4 ms·

It sounds like the new Outlook is a thin wrapper around the cloud version, so the IMAP sync happens in the cloud, not locally. I wonder how MS is supposed to do

by hnbad 3y ago

It sounds like the new Outlook is a thin wrapper around the cloud version, so the IMAP sync happens in the cloud, not locally. I wonder how MS is supposed to do this without having the remote IMAP password transmitted to the cloud version of Outlook. This sounds less like "Microsoft steals your data" and more like "Microsoft replaced Desktop Outlook with OWA".

chx 3y ago
ssshhh non-inflammatory common sense replies have no place in a Microsoft hate discussion
graypegg 3y ago
That’s true! But isn’t having that sort of access to your non-Microsoft email account a second order effect of the change to a OWA? A lot of users are being shown the “new outlook!” toggle and are trained to just assume updated = safer. They’re not really communicating the effect it has, even if it’s just a change from a desktop app to a bundled web app.
boxed 3y ago
It's going to be a problem when some people end up murdered because their credentials leaked through this thing.
- hnbad 3y ago
  Sorry, I think you'll need to walk me through this step-by-step. 1. User enters their IMAP credentials into desktop web app. 2. Web app transmits credentials to the backend where it is used to sync e-mails between Azure and third-party IMAP server. 3. Somehow the credentials leak to some untrusted third party. 4. User is murdered. This feels like some rather important steps were skipped. If your threat scenarios include "being murdered because someone got access to my e-mail account", yeah, maybe just use Thunderbird to begin with.
mrweasel 3y ago
So you can't read your email if outlook.com is down, or Microsofts authentication backend?
cmiles74 3y ago
This also strikes me as pretty bad. The application that New Outlook is replacing was more of a regular IMAP client and managed mail locally, making this new behavior a big departure. Also: how long does Microsoft expect this to work? If I was Google, I'd think about banning IMAP logins from the Azure servers that are doing this syncing.

by hnbad 3y ago

chx 3y ago

ssshhh non-inflammatory common sense replies have no place in a Microsoft hate discussion

graypegg 3y ago

That’s true! But isn’t having that sort of access to your non-Microsoft email account a second order effect of the change to a OWA? A lot of users are being shown the “new outlook!” toggle and are trained to just assume updated = safer. They’re not really communicating the effect it has, even if it’s just a change from a desktop app to a bundled web app.

boxed 3y ago

It's going to be a problem when some people end up murdered because their credentials leaked through this thing.

hnbad 3y ago
Sorry, I think you'll need to walk me through this step-by-step. 1. User enters their IMAP credentials into desktop web app. 2. Web app transmits credentials to the backend where it is used to sync e-mails between Azure and third-party IMAP server. 3. Somehow the credentials leak to some untrusted third party. 4. User is murdered. This feels like some rather important steps were skipped. If your threat scenarios include "being murdered because someone got access to my e-mail account", yeah, maybe just use Thunderbird to begin with.

mrweasel 3y ago

So you can't read your email if outlook.com is down, or Microsofts authentication backend?

cmiles74 3y ago

This also strikes me as pretty bad. The application that New Outlook is replacing was more of a regular IMAP client and managed mail locally, making this new behavior a big departure. Also: how long does Microsoft expect this to work? If I was Google, I'd think about banning IMAP logins from the Azure servers that are doing this syncing.