7 ms·
Oh wow, it posts your cleartext email credentials to an API endpoint called “/ows/beta/ShadowService/getShadowToken”. But it least it calls the password string
by this_steve_j 3y ago
Oh wow, it posts your cleartext email credentials to an API endpoint called “/ows/beta/ShadowService/getShadowToken”.
But it least it calls the password string a “Secret” in the JSON payload so you can REST assured knowing the Shadow Service agents will handle this data appropriately.
- beebmam 3y agoHow do you think login works for almost all network/web services? Very few do anything different. I wish they would, of course. Crypto/signature logins please!
- ric2b 3y agoThe thing is that this isn't logging in to your web server, it's just sending a copy of your password to Microsoft in plaintext.
- deleted 3y ago[deleted]
- nacs 3y agoIt's also comforting that the path says "beta" so you know your email credentials are being sent to a secure location.