The situation comes down to this:
- When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password.
- Since I had signed in a couple of days ago, I do not need to put my email/password again: hotmail doesn't know any secret about me/this specific session.
From these points, I can only infer:
- They store a master password derived from my original password in my cookies. Thus, when I come back, they use that to decrypt the emails.
- They have it stored using a master, per-site password.
However, both of the solutions seem really weak. Any idea on how to implement a secure, cookie persistent connection and encrypting passwords?
Note: please read this question from me about why I'm saying encrypt and not hash passwords.