3 ms·

> Although this transfer is secured with Transport Layer Security (TLS), according to Heise Online, your IMAP and SMTP username and password are transmitted to

> Although this transfer is secured with Transport Layer Security (TLS), according to Heise Online, your IMAP and SMTP username and password are transmitted to Microsoft in plain text So like every login form in the world, which sends the username and password in plain text over SSL. This is pure FUD.

tambre 3y ago
But it isn't a password for Microsoft's services that's being sent. It's your username and password for another service you probably didn't intend Microsoft to have your credentials for. And it's intended.
- NoZebra120vClip 3y ago
  No, it's not. It's an OAUTH2 connection like a sane app. Proton is ostensibly lying about this credential setup. No app does that anymore.
  - snailmailman 3y ago
    Either way, Microsoft servers get access to your email accounts so that you can view them locally. Why should Microsoft get access to my Gmail or Protonmail? Their servers don’t need access to my email. Old outlook didn’t do that. Thunderbird doesn’t do that. This is completely unnecessary for a mail app. My computer can check my email. No reason for Microsoft servers to do it on my behalf.
  - WarOnPrivacy 3y ago
    > Proton is ostensibly lying about this credential setup. Not sure what your evidence is for lying. Because they're not. When creating an IMAP account, c't was able to sniff the traffic between new Outlook and the Microsoft servers. It contained the target server, log-in name and password which were sent to those Servers of Microsoft. Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel. Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook. ref: https://www.heise.de/news/Microsoft-lays-hands-on-login-data-Beware-of-the-new-Outlook-9358925.html https://www.heise.de/news/Microsoft-lays-hands-on-login-data...
- NoZebra120vClip 3y ago
  > you probably didn't intend Microsoft to have your credentials for But you just gave Microsoft your credentials! How could you not intend that? They're pretty clear about this: if you set up a 3rd party IMAP account, then yeah, credentials get used. If you set up an OAUTH2-capable account, then it uses that instead. That's why it's a lie, because of course if c't has some custom bespoke IMAP server, it's going to need credentials, and the user is going to intentionally hand them over so it can retrieve the mail.
  - thesuitonym 3y ago
    It's one thing to give the locally installed instance of the Outlook client your password, it's another for Outlook to send it in plain text to Microsoft's servers.
  - int_19h 3y ago
    I don't think it's clear at all if you're using the "New Outlook" app as opposed to web client. Traditionally, desktop email clients would handle credentials by directly using them to log in, not by sending them to a web service that logs in on their behalf.
wharvle 3y ago
If they mean usernames and passwords for third party mail servers, then it is notable, since a traditional email client doesn't do that. They only send the credentials to the server they're authenticating against, not also to the email client vendor. That it's happening as plain text (notwithstanding TLS on the transfer) distinguishes this from some kind of credentials-sync system (think: LastPass or Keychain) which wouldn't necessarily need to have the credentials in plaintext to function.

tambre 3y ago

But it isn't a password for Microsoft's services that's being sent. It's your username and password for another service you probably didn't intend Microsoft to have your credentials for. And it's intended.

NoZebra120vClip 3y ago
No, it's not. It's an OAUTH2 connection like a sane app. Proton is ostensibly lying about this credential setup. No app does that anymore.
- snailmailman 3y ago
  Either way, Microsoft servers get access to your email accounts so that you can view them locally. Why should Microsoft get access to my Gmail or Protonmail? Their servers don’t need access to my email. Old outlook didn’t do that. Thunderbird doesn’t do that. This is completely unnecessary for a mail app. My computer can check my email. No reason for Microsoft servers to do it on my behalf.
- WarOnPrivacy 3y ago
  > Proton is ostensibly lying about this credential setup. Not sure what your evidence is for lying. Because they're not. When creating an IMAP account, c't was able to sniff the traffic between new Outlook and the Microsoft servers. It contained the target server, log-in name and password which were sent to those Servers of Microsoft. Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel. Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook. ref: https://www.heise.de/news/Microsoft-lays-hands-on-login-data-Beware-of-the-new-Outlook-9358925.html https://www.heise.de/news/Microsoft-lays-hands-on-login-data...
NoZebra120vClip 3y ago
> you probably didn't intend Microsoft to have your credentials for But you just gave Microsoft your credentials! How could you not intend that? They're pretty clear about this: if you set up a 3rd party IMAP account, then yeah, credentials get used. If you set up an OAUTH2-capable account, then it uses that instead. That's why it's a lie, because of course if c't has some custom bespoke IMAP server, it's going to need credentials, and the user is going to intentionally hand them over so it can retrieve the mail.
- thesuitonym 3y ago
  It's one thing to give the locally installed instance of the Outlook client your password, it's another for Outlook to send it in plain text to Microsoft's servers.
- int_19h 3y ago
  I don't think it's clear at all if you're using the "New Outlook" app as opposed to web client. Traditionally, desktop email clients would handle credentials by directly using them to log in, not by sending them to a web service that logs in on their behalf.

wharvle 3y ago

If they mean usernames and passwords for third party mail servers, then it is notable, since a traditional email client doesn't do that. They only send the credentials to the server they're authenticating against, not also to the email client vendor. That it's happening as plain text (notwithstanding TLS on the transfer) distinguishes this from some kind of credentials-sync system (think: LastPass or Keychain) which wouldn't necessarily need to have the credentials in plaintext to function.