4 ms·

> Outlook 2010 does not support the modern authentication and encryption that Exchange Online, and Outlook.com require. Really? Then explain me why is it impor

by csdvrx 4y ago

> Outlook 2010 does not support the modern authentication and encryption that Exchange Online, and Outlook.com require. Really? Then explain me why is it important? Why does it require this specific solution, and why other solutions like say using say POP over SSL are absolutely impossible? And if it's so absolutely required, and other solutions are absolutely impossible, why couldn't it be added? I mean, Google of all people managed to write a plugin that acts as a middleware between Outlook and gmail.com and solves all this, and unlike Microsoft they didn't have the benefit of having access to Outlook sourcecode or APIs, so clearly, something is off. To me, this means 1) the lack of "modern" auth and encryption is at best an excuse since 2) there's a proof of concept (from a competitor!) that 3) reliably works as a plugin which is using architectural choices ALREADY BAKED IN outlook. Maybe Microsoft didn't have the money (nah) human resources (possible) or lost the source code (but didn't it get posted during a hack?) of Office 2010 to tweak it and add the feature. However, since it came right after the end of the official support period, I seriously doubt it. I see that more like the same money grab that 1Password did: stop selling regular licenses (here office 2010), move to a subscription model (here office 365), introducing incompatible features as needed to "encourage" the migration (here "modern" auth) , and if customers still don't get the memo, just plainly break the product with some technobabble for plausible deniability (here "encryption" - works as well on the average techie as "think about the children!" works on the average voter)

phpisthebest 4y ago
>>and why other solutions like say using say POP over SSL are absolutely impossible? And if it's so absolutely required, and other solutions are absolutely impossible, why couldn't it be added? MFA namely, it requires an interactive process. Other auth standards do not support a challenge-response exchange. Not to mention increasing encryption standards like TLS1.2 that are not included in that client. >>Google of all people managed to write a plugin that acts as a middleware between Outlook and gmail.com Ok and... MS is perfectly cable of doing the same but why? Outside of the problems with traffic and auth, old software has a HUGE security risk, personally I think it should be built into office that once EOL date is reached it simply bricks... People running old software are a risk to EVERYONE online, as these systems are normally the ones turned into botnets, and other control centers for ransomware.
- csdvrx 4y ago
  > Other auth standards do not support a challenge-response exchange And why is a challenge required? Shouldn't the decision on which level of protection to use be left to the client? The business should be able to say "thanks but no thanks I like my email server just the way it is". > MFA namely, it requires an interactive process Assuming that an interactive process is required (even if that's moving the goalpost), again, that's something that can totally be done in the plugin (show a prompt, and pass that to the server along with the rest of the information stored). It could even be automatized by saving the seed (often shown as a QR code) in the plugin. > MS is perfectly cable of doing the same but why? They don't even have to. All I ask is to not take steps to actively destroy software. With a profit motive (replacing Office 2010 by 365 with a yearly fee) "Negligence" is no longer an excuse. I see "Malice" as way more probable. > old software has a HUGE security risk A client should never cause a security risk to the server. So if you mean outlook.com, no: if Outlook 2010 can cause a security risk to outlook.com when it connects to outlook.com, then you've done the server part seriously wrong (like how SQL injections means a lack of input sanitation). If you mean on my own computer, I'm sorry but I run what the hell I want however I want - first sale doctrine and all that. So if I want to run Windows 7, I will. > personally I think it should be built into office that once EOL date is reached it simply bricks OMG what did I just read? If that's what you seriously believe 1) I'm so glad you're not in charge of the products I use, because 2) you have a great future in sales or as a manager to increase the revenue streams, users be damned. > People running old software are a risk to EVERYONE online I'm sorry my freedom is a negative externality to you? Actually, no: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither"

by csdvrx 4y ago

phpisthebest 4y ago

>>and why other solutions like say using say POP over SSL are absolutely impossible? And if it's so absolutely required, and other solutions are absolutely impossible, why couldn't it be added? MFA namely, it requires an interactive process. Other auth standards do not support a challenge-response exchange. Not to mention increasing encryption standards like TLS1.2 that are not included in that client. >>Google of all people managed to write a plugin that acts as a middleware between Outlook and gmail.com Ok and... MS is perfectly cable of doing the same but why? Outside of the problems with traffic and auth, old software has a HUGE security risk, personally I think it should be built into office that once EOL date is reached it simply bricks... People running old software are a risk to EVERYONE online, as these systems are normally the ones turned into botnets, and other control centers for ransomware.

csdvrx 4y ago
> Other auth standards do not support a challenge-response exchange And why is a challenge required? Shouldn't the decision on which level of protection to use be left to the client? The business should be able to say "thanks but no thanks I like my email server just the way it is". > MFA namely, it requires an interactive process Assuming that an interactive process is required (even if that's moving the goalpost), again, that's something that can totally be done in the plugin (show a prompt, and pass that to the server along with the rest of the information stored). It could even be automatized by saving the seed (often shown as a QR code) in the plugin. > MS is perfectly cable of doing the same but why? They don't even have to. All I ask is to not take steps to actively destroy software. With a profit motive (replacing Office 2010 by 365 with a yearly fee) "Negligence" is no longer an excuse. I see "Malice" as way more probable. > old software has a HUGE security risk A client should never cause a security risk to the server. So if you mean outlook.com, no: if Outlook 2010 can cause a security risk to outlook.com when it connects to outlook.com, then you've done the server part seriously wrong (like how SQL injections means a lack of input sanitation). If you mean on my own computer, I'm sorry but I run what the hell I want however I want - first sale doctrine and all that. So if I want to run Windows 7, I will. > personally I think it should be built into office that once EOL date is reached it simply bricks OMG what did I just read? If that's what you seriously believe 1) I'm so glad you're not in charge of the products I use, because 2) you have a great future in sales or as a manager to increase the revenue streams, users be damned. > People running old software are a risk to EVERYONE online I'm sorry my freedom is a negative externality to you? Actually, no: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither"