though I wouldn't have clicked it if there was! Now if I was using some Apple kit, had an Apple account, had ever had any business with Apple, and there was an 'authorisation page' to put the code in it might make a little sense, but as none of those things are true I'm a bit baffled. (Like everyone I get loads of emails asking me to 'verify my email/bank account/whatever' and just ignore them, but this one lacks the usual dodgy link and the timing suggests something to do with the email authorisation I just did). According to the message my email won't work unless I do, but it does now

Now I can't believe this is just coincidence, and it appears to have come from Apple, simultaneously with me re-authorising the email address on PP. Am I missing something???

[spc3rd]

Hi tphil,

While waiting for Jeff to continue his follow-up with you, you might want to look at that "Apple" email's source code to see if anything looks amiss. If so, just mention it to Jeff.

Good luck!

[tphil]

Pete - yes, my first thought too! But that's why I said it looked like it WAS from Apple - the top bit says:

Received: from VE1EUR02HT041.eop-EUR02.prod.protection.outlook.com
(10.171.89.154) by HE1PR0902MB1802.eurprd09.prod.outlook.com with HTTPS via
HE1PR0202CA0040.EURPRD02.PROD.OUTLOOK.COM; Tue, 28 Feb 2017 03:59:38 +0000
Received: from VE1EUR02FT036.eop-EUR02.prod.protection.outlook.com
(10.152.12.51) by VE1EUR02HT041.eop-EUR02.prod.protection.outlook.com
(10.152.13.186) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.933.11; Tue, 28
Feb 2017 03:59:37 +0000
Authentication-Results: spf=pass (sender IP is 17.151.1.70)
smtp.mailfrom=id.apple.com; hotmail.com; dkim=pass (signature was verified)
header.d=id.apple.com;hotmail.com; dmarc=pass action=none
header.from=id.apple.com;
Received-SPF: Pass (protection.outlook.com: domain of id.apple.com designates
17.151.1.70 as permitted sender) receiver=protection.outlook.com;
client-ip=17.151.1.70; helo= nwk-txn-msbadger0503.apple.com;

It goes on...and on.... but does appear to be from Apple. Like I say - I'm sure this is me being very stupid, but frankly totally baffled! This was done on an ordinary PC, nothing to do with any Apple device.

[Jeff]

That is strange... Based on the snippet you sent, it does look authentic, but I wouldn't hold to that without seeing the entire header. And that's not considering the whole "apple" thing, which really is very peculiar. And the fact that they *don't* include a link to the authorization page presumably makes it more legitimate. fwiw, I just reset my oauth2 credentials on my hotmail account and didn't receive anything. Final conclusion: I'm sure you did the right thing by ignoring the email.

fyi: you may need to enable POP3 in your hotmail account (ie. http://www.hotmail.com ; gear icon / options / Accounts -> POP and IMAP -- "let devices and apps use POP" = yes); it's disabled by default.

[tphil]

Account stopped working again - SSL failure. - maybe because I changed the password? Did 0auth2 again, and works fine. Will see if I get another email from apple....

The only thing I'm left wondering is if the authorisation screen I get through PP is what it seems to be. Is it possible somebody has hacked the PP program on my PC and I'm sending the password somewhere else? Seems highly unlikely and even less so they then somehow notify Apple, but is there any way I can check that the screen that pops up when I use that key is genuine and what it seems to be?

[Jeff]

These are likely unrelated -- SSL negotiation occurs before login/oauth2 -- so I suspect it was just coincidence.

It's unlikely that your poppeeper program files have been hacked (again: hotmail's imap is not a reliable service, I'm sure you're just getting unluckier than most), but if you want to confirm here's what I recommend:
- Go to: http://www.virustotal.com/ (virustotal is google-owned)
- Upload the file: poppeeper.exe from where PP is installed (e.g. C:\Program Files (x86)\POP Peeper\)
- Assuming that you have POP Peeper v4.3, the SHA256 value (listed at the top of the virustotal results page) is:
4eed04906c0a0d3e023d660eeaa111130f3f3ea4ccae75287b534a0b7e1dc79c
-> if yours is the same, then you have the correct file (it's usually not necessary to compare every single character, a single change in the binary file will make the checksum completely different)

You can also review the virus test results. I just uploaded mine and it looks like someone else recently (12 hours ago) re-verified the results and it is 100% clean (for the record, 1 or 2 false positives is not uncommon).