3 ms·

I wonder how long this will work? If I was Google, I'd think about banning IMAP logins from the Azure servers that are doing this syncing.

wannacboatmovie 3y ago
That's rich, considering Google invented email credential harvesting.
cma 3y ago
Google won't let you backup any parts of your phone without sending them your private wifi key.
olyjohn 3y ago
The already call IMAP an inscure, outdated service. So when you enable it, they will disable it for you after so many days whether you want them to or not.
- vasdae 3y ago
  That is false.
- andix 3y ago
  I think it really is a security issue to some extent, because it doesn't support multi factor authentication. For most services email is the master key to reset your password. By getting access to someone's email account a lot of other accounts can be breached easily. I try to disable password reset via email wherever possible. But most services don't provide this option. I think it would be time for IMAP to get a standardized way to log in via OAuth2/OIDC. And maybe an update to the email standard to mark a recovery links or codes as secret, that require 2FA every time to read. Especially dangerous are servers that still allow using IMAP without TLS, that's just asking for trouble.
jkaplowitz 3y ago
It uses OAuth2 rather than IMAP for Google accounts, as per Heise's German-language reporting which was previously linked in HN (I haven't yet checked their English-language article). So the Google account password doesn't get sent to Microsoft servers or stored locally or anything, as it does with a regular IMAP account. Microsoft stores an OAuth2 access token for these accounts, which is still unnecessary compared to the locally synced version of Outlook we're all used to, but the user can revoke it through Google account settings at any time, just like any other OAuth2 access token.

wannacboatmovie 3y ago

That's rich, considering Google invented email credential harvesting.

cma 3y ago

Google won't let you backup any parts of your phone without sending them your private wifi key.

olyjohn 3y ago

The already call IMAP an inscure, outdated service. So when you enable it, they will disable it for you after so many days whether you want them to or not.

vasdae 3y ago
That is false.
andix 3y ago
I think it really is a security issue to some extent, because it doesn't support multi factor authentication. For most services email is the master key to reset your password. By getting access to someone's email account a lot of other accounts can be breached easily. I try to disable password reset via email wherever possible. But most services don't provide this option. I think it would be time for IMAP to get a standardized way to log in via OAuth2/OIDC. And maybe an update to the email standard to mark a recovery links or codes as secret, that require 2FA every time to read. Especially dangerous are servers that still allow using IMAP without TLS, that's just asking for trouble.

jkaplowitz 3y ago

It uses OAuth2 rather than IMAP for Google accounts, as per Heise's German-language reporting which was previously linked in HN (I haven't yet checked their English-language article). So the Google account password doesn't get sent to Microsoft servers or stored locally or anything, as it does with a regular IMAP account. Microsoft stores an OAuth2 access token for these accounts, which is still unnecessary compared to the locally synced version of Outlook we're all used to, but the user can revoke it through Google account settings at any time, just like any other OAuth2 access token.