3 ms·
There seems to be an attempt at a single-sign on solution, but when I used it about 2 years ago, it sent me a on trip to about 6 different domains (live.com, mi
by perlgeek 8y ago
There seems to be an attempt at a single-sign on solution, but when I used it about 2 years ago, it sent me a on trip to about 6 different domains (live.com, microsoft.com, office365.com, something with sharepoint in the name, and several subdomains of those).
In the past, I've given folks the tip to not open links if they send you to a different domain than the link suggests -- by that standard, the SSO looks like a complete scam. It takes some serious knowledge of the Microsoft products to know that those domains all belong to the same corporate entity.
- rcarmo 8y agoIt is also a pain for parental controls if your kids use Kahoot or micro:bit with MS auth. I've had to whitelist a bunch of non-obvious subdomains as well.
- mavhc 8y agoOffice 365 Message Encryption looks exactly like phishing. (and is also useless as it doesn't have a second channel) Good news: You can pay more to get phishing warnings in Office 365.... spooky
- jedieaston 8y agoCan you clarify what you mean by second channel?
- mavhc 8y agoYou have to send the way to decrypt data via a different method than your send the encrypted data, otherwise the person who can intercept one can intercept the other. If you email me a file which needs a password, and then the password, that's pointless, you have to phone me or post me the password. In MS's case the way you see the document is to login to MS's servers using your email account (so an attacker could send a password reset), or an emailed one time code (so an attacker can intercept and use it, either first, or if they can change the intercepted channel, not pass it on)