3 ms·

No, they only have a Oauth bearer token that lets them impersonate you to the IMAP server. But it's not your password so that's cool, right?

mrweasel 3y ago
For Google and Apple at least, wouldn't you get a message saying that a new device has attempted to connect, asking you to confirm?
- mschuster91 3y ago
  No. The dirty secret is that OAuth tokens, JWTs and whatnot are just as bad as passwords and cookies in terms of credential theft, the difference is only in built-in expiration and scope.
  - mrweasel 3y ago
    But would you not get a "A new device has accessed your account" warning? Or it that skipped because the token is already validated?
    - mschuster91 3y ago
      No. A bearer token (which almost all credentials are) doesn't say anything about the device that is using it. The sole exception are tokens tied to a device's HSM (TPM, Secure Enclave, TrustZone, ...) - you can't clone these onto another device. ETA: to expand a bit... passwords, SSL client certificates, JWTs, tokens generated after a SAML assertion, they are all fungible bearer tokens. A server has no way of verifying if what is presented to him is originating as an intentional act of a user, or if a malicious third party has duplicated the token somehow and is using it from somewhere else. An attacker can act just the same as the user themselves can. A HSM-backed token, i.e. having the server send a preflight challenge value, and the client HSM signing that challenge together with the token to send back with the actual request, at least proves that the request originated from the device expected to be in control of the user. However, such a scheme comes at a high cost - the user needs to be in possession of a capable device, the HSM needs to be secure, and doing preflight requests to obtain the challenge adds considerable latency.
    - dist-epoch 3y ago
      I didn't get such warning when I connected Outlook to my Gmail. But I had to click accept on the Google form requesting my permission to grant Outlook access. So I was informed when the app was connected. I'm not sure how you would count "new device", since that token is going to be used by a random Microsoft cloud server, potentially different every time.
dist-epoch 3y ago
So just like every other connected app, right? How are they supposed to access the emails without some sort of token?
- hellojesus 3y ago
  Wouldn't it just use the credential from client to directly connect to the service instead of going client->msft->server? You need a token to authenticate, but the client software (Microsoft here) doesn't ever need to send that data to themselves to successfully auth. Sending themselves the auth credentials does allow them to then use it on their servers in ways that your client device may not want to (e.g., excessive battery drain) or can do (loss of network). But it then also allows them full access anytime they want and complete control of your data for whatever they want.
  - dist-epoch 3y ago
    > But it then also allows them full access anytime they want and complete control of your data for whatever they want. 95% of people use webmails from Google, Microsoft or Yahoo. They already have complete control. Sure, Microsoft should make it much more clear what is going on with the passwords and cloud email, but all things considered, nothing really changed for 95% of people. And if you don't trust Microsoft with your email, but are using this Microsoft mail app on Microsoft Windows, well, that's again weird.

mrweasel 3y ago

For Google and Apple at least, wouldn't you get a message saying that a new device has attempted to connect, asking you to confirm?

mschuster91 3y ago
No. The dirty secret is that OAuth tokens, JWTs and whatnot are just as bad as passwords and cookies in terms of credential theft, the difference is only in built-in expiration and scope.
- mrweasel 3y ago
  But would you not get a "A new device has accessed your account" warning? Or it that skipped because the token is already validated?
  - mschuster91 3y ago
    No. A bearer token (which almost all credentials are) doesn't say anything about the device that is using it. The sole exception are tokens tied to a device's HSM (TPM, Secure Enclave, TrustZone, ...) - you can't clone these onto another device. ETA: to expand a bit... passwords, SSL client certificates, JWTs, tokens generated after a SAML assertion, they are all fungible bearer tokens. A server has no way of verifying if what is presented to him is originating as an intentional act of a user, or if a malicious third party has duplicated the token somehow and is using it from somewhere else. An attacker can act just the same as the user themselves can. A HSM-backed token, i.e. having the server send a preflight challenge value, and the client HSM signing that challenge together with the token to send back with the actual request, at least proves that the request originated from the device expected to be in control of the user. However, such a scheme comes at a high cost - the user needs to be in possession of a capable device, the HSM needs to be secure, and doing preflight requests to obtain the challenge adds considerable latency.
  - dist-epoch 3y ago
    I didn't get such warning when I connected Outlook to my Gmail. But I had to click accept on the Google form requesting my permission to grant Outlook access. So I was informed when the app was connected. I'm not sure how you would count "new device", since that token is going to be used by a random Microsoft cloud server, potentially different every time.

dist-epoch 3y ago

So just like every other connected app, right? How are they supposed to access the emails without some sort of token?

hellojesus 3y ago
Wouldn't it just use the credential from client to directly connect to the service instead of going client->msft->server? You need a token to authenticate, but the client software (Microsoft here) doesn't ever need to send that data to themselves to successfully auth. Sending themselves the auth credentials does allow them to then use it on their servers in ways that your client device may not want to (e.g., excessive battery drain) or can do (loss of network). But it then also allows them full access anytime they want and complete control of your data for whatever they want.
- dist-epoch 3y ago
  > But it then also allows them full access anytime they want and complete control of your data for whatever they want. 95% of people use webmails from Google, Microsoft or Yahoo. They already have complete control. Sure, Microsoft should make it much more clear what is going on with the passwords and cloud email, but all things considered, nothing really changed for 95% of people. And if you don't trust Microsoft with your email, but are using this Microsoft mail app on Microsoft Windows, well, that's again weird.