5 ms·
> Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel. Although encrypted, the data is unencrypted when you decrypt it! They
by wannacboatmovie 3y ago
> Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel.
Although encrypted, the data is unencrypted when you decrypt it!
They should at least add double ROT-13...
Did whoever wrote this realize you need to be able to recover the cleartext for this to even work?
- fifteen1506 3y agoThe problem is Microsoft using its servers as the middle man, without fair warning. Not what you mentioned.
- wannacboatmovie 3y agoYou're right it's totally different when Google does the same thing with Gmail.
- blkhawk 3y agoFor GMail people set that up deliberately Outlook pretends to be a desktop app.
- wannacboatmovie 3y agoThe kids call these Progressive Web Apps and half the posters here were complicit in developing the technology.
- Etheryte 3y agoI think you're wildly overestimating how much deliberation or thought the average Gmail user has put into any of these topics outside of "free email, neat".
- MereInterest 3y agoThe difference between Gmail's IMAP setup and this new Outlook IMAP behavior is the same difference between borrowing a friend's car and stealing a friend's car. In both cases, you're driving a car that doesn't belong to you. The difference is whether you have permission to be driving that car. Both Gmail and Outlook are receiving passwords, then using those to perform IMAP requests from their servers. The difference is that Gmail had permission to do so, while Outlook did not.
- lstamour 3y ago“If you are trying to login to IMAP hosted by Google or Fastmail, why should Microsoft need to be contacted let alone given the password?” is how I read the article… Now, I know the answer is so that you can have push notifications sent to your mobile phone with every IMAP poll Microsoft does on your behalf, but that’s because the architecture of the new Outlook app likely borrows features of the Accompli mobile app they bought and maintained as Outlook mobile. That the desktop app re-uses the same APIs as the mobile app rather than process mail locally makes sense from a code reuse and efficiency standpoint, but really only because your accounts can seamlessly carry over to all your devices. It’s arguable that the distinction between keeping your password in the cloud and keeping your password local is a security risk. However, if you previously used Outlook.com to check your IMAP email, and maybe this is where the feature derives from, then you already provided your IMAP password to Microsoft on the web. Likewise Google for importing IMAP to Gmail. We do this because it is nicer to get one inbox and one push notification across multiple accounts - when we want cloud providers checking emails for us. It is less clear why a desktop app would do this unless you opted in to fancier service of some kind - e.g. viewing emails on the web when not at this device, or push notifications to your mobile phone, etc. If Microsoft wanted to read your emails even with a locally stored and never shared IMAP password, they could still send telemetry derived from the local client to build an advertising profile based on local emails, or to display targeted ads. They don’t technically need your password to read your emails if you are using their email client.
- deleted 3y ago[deleted]
- Retric 3y agoThe concern is someone logging into Gmail is sending plain text passwords and email contents to Microsoft. That’s why sending plain text passwords over an encrypted channel is a concern. It would be fine if Outlook was backing up encrypted data and then not sending the decryption key to Microsoft servers.
- babypuncher 3y agoThe question is, why does Microsoft need your Gmail password at all to begin with? Thunderbird works perfectly fine with Gmail without sending Mozilla your password.
- jabroni_salad 3y agoBecause their MUA is a website now instead of a desktop application. tbird is still a desktop application.
- deleted 3y ago[deleted]
- Cu3PO42 3y agoIt is conceivable that they wanted to express "although encrypted in transit, it is not hashed and Microsoft can recover the full password". However, you'd have to be very charitable to interpret the articale like that. This is not a translation error either. The same mistake can be found in the German original. > Did whoever write this realize you need to be able to recover the cleartext for this to even work? The first author of the article has a degree in 'commercial information technology' and has worked as a sysadmin, so I assume they do understand that this is necessary, they may just have done a bad job of expressing that. An article in a technical outlet should still do better in such regards.
- wannacboatmovie 3y agoWait till they find out credit card numbers are not hashed and salted before being transmitted to a merchant over TLS.
- MereInterest 3y agoIt's to distinguish this behavior from password managers. Here, the message is sent to Microsoft in an encrypted form, but Microsoft can decrypt it to access the underlying password. For password managers, the remote server receives a password in an encrypted form, and cannot decrypt it to access the underlying password. It could have been phrased better, but the clear message is that Microsoft has pilfered access to unencrypted passwords, regardless of any transportation-level encryption.