43 ms·
Windows 11 Update 23H2 is stealing users' IMAP credentials
- neycoda 3y agoThis is why Microsoft's phone failed. They're just focusing on the wrong things.
- raxxorraxor 3y agoThis version of Outlook should be flagged as malware. It is a huge security flaw. This is exactly why I wouldn't want a MS account on my local system. Without that, this wouldn't even be possible.
- Fischgericht 3y agoGerman IT magazine has uncovered that with Windows 11 Update 23H2 if you accept the "recommended" new version of Outlook the client may be uploading your secret IMAP credentials to the Microsoft cloud. If you are trying to add a "local" IMAP/SMTP account, there is short notice that Outlook needs to "synchronize" your IMAP account with the Microsoft cloud. It does NOT explain that what this actually means is that it will send all your credentials including your passwords in clear text to Microsoft. Microsoft's support document to this also only mentions: "Syncing your account to the Microsoft Cloud means that a copy of your email, calendar, and contacts will be synchronized between your email provider and Microsoft data centers." No word that it means that they are uploading your passwords. This is evil. And at least in the EU, illegal. I have not yet found any report on this in english-language IT media, and therefore have provided a Google Translate link to the report in German.
- jofla_net 3y agobig if true, i mean what a footgun. Imagine the target they are painting on their back, with all those credentials now harvested.
- Fischgericht 3y agoYeah, it's true. c't magazine is the biggest IT print publication in the EU, and is highly respected and known for investigative journalism. It looks like the pictures provided which show what they captured is sent to Microsoft (your passwords in plain text) aren't shown if the page is viewed via Google Translate. So here is the original page URL: https://www.heise.de/news/Microsoft-krallt-sich-Zugangsdaten-Achtung-vorm-neuen-Outlook-9357691.html https://www.heise.de/news/Microsoft-krallt-sich-Zugangsdaten... And here is the picture that shows what they have captured is sent to Microsoft: https://heise.cloudimg.io/v7/_www-heise-de_/imgs/18/4/3/3/1/0/1/1/01-Traffic_Mitschnitt-330ad3a100639b8c.png?q=85&width=1887 https://heise.cloudimg.io/v7/_www-heise-de_/imgs/18/4/3/3/1/...
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- hulitu 3y agoTarget ? They are very happy to share your data with 3 letter agencies. You are the target. They are the dealers.
- deleted 3y ago[deleted]
- martinald 3y ago"Although TLS protected, the data in the tunnel runs to Microsoft in plain text". What? Not sure if this is a mistranslation but this makes absolutely no sense. TLS is encryption. Why would they further encrypt it "in the tunnel"?
- Fischgericht 3y agoWhat they are talking about is that your passwords are uploaded via HTTPS/TLS, so an encrypted connection, but what they are sending are you full passwords in plain text over it. https://heise.cloudimg.io/v7/_www-heise-de_/imgs/18/4/3/3/1/0/1/1/01-Traffic_Mitschnitt-330ad3a100639b8c.png?force_format=avif%2Cwebp%2Cjpeg&org_if_sml=1&q=85&width=610 https://heise.cloudimg.io/v7/_www-heise-de_/imgs/18/4/3/3/1/...
- quietbritishjim 3y agoFor IMAP to work you need the original password, not e.g. a hash. Once you've decided to send the actual password, whether wise or not, the best you can do is encrypt it, and TLS does that. What else would you expect?
- nhinck2 3y agoI would expect Microsoft not to be on the receiving end of my plaintext password.
- Fischgericht 3y agoTLS is only transport encryption. The password will be transmitted in clear before and and after that transport. This is not at all comparable to other "store my passwords inside the cloud"-systems, where the passwords are encrypted and decrypted on the users' devices, without the encryption key going to the cloud provider - that's the way it's handled in Password Managers, Chrome Auto-Fill etc. And I would expect Microsoft asking the user for explicit consent "May we take your IMAP password and transfer it and store it in our cloud?" in easy to understand wording so people understand the consequences (for example getting fired for having punched a gapping hole into your employers security policies like "Don't share this password with anyone") That expectation would match the law in the EU. And in addition, inside the EU it would also have to guarantee that the password will only be stored on servers inside the EU, and not end up, for example, with the NSA. And even then it still might not be legal. And from a user's perspective: Certainly a big chunk of users that have been using email software for the last decades would assume that an email client installed on your PC is doing the IMAP access locally. There is no need for your IMAP credentials to go to Microsoft. Merging your local mail store from multiple sources inside the client is what email clients have been doing for the last 20 years. There is absolutely no need to move this to the cloud. Yes, my computer can handle merging email folders.
- Fischgericht 3y agoI have now translated it as a PDF using Deepl. Much better translation, and you can see the images, too: https://www.scamp.de/stuff/heise_windows_outlook_stealing_imap_passwords_20231110.pdf https://www.scamp.de/stuff/heise_windows_outlook_stealing_im...
- derkades 3y agoA translation by the original source is now available: https://www.heise.de/news/Microsoft-lays-hands-on-login-data-Beware-of-the-new-Outlook-9358925.html https://www.heise.de/news/Microsoft-lays-hands-on-login-data...
- tuetuopay 3y agothanks. with the screenshot of the json payload it's quite frightening and explicit. they did not even try to conceal it...
- wkat4242 3y agoI'm not surprised to be honest because the 'new' outlook is simply the old office 365 version of Outlook Web Access in an element wrapper. They don't seem to have added local storage or local imap support but they simply sync your mail into their cloud instead. I wouldn't be surprised if this is a ploy to offer users a 'migration' to a paid office 365 subscription later. The old windows mail was ok even though it wasn't very full featured.
- nolok 3y agoI can't wait for a "Mail" app that can't be properly removed, and keep restarting itself with the computer just to nag you to upgrade from the tray, like they did with One Drive.
- j-bos 3y agoDon't wait, leave. Get on an OS that serves you.
- boppo1 3y agoThis. I hardly understand Linux but I tentatively switched to xubuntu in 2017. Ever since, I only boot windows once every 3-6 months for some proprietary software. It's an amazing feeling when your OS isn't insisting left and right on behavior you don't want.
- rft 3y ago> It's an amazing feeling when your OS isn't insisting left and right on behavior you don't want. Yepp, I get this confirmed every so often when I need to boot/install Windows. I will not deny Linux has issues, but so far these issues could be solved or at least worked around. They can be frustrating at times, but at least they tickle the problem solving and learning part of my brain instead of the part reserved for unreasonable anger.
- Aerbil313 3y agoAnd an advice for anyone new to Linux: Use KDE Plasma (preferably Kubuntu or Debian). Afaict they are the future of Linux (on desktop and mobile) and already better than Windows on desktop. Better in all 3 ways: grandma-friendliness, for corporate/academic/work and for the power-user. Literally only 2 things lacking right now is those 3 last game titles left which can’t run via Steam/Lutris and those corporate Windows apps which I prefer to run in a VM (virt-manager).
- Kim_Bruning 3y agoThis could become a bit of an issue. There's a reason why you're using IMAP in the first place, typically. Hopefully this doesn't apply to eg. Outlook365 as well.
- Enderboi 3y agoAs an email host... I've been turning New Outlook off for clients for weeks trying to explain this. Apart from the security issues, it's also very annoying to have to explain that I can't actually troubleshoot any IMAP connectivity issues when your machine isn't the one thats actually making the connection. Now we've been internally discussing whether we should just firewall off whatever Azure ranges are connecting to our IMAP backend servers and intentionally "break" the functionality. Not my first choice, but users keep seeing the "New" toggle and turning it on, causing all sorts of other uncontrolled chaos! Cloud-first, in all the wrong ways. It's supposed to be a local app..
- neycoda 3y agoSounds like a government-requested "feature".
- Fischgericht 3y agoSpot on. I am a bit puzzled that I have not been reading about this in any big US media, not even IT ones. How did you first learn about it? This IS a big deal and should be a scandal people are educated about, and Microsoft should be forced to stop this immediately. It's interesting that Microsoft appears to have managed to stay under the radar with these deceptive tactics...
- Enderboi 3y agoWe first discovered this while troubleshooting why we were receiving logins with an old password.. after updating the settings in Outlook. They had no other email clients, but the 'New Outlook' didn't actually send the updated password to the Microsoft cloud due to a bug :P Imagine my surprise discovering that this little banner in their Outlook settings that said "Using Microsoft sync technology" actually means "This is no longer really a local IMAP client".
- hulitu 3y ago> I am a bit puzzled that I have not been reading about this in any big US media, not even IT ones. How did you first learn about it? If Microsoft has the power to pay the EU for laws in its favour, i presume (i am actually sure see "die Welt") that paying some newspapers poses no big logistical problems.
- deafpolygon 3y agoTurns out, if you are using an Oauth2 backed service (G-mail) or something like iCloud - then you are fine. It's only for local IMAP accounts (think: your ISP email account) where you type the password directly into the settings that Microsoft is doing this. Doesn't make this any better- but before you worry that MS has your Google account password, they don't.
- whoopdedo 3y agoNo, they only have a Oauth bearer token that lets them impersonate you to the IMAP server. But it's not your password so that's cool, right?
- mrweasel 3y agoFor Google and Apple at least, wouldn't you get a message saying that a new device has attempted to connect, asking you to confirm?
- mschuster91 3y agoNo. The dirty secret is that OAuth tokens, JWTs and whatnot are just as bad as passwords and cookies in terms of credential theft, the difference is only in built-in expiration and scope.
- mrweasel 3y agoBut would you not get a "A new device has accessed your account" warning? Or it that skipped because the token is already validated?
- mschuster91 3y agoNo. A bearer token (which almost all credentials are) doesn't say anything about the device that is using it. The sole exception are tokens tied to a device's HSM (TPM, Secure Enclave, TrustZone, ...) - you can't clone these onto another device. ETA: to expand a bit... passwords, SSL client certificates, JWTs, tokens generated after a SAML assertion, they are all fungible bearer tokens. A server has no way of verifying if what is presented to him is originating as an intentional act of a user, or if a malicious third party has duplicated the token somehow and is using it from somewhere else. An attacker can act just the same as the user themselves can. A HSM-backed token, i.e. having the server send a preflight challenge value, and the client HSM signing that challenge together with the token to send back with the actual request, at least proves that the request originated from the device expected to be in control of the user. However, such a scheme comes at a high cost - the user needs to be in possession of a capable device, the HSM needs to be secure, and doing preflight requests to obtain the challenge adds considerable latency.
- rrrix1 3y agoMy magic crystal ball just showed me that they're going to use your email for training AI models. They're just trying to catch up with Google in any and every way they possibly can, users trust, privacy and security be damned.
- mcint 3y agoCatch up? This is an attempt to re-claim, or solidify, monopoly.
- steve1977 3y agoI don’t know about this. Microsoft would already have a huge body of e-mail to train on with Microsoft 365 and outlook.com if they wanted to I guess?
- integricho 3y agoYes, but mostly internal corporate emails, stretching back decades, with most of the content about how to violate user privacy using various sneaky schemes. I wonder what kind of A.I. would result from training on such content.
- alt227 3y agoMicrosoft have run hotmail/outlook.com for decades.This is a service used by hundreds of millions of people, I would guess mostly non corporate. I think they have more than enough personal email data to train on if they wanted to.
- steve1977 3y agoThis. I would gather it’s one of the bigger free mail services after Gmail, at least in the western world.
- steve1977 3y agoI mean the mails of all their Microsoft 365 customers. Which at least where I live is the majority of all businesses.
- NOWHERE_ 3y agoWithout google translate (german): https://www.heise.de/news/Microsoft-krallt-sich-Zugangsdaten-Achtung-vorm-neuen-Outlook-9357691.html https://www.heise.de/news/Microsoft-krallt-sich-Zugangsdaten...
- randunel 3y agoI've had all my Google Translate posts taken down with the ask to post it in the original language, but this one somehow stays up. Mysterious are the ways of the mods.
- yorwba 3y agoThe mods need to sleep sometimes.
- randunel 3y agoI'm fairly certain they're on different timezones and a 9h span with a front page link has been noticed by several.
- yorwba 3y agoI'm fairly certain they're all in the US and this post has been on the front page for only a little more than an hour: https://hnrankings.info/38212453/ https://hnrankings.info/38212453/
- Fischgericht 3y agoWasn't aware of this rule, has been one of my first submissions. If any mod wants to modify... Original is: https://www.heise.de/news/Microsoft-krallt-sich-Zugangsdaten-Achtung-vorm-neuen-Outlook-9357691.html https://www.heise.de/news/Microsoft-krallt-sich-Zugangsdaten... Deepl-Translated PDF version: https://www.scamp.de/stuff/heise_windows_outlook_stealing_imap_passwords_20231110.pdf https://www.scamp.de/stuff/heise_windows_outlook_stealing_im...
- vasdae 3y agoIt is not stealing anything because you get a dialog asking you for permission to do it. If you give someone permission to take something, they are not stealing it. https://heise.cloudimg.io/v7/_www-heise-de_/imgs/18/4/3/3/1/0/1/1/outlook-warnung-e147ccf7fd4368f4.png https://heise.cloudimg.io/v7/_www-heise-de_/imgs/18/4/3/3/1/...
- logifail 3y ago> It is not stealing anything because you get a dialog asking you for permission to do it That dialog talks about sync but notably does not mention credentials at all. Surely this is instance where informed consent is needed, with full disclosure of what's going to happen. Something along the lines of: "this means your IMAP username and password will be passed to Microsoft where we will store it indefinitely so we can regularly log into your IMAP server to sync your messages". Of course, users are less likely to consent if you explain exactly what's going to happen...
- oaiey 3y ago[flagged]
- zelphirkalt 3y agoI am not so sure about that. Are they allowed to simply assume "expert" knowledge?
- c4mpute 3y agoNo, they are not. GDPR notices (which this is) must be understandable to the layman. Including all consequences like "this will also allow access to other services secured with the same university/company-wide password". This could also be a punishable crime in Germany: https://www.gesetze-im-internet.de/stgb/__202c.html https://www.gesetze-im-internet.de/stgb/__202c.html and other articles around that one.
- 3y ago
- einr 3y ago1. Embrace (Sure, Outlook supports SMTP and IMAP! Kinda.) 2. Extend (New Outlook supports IMAP, but only in the sense that we copy all your stuff to our Cloud) <--- We are here 3. Extinguish (We are deprecating support for legacy e-mail protocols, but it's okay because all your old stuff is in M365 anyway) The dream of decentralized e-mail based on open standards is dead.
- varispeed 3y agoWait for "Microsoft would never!" brigade...
- oblio 3y agoNo, it's just that the Halloween Documents are now obsolete, not because Microsoft is kind. It's because there are newer and better sharks out there, and you guys haven't caught up to the last 1-2 decades. For example: https://www.demandsage.com/gmail-statistics/ https://www.demandsage.com/gmail-statistics/
- HPsquared 3y agoFunny how all the antitrust stuff melted away in recent years. It's almost as if the parties involved see that their interests are aligned.
- contravariant 3y agoI mean it's easy to claim your actions don't hurt your competitors when you haven't got any.
- danaris 3y agoThe antitrust "stuff" disappeared very quickly, 23 years ago, when George W Bush was elected President and his administration wasted no time in stopping the imminent harsh ruling against Microsoft in its antitrust trial, giving them barely a slap on the wrist, compared to the much stronger penalties they were undoubtedly facing (it was not at all unrealistic at that point to be expecting them to be broken up in some way). Recently, Biden's administration has started changing the federal tune on antitrust, formally rejecting the intellectually and morally bankrupt Chicago School interpretation that has hobbled all antitrust efforts for decades. That's why we're starting to see some real antitrust cases again.
- sampa 3y agojust one word: Linux
- glimshe 3y agoI only use Knock-OutLook for Microsoft accounts. They have my password already, so no lost security there. Synchronizing email accounts is useful, but I never thought worth the hassle before or after Outlook.
- reddalo 3y agoWhat's left now, for Windows users? I think the only solution is Thunderbird
- KronisLV 3y ago> I think the only solution is Thunderbird Some while ago, there was a bit of backlash over their re-design, but after actually using the more recent versions, I have to say that they did a good job - you can toggle the display density of the UI elements and it's still a good mail client with reasonable performance and usability. I can even sign e-mails with OpenPGP and did you know that it also has a built in RSS feed reader (a bit clunky, but having news sites/blogs be a folder that's right next to my e-mail accounts works brilliantly well)? In addition, I have it both on my Windows and Linux machines, surprisingly consistent across the board. Honestly, I couldn't be happier. Maybe also Roundcube hosted on VPSes for my own development mail servers when I don't feel like adding bunches of accounts to Thunderbird, but it's really nice that there's software like this out there in the first place!
- soco 3y agoMy favorite RSS reader is Feedbro in Firefox, maybe on the minimal side but exactly what I need.
- greyface- 3y agoPuTTY + Mutt? :)
- jkaplowitz 3y agoI’ve done myself over the years. :) Windows now directly offers OpenSSH and a decent modern terminal app, so while PuTTY still works it’s no longer necessary for accessing mutt over SSH from Windows. Also with WSL you can also run mutt locally on Windows within a userland Linux distro like Ubuntu or Debian.
- alt227 3y ago
- chinathrow 3y agoWho on earth approved something like this at Microsoft?
- timbit42 3y agoNadella.
- flower-giraffe 3y agoWhen combined with the rate limiting on 365 email api and ultimately removing imap access this seems like a strategic goal to capture our data. The dark patterns pushing content to one drive from office apps and web access opening attachments and keeping them in one drive is another example of this data grab. It’s an example of shareholder value trumping customer value, the primary purpose of cloud is to make you pay more without having to provide more in return.
- vladvasiliu 3y ago> When combined with the rate limiting on 365 email api and ultimately removing imap access this seems like a strategic goal to capture our data. While I agree with your other points, I'm not sure how this one works. If you're using Office365, you're already having your mail at least go through their servers. What difference does IMAP make to their snooping intentions?
- tremon 3y agoThis attack targets people's personal accounts. Many people have Office 365 because their work requires it, so they have to use the Outlook app for that. So if those people then choose to add their personal account to the same mail client, Microsoft can also snoop on the private correspondence of their captive corporate audience.
- trelane 3y ago> seems like a strategic goal to capture our data. Sure is good they're not an ad company then. /s
- 2devnull 3y agoThe majority seems to like one-drive. In theory having everything in one place sounds great. Few people think long term. Customer value trumps customer value if you ask me. IT departments and clueless users love MSFT and that will never change. Embrace it.
- pronoiac 3y agoIf you have large mailboxes, this would steer you toward paying for cloud storage at Microsoft, which might be a surprising bill to face.
- znpy 3y agoHow is that remotely even legal? That's actively malicious behavior.
- hulitu 3y agoIf you pay the right people, it is legal.
- WhereIsTheTruth 3y agoMicrosoft is allowed to do whatever it wants with impunity, including stealing your password and tunneling back to their servers in plain text Wow, just wow
- phendrenad2 3y agoIt's not plain text, it's encrypted via TLS
- gmueckl 3y agoWell, two counter-points: 1. their TLS implementation isn't secured against MitM attacks. 2. They receive the the full plain text password, not a a hash. Not sure if it's apparent from the English version of the article, but Heise performed a successful MitM attack to extract the plain text password from the daa stream.
- mynameisvlad 3y agoWhat use would a hash of the password be when the purpose is to log in as the user?
- emayljames 3y agoit is not a hash
- timbit42 3y agoThey didn't say it was. They were asking what use a hash would be.
- stevemk14ebr 3y agoYou're correct it's necessary for how they use this, to impersonate a user and 'clone' their email data. But then, that is the problem, they shouldn't be able to do this at all.
- N19PEDL2 3y agoI installed the new Outlook just a few days ago and I almost immediately started to receive emails like "I recorded you, pay or I'll share your files with everyone" on my customized email address. I thought it was a coincidence but now I am beginning to have doubts.
- secondcoming 3y agoApple has also started to try to get users to switch to their Mail app, at least on iPadOS. Every time I switch gmail accounts on the web UI in Chrome, I get a popup from Mail asking me to set the account up in Mail. I can't turn it off.
- Aerroon 3y agoDoes this mean the new Outlook is actual malware? It's literally stealing your password.
- hulitu 3y agoYes (technically). Just like OneDrive which is stealing your files. But if you write malware to steal passwords or steal files, you go to jail for computer crimes. If Microsoft (or FAANG) does it, it is business as usual because they pay legislators and law enforcement to close their eyes.
- yrro 3y agoIsn't this exactly what BlackBerry used to do? Privacy wise it's distasteful but it does work around a lot of IMAP's problems which still don't seem to have been fixed in the ~20 years that they've been known about...
- AshamedCaptain 3y agoThere are no such IMAP problems, at least ever since IDLE was a thing (which arguably you could argue may have not been a thing up until the 2010s, even if it's technically from the 2000s). It's just all political bullshit -- the same reason you can have decent IMAP clients on Android, but you can't on iOS (they have to resort to tricks like this), except if you're Apple.
- yrro 3y agoIsn't there still a limit of one watched mailbox per TCP connection?
- deaddodo 3y agoYes. But you're going to have a unique TCP connection per host, at minimum. Unless I'm misunderstanding the problem you're raising, it seems like a non-issue for the majority of people with multiple accounts (a work email, a Gmail, a hotmail; for instance).
- yrro 3y agoA unique connection per host isn't too bad. But I have 12 connections for each of my desktops and laptops and phones and tablets... As you say the problem is somewhat caused by Apple ~~and Google~~ forcing apps to use their proprietary notification systems so that e.g., mail can be checked while a phone is idling. But the end user does not care about the market abusing power of the monopolies--they wants instant notifications when they receive mail...
- deleted 3y ago
- febeling 3y agoYou wonder what needs to happen that would make people stop using Windows.
- switch007 3y agoShouldn't be too hard: 1. Remove it from schools so kids don't grow up used to it 2. Stop it being bundled with new PCs 3. Get companies to stop using Excel 4. Convince gaming companies to stop making first class support for games for Windows 5. Make all existing important software and games work just as well on Linux 6. Get NVIDIA to make Linux a first-class citizen
- deleted 3y ago[deleted]
- antx 3y agoSurely you are being sarcastic?
- lostmsu 3y agoThe only sarcasm there is the first line.
- hospitalJail 3y ago>3. Get companies to stop using Excel Libre Office is just... not there. Something is seriously wrong with it. Anyway, Linux Desktop is ready for the mainstream. I can typically get away with Google's suite for Office. All of my workflows work fine with Linux, and I have hobbies from 3D printing to electronics to writing to creative work.
- hellojesus 3y agoDo you have a non Excel recommendation for Linux? Excel is the one reason I use Windows other than games. I've tried Excel on OSX and hated it every time. Some of that is due to different key shortcuts; most of it is due to subpar functionality and performance. It may have changed; the last time I tried was over a decade ago.
- lifty 3y agoEverything will run in Azure and all apps will be web apps. You can count on that. This is a clear strategy from Nadella and I doubt anything will change his mind.
- lakpan 3y agoIt’s funny but anyone who’s ever used Gmail’s “Accounts” tab on its options page, has voluntarily given Google their passwords to keep forever. Now Microsoft wraps their web UI in a “native” app and everybody loses their mind. It’s hardly unusual for an internet-connected app to be at least partially run in the cloud in 2023. Much less unusual when it’s something related to MS365 and AI (one of the banner features of this new release)
- MereInterest 3y agoFalse equivalence. In one case, credentials are deliberately given for remote use. In the other case, credentials are expected to be used for a direct connection, but are instead taken for remote use. One is an explicit delegation, while the other is a man-in-the-middle attack.
- lakpan 3y agoI don’t think so. Remote or direct is only something we think about. The general user could not care less nor know the difference. Hardly a false equivalence.
- HumblyTossed 3y agoWhat's the difference between this and some of those other email apps like Spark?
- microflash 3y agoSpark does the same thing. Infact, many email clients do this, so you may want to read the fine print before using them.
- HumblyTossed 3y agoI know. That was my point. People are in an uproar, but I bet a lot of them use Spark, etc.
- pseudalopex 3y agoWhat formed your assumption? Many mentioned old Outlook, Microsoft's Mail, Apple's Mail, Thunderbird, Claws, mutt. You mentioned Spark.
- deleted 3y ago[deleted]
- _cenw 3y agoI filed a GDPR complaint regarding this when they released it on Mac, because it is not transparent what data Microsoft stores when you stop fetching email over their Exchange proxy. This was their response, after 3 months... • How long is mail data fetched from the non-Microsoft server retained? On 31st day of user inactivity we mark the account for removal. The account is soft deleted, and the data is purged within a week (approximately) after that. • What happens with an account that is no longer being used? Does the service continue fetching and “enhancing” mail data or does it happen on demand when a user opens Outlook? - If the user is not signing into the 3rd party accounts using outlook mobile, Teams for life or Outlook for Mac. We stop syncing any data after 7 days and mark the account for deletion after 30 days. • How do I know what data the service holds? - Service holds Mail, Calendar, contacts data and profile data for the user (User provides consent to collect this data during add account flow). • How can I make sure data is no longer retained? (e.g., does logging out from Outlook delete the mail data and credentials?) - When removing the account in Mac you can choose to "Sign Out On All Devices" which deletes the mailbox from the Microsoft Cloud (Exchange-backed mailbox where the third-party account is being synced). I also filed a complaint about not making it clear if data is required for processing (Article 13, Section 2(e) [1]) - but the supervisory authority ignored me on that one. [1]: https://gdpr-info.eu/art-13-gdpr/ https://gdpr-info.eu/art-13-gdpr/
- dewey 3y agoI thought that's what every email provider does? Fastmail has the same feature where you can provide your credentials and they'll fetch the emails from other providers for you.
- jeroenhd 3y agoMany webmail services offer this, but the difference is that the Windows program is a local program, not a cloud service. The Outlook app for Android does the exact same thing, copying your email to the Microsoft cloud and then serving the emails to your phone from Microsoft's servers.
- dewey 3y ago> Many webmail services offer this, but the difference is that the Windows program is a local program, not a cloud service. Is it really? The comments on the original Heise article mention that Heise actually misunderstood it and it's basically just a link to the web interface in the task bar so it's not a local app.
- jeroenhd 3y agoI can't see any indication that it's actually a web interface in Microsoft's announcement. Looking at the Microsoft Store entry (https://apps.microsoft.com/detail/outlook-for-windows/9NRX63209R7B?hl=en-US&gl=US https://apps.microsoft.com/detail/outlook-for-windows/9NRX63...) I don't really see any indication of it being a web app either. Maybe they're hiding their web app Electron/Tauri style, but I would certainly expect it to be local-only based on the way it's advertised and designed.
- iinnPP 3y agoThe difference here seems to be transparency.
- matrss 3y agoIf I instruct fastmail or another provider to fetch mail from a different email provider on my behalf so that I have it in one place then that is a deliberate decision I make. If I connect to my mail provider via IMAP/SMTP from a local application (Outlook, Thunderbird, mutt or whatever) I do not expect my credentials to be exfiltrated to a third party so that they can also fetch my mail. In fact, I would consider that to be criminal behavior if not VERY clearly communicated, with all it's implications.
- reportgunner 3y agoSorry I can't read german but do I understand properly that you give your gmail password to outlook (microsoft) and you are surprised that outlook does whatever it likes with the password ?
- dugite-code 3y agoI think it's a surprise that that password is going off device. The default mail app traditionaly and sensibly is a local only client and and "sync" features have not behaved in this fashion in the past.
- bradley13 3y agoThis is the horrifying core issue: "When creating an IMAP account, c't was able to record that the target server, login name and password were being transferred to Microsoft's server. Although TLS protected, the data in the tunnel runs to Microsoft in plain text. Without informing or asking, Microsoft grants itself full access to the IMAP and SMTP access data of users of the new Outlook." To be clear: this is for accounts not hosted on Microsoft servers. They likely copy all of your existing mails to their servers, and any future mails sent or received also run through their servers.
- singularity2001 3y agoHow is that not a $1 billion fine under European law?
- paganel 3y agoBecause Europe heavily depends on the US for its defense and because most of MS is by now an extension of the US establishment from a strategic pov (the dividends and the profits still go to MS’s private investors, many of them Americans, but that’s not what the US establishment is really after)
- berkes 3y agoNo. Because it's still early. It quite probably will turn out to be fined. Let's wait (for months or years).
- paganel 3y agoIf anything, the fine would be at most a symbolic gesture. Just think how would hell have broken loose if the same practice had been carried out by a Chinese company or even by a Russian one (such as Kaspersky, let's say).
- matrss 3y agoThis shouldn't be just a fine. They exfiltrate a users credentials for another service without explicit consent and intercept a confidential communication channel between the user and their mail provider. This is straight up criminal behavior and should lead to jail time for the responsible person.
- 29athrowaway 3y agoNot to mention that Microsoft authenticator seems to be required now.
- dinckelman 3y agoTo call the "new" Outlook a horrible piece of software, would be an insult to actually horrible pieces of software. They're one tier below that, wherever that is. The fact that this is acceptable, in their narrow minds, is insane
- thiht 3y agoI wonder if Microsoft execs themselves use this crap, and what they think of it
- ofslidingfeet 3y agoWhat do you call an economy where the central establishment keeps stubbornly giving consumers things they don't want?
- ActionHank 3y agoHow else are they supposed to get your emails to train their ai models?
- Anthony_JT 3y agogo back to Windows 10 Buy MS Office. No to O365
- hulitu 3y agoWhy do you think Win 10 is better ? It has the same Outlook.