4 ms·

>>How Outlook 2010 was cut out from downloading outlook.com mail is concerning. Why is that concerning? Outlook 2010 does not support the modern authenticatio

>>How Outlook 2010 was cut out from downloading outlook.com mail is concerning. Why is that concerning? Outlook 2010 does not support the modern authentication and encryption that Exchange Online, and Outlook.com require. It only supports Basic Auth, which was turned off after a long and extended delay.

throwifasd 4y ago
[flagged]
- Twisell 4y ago
  Well basic auth decommissioning was a shitshow for end business users. Our IT teams sure handled it gracefully for internal app we manage, but what about legacy production software from third parties vendors? IT is now facing enraged users on one front and shitty vendors on another. What to conclude? Stop trusting Microsoft for mail delivery and run your own mail stack (or pay someone to manage it on your own term). (Also get rid of shitty vendors but that is far easier said that done quickly because of Microsoft policy change)
  - phpisthebest 4y ago
    What legacy things where auth to AzureAD or Microsoft 365? Legacy things would/should be auth to OnPrem AD which was uneffected.
    - Twisell 4y ago
      Well our IT was sold on Cloud AD to replace OnPrem with retrocompatibilty with all existing app... And then basic auth deprecation was announced. But they still praise Microsoft, too much crap built on top of legacy MSFT plateform, unless someone decide to put big money on the table to get rid of this shit we are pretty much captive prey for MSFT salesmen...
csdvrx 4y ago
> Outlook 2010 does not support the modern authentication and encryption that Exchange Online, and Outlook.com require. Really? Then explain me why is it important? Why does it require this specific solution, and why other solutions like say using say POP over SSL are absolutely impossible? And if it's so absolutely required, and other solutions are absolutely impossible, why couldn't it be added? I mean, Google of all people managed to write a plugin that acts as a middleware between Outlook and gmail.com and solves all this, and unlike Microsoft they didn't have the benefit of having access to Outlook sourcecode or APIs, so clearly, something is off. To me, this means 1) the lack of "modern" auth and encryption is at best an excuse since 2) there's a proof of concept (from a competitor!) that 3) reliably works as a plugin which is using architectural choices ALREADY BAKED IN outlook. Maybe Microsoft didn't have the money (nah) human resources (possible) or lost the source code (but didn't it get posted during a hack?) of Office 2010 to tweak it and add the feature. However, since it came right after the end of the official support period, I seriously doubt it. I see that more like the same money grab that 1Password did: stop selling regular licenses (here office 2010), move to a subscription model (here office 365), introducing incompatible features as needed to "encourage" the migration (here "modern" auth) , and if customers still don't get the memo, just plainly break the product with some technobabble for plausible deniability (here "encryption" - works as well on the average techie as "think about the children!" works on the average voter)
- phpisthebest 4y ago
  >>and why other solutions like say using say POP over SSL are absolutely impossible? And if it's so absolutely required, and other solutions are absolutely impossible, why couldn't it be added? MFA namely, it requires an interactive process. Other auth standards do not support a challenge-response exchange. Not to mention increasing encryption standards like TLS1.2 that are not included in that client. >>Google of all people managed to write a plugin that acts as a middleware between Outlook and gmail.com Ok and... MS is perfectly cable of doing the same but why? Outside of the problems with traffic and auth, old software has a HUGE security risk, personally I think it should be built into office that once EOL date is reached it simply bricks... People running old software are a risk to EVERYONE online, as these systems are normally the ones turned into botnets, and other control centers for ransomware.

throwifasd 4y ago

[flagged]

Twisell 4y ago
Well basic auth decommissioning was a shitshow for end business users. Our IT teams sure handled it gracefully for internal app we manage, but what about legacy production software from third parties vendors? IT is now facing enraged users on one front and shitty vendors on another. What to conclude? Stop trusting Microsoft for mail delivery and run your own mail stack (or pay someone to manage it on your own term). (Also get rid of shitty vendors but that is far easier said that done quickly because of Microsoft policy change)
- phpisthebest 4y ago
  What legacy things where auth to AzureAD or Microsoft 365? Legacy things would/should be auth to OnPrem AD which was uneffected.
  - Twisell 4y ago
    Well our IT was sold on Cloud AD to replace OnPrem with retrocompatibilty with all existing app... And then basic auth deprecation was announced. But they still praise Microsoft, too much crap built on top of legacy MSFT plateform, unless someone decide to put big money on the table to get rid of this shit we are pretty much captive prey for MSFT salesmen...

csdvrx 4y ago

> Outlook 2010 does not support the modern authentication and encryption that Exchange Online, and Outlook.com require. Really? Then explain me why is it important? Why does it require this specific solution, and why other solutions like say using say POP over SSL are absolutely impossible? And if it's so absolutely required, and other solutions are absolutely impossible, why couldn't it be added? I mean, Google of all people managed to write a plugin that acts as a middleware between Outlook and gmail.com and solves all this, and unlike Microsoft they didn't have the benefit of having access to Outlook sourcecode or APIs, so clearly, something is off. To me, this means 1) the lack of "modern" auth and encryption is at best an excuse since 2) there's a proof of concept (from a competitor!) that 3) reliably works as a plugin which is using architectural choices ALREADY BAKED IN outlook. Maybe Microsoft didn't have the money (nah) human resources (possible) or lost the source code (but didn't it get posted during a hack?) of Office 2010 to tweak it and add the feature. However, since it came right after the end of the official support period, I seriously doubt it. I see that more like the same money grab that 1Password did: stop selling regular licenses (here office 2010), move to a subscription model (here office 365), introducing incompatible features as needed to "encourage" the migration (here "modern" auth) , and if customers still don't get the memo, just plainly break the product with some technobabble for plausible deniability (here "encryption" - works as well on the average techie as "think about the children!" works on the average voter)

phpisthebest 4y ago
>>and why other solutions like say using say POP over SSL are absolutely impossible? And if it's so absolutely required, and other solutions are absolutely impossible, why couldn't it be added? MFA namely, it requires an interactive process. Other auth standards do not support a challenge-response exchange. Not to mention increasing encryption standards like TLS1.2 that are not included in that client. >>Google of all people managed to write a plugin that acts as a middleware between Outlook and gmail.com Ok and... MS is perfectly cable of doing the same but why? Outside of the problems with traffic and auth, old software has a HUGE security risk, personally I think it should be built into office that once EOL date is reached it simply bricks... People running old software are a risk to EVERYONE online, as these systems are normally the ones turned into botnets, and other control centers for ransomware.