I can't get usable browser access to email.orange.co.uk using either HTTP or HTTPS protocols. I'm using OS X and Firefox so if that's the site that is having problems, they aren't necessarily related to Windoze of any flavour.

FWIW, the server at email.orange.co.uk displays a number of significant security failings. See https://www.ssllabs.com/ssltest/analyze.html?d=email...

This isn't the server handling webmail at the moment though. From a command line, I can get the following from the site using the Lynx browser.

It gets a bit complicated because http://email.orange.co.uk redirects to http://email01.orange.co.uk as follows;

colombia:/var/log$ lynx -dump -head http://email.orange.co.uk
HTTP/1.1 302 Found
Date: Tue, 08 Mar 2016 18:39:55 GMT
Server: Apache
Set-Cookie: proxyIn_uk_a=mspap401; path=/; domain=email.orange.co.uk; expires=Fr
i, 11-Mar-2016 06:39:55 GMT
Location: http://email01.orange.co.uk
Connection: close
Content-Type: text/html; charset=iso-8859-1

http://email01.orange.co.uk redirects back to http://email.orange.co.uk/service/SA?VS=MAILWELCOME

colombia:/var/log$ lynx -dump -head http://email01.orange.co.uk
HTTP/1.1 302 Found
Date: Tue, 08 Mar 2016 18:53:16 GMT
Server: Apache
Set-Cookie: proxyIn_uk_a=mspvp399; path=/; domain=email01.orange.co.uk; expires=
Fri, 11-Mar-2016 06:53:16 GMT
Location: http://email.orange.co.uk/service/SA?VS=MAILWELCOME
Connection: close
Content-Type: text/html; charset=iso-8859-1

http://email.orange.co.uk/service/SA?VS=MAILWELCOME redirects to https://web.orange.co.uk/r/login/?ServiceId=mdsp&tar...

colombia:/var/log$ lynx -dump -head http://email.orange.co.uk/service/SA?VS=MAILWELCOME
HTTP/1.1 302 Found
Date: Tue, 08 Mar 2016 18:53:43 GMT
Server: Apache
Set-Cookie: proxyIn_uk_a=mspvp404; path=/; domain=email.orange.co.uk; expires=Fr
i, 11-Mar-2016 06:53:43 GMT
Location: https://web.orange.co.uk/r/login/?ServiceId=mdsp&target=http%3A%2F%2Fe
mail.orange.co.uk%2Fservice%2FSA%3FVS%3DMAILWELCOME

But https://web.orange.co.uk/ is currently borked and not responding; https://www.ssllabs.com/ssltest/analyze.html?d=web.o...

Thanks for your analysis. Very useful.

However the situation has changed this PM. Orange Webmail is now completely borked for everyone, due, i'm sure, with EE playing around with a live system whilst investigting the issues affecting only some users prior to this PM. Pity you did not get in yesterday with your Apple. That would have interesting.

Therefore my suspicions re Windows updates no longer hold water on a changed server that is completely down. I wonder if my hints re Windows updates, which I only voiced yesterday, have filtered back to the EE BB Team causing them to change the server to this dead one, or it's just coincidence?

I was aware that Orange Webmail did put out bad HTML, but not its detail.

@caffn8me: Can you try https://email.orange.co.uk/ from your Apple now. It's back up. Does your analysis change anything?

Edited by XRaySpeX (Wed 09-Mar-16 21:03:13)

It works on Apple but the security is still very poor in a number of ways; https://www.ssllabs.com/ssltest/analyze.html?d=web.o...

The server uses apache httpd software. Disabling insecure protocols on this is trivial, as is enabling more secure protocols. It is also possible to specify an order of preference so that clients connect with the most secure encryption they support but this server doesn't do that.

This doesn't mean the website can be hacked, but that clients connecting use poor or obsolete encryption which may allow a third party to intercept and decode their messages.

Edited by caffn8me (Thu 10-Mar-16 08:56:16)