5 ms·
Microsoft is allowed to do whatever it wants with impunity, including stealing your password and tunneling back to their servers in plain text Wow, just wow
by WhereIsTheTruth 3y ago
Microsoft is allowed to do whatever it wants with impunity, including stealing your password and tunneling back to their servers in plain text
Wow, just wow
- phendrenad2 3y agoIt's not plain text, it's encrypted via TLS
- gmueckl 3y agoWell, two counter-points: 1. their TLS implementation isn't secured against MitM attacks. 2. They receive the the full plain text password, not a a hash. Not sure if it's apparent from the English version of the article, but Heise performed a successful MitM attack to extract the plain text password from the daa stream.
- mynameisvlad 3y agoWhat use would a hash of the password be when the purpose is to log in as the user?
- emayljames 3y agoit is not a hash
- timbit42 3y agoThey didn't say it was. They were asking what use a hash would be.
- stevemk14ebr 3y agoYou're correct it's necessary for how they use this, to impersonate a user and 'clone' their email data. But then, that is the problem, they shouldn't be able to do this at all.
- phendrenad2 3y agoOkay but the existence of a problem does not change the simple fact that it's encrypted. So many people arguing against this point out of some misguided sense of fuzzy logic.
- account42 3y agoGur rkpvfgrapr bs rapelcgvba qbrf abg punatr gur fvzcyr snpg gung jung gurl ner qbvat vf onq sbe frphevgl naq ubeevoyr sbe cevinpl.
- matrss 3y agoIt is encrypted in transit, but Microsoft is on the receiving end of that transit and gets the plain text password. The encryption does nothing to prevent the third party, that is Microsoft, from impersonating the user and reading all their mail.
- mynameisvlad 3y agoHow would a hashed password fix that problem?
- matrss 3y agoIt would make it harder for them to impersonate their users and read all their mail. I would still be concerned that they want to run a rainbow table attack against it though. They should not steal user credentials at all, because it is simply not necessary for a functioning email client.
- mynameisvlad 3y agoWhat? They would use the hashed password to login to the server, using something like XOAUTH2. That’s the point of the hashed password. It accomplishes nothing other than revocation, which can be done already by changing your password.