14/05/2025
How “eh” Broke Hotmail—and Internet Security
In 1999, one of the most astonishing security flaws in internet history surfaced. Hackers discovered that entering the letters “eh” into the password field of any Hotmail login page would grant access to any user’s account. No username needed, no brute force required—just “eh.” It was possibly the simplest and most dangerous vulnerability ever uncovered in a major email service.
Hotmail, which had just been acquired by Microsoft in 1997, was one of the largest email providers at the time with millions of users worldwide. This flaw wasn’t the work of sophisticated espionage or malware. It was a gaping hole in the authentication system that somehow made it past every layer of security review.
When word got out—especially in European tech circles and forums—the damage was swift. For hours, possibly days, anyone could access any inbox simply by typing "eh." Personal conversations, bank statements, passwords, and sensitive business information were all exposed.
Microsoft responded quickly, patching the vulnerability within hours after it became widely known. But by then, the internet had learned a hard lesson: trust in digital platforms is fragile, and even tech giants can slip. The incident sparked major concerns about online privacy and prompted companies to reassess their approach to cybersecurity.
The Hotmail “eh” incident remains a stark reminder of the early internet’s wild west days, when basic flaws could bring entire systems to their knees. It also highlights the importance of responsible disclosure—had the flaw been shared privately with Microsoft, millions of users might have been spared potential breaches.
In a world where data breaches often involve sophisticated tactics, this case stands out for its absurd simplicity. A two-letter word almost brought down a global communication tool—and showed just how little stood between users and chaos.
