5 ms·
What use would a hash of the password be when the purpose is to log in as the user?
by mynameisvlad 3y ago
What use would a hash of the password be when the purpose is to log in as the user?
- emayljames 3y agoit is not a hash
- timbit42 3y agoThey didn't say it was. They were asking what use a hash would be.
- stevemk14ebr 3y agoYou're correct it's necessary for how they use this, to impersonate a user and 'clone' their email data. But then, that is the problem, they shouldn't be able to do this at all.
- phendrenad2 3y agoOkay but the existence of a problem does not change the simple fact that it's encrypted. So many people arguing against this point out of some misguided sense of fuzzy logic.
- account42 3y agoGur rkpvfgrapr bs rapelcgvba qbrf abg punatr gur fvzcyr snpg gung jung gurl ner qbvat vf onq sbe frphevgl naq ubeevoyr sbe cevinpl.
- matrss 3y agoIt is encrypted in transit, but Microsoft is on the receiving end of that transit and gets the plain text password. The encryption does nothing to prevent the third party, that is Microsoft, from impersonating the user and reading all their mail.
- mynameisvlad 3y agoHow would a hashed password fix that problem?
- matrss 3y agoIt would make it harder for them to impersonate their users and read all their mail. I would still be concerned that they want to run a rainbow table attack against it though. They should not steal user credentials at all, because it is simply not necessary for a functioning email client.
- mynameisvlad 3y agoWhat? They would use the hashed password to login to the server, using something like XOAUTH2. That’s the point of the hashed password. It accomplishes nothing other than revocation, which can be done already by changing your password.
- matrss 3y agoWhat you are referring to is called an access token and has nothing to do with hashed passwords. A hashed password cannot be used directly to authenticate, otherwise it would not be a hashed password, but just a password (or access token, which is the same really). I don't understand how hashed passwords got into this discussion though. My point is that microsoft should have no way to authenticate as an outlook user against their third party mail provider without the user explicitly giving them permission to do so and what they do is strictly unnecessary to provide the functionality of an email client.
- gmueckl 3y agoIt's worse: anybody who can proxy the communication between Outlook and the MS servers can impersonate the user.
- matrss 3y ago