3 ms·
But it isn't a password for Microsoft's services that's being sent. It's your username and password for another service you probably didn't intend Microsoft to
by tambre 3y ago
But it isn't a password for Microsoft's services that's being sent. It's your username and password for another service you probably didn't intend Microsoft to have your credentials for. And it's intended.
- NoZebra120vClip 3y agoNo, it's not. It's an OAUTH2 connection like a sane app. Proton is ostensibly lying about this credential setup. No app does that anymore.
- snailmailman 3y agoEither way, Microsoft servers get access to your email accounts so that you can view them locally. Why should Microsoft get access to my Gmail or Protonmail? Their servers don’t need access to my email. Old outlook didn’t do that. Thunderbird doesn’t do that. This is completely unnecessary for a mail app. My computer can check my email. No reason for Microsoft servers to do it on my behalf.
- WarOnPrivacy 3y ago> Proton is ostensibly lying about this credential setup. Not sure what your evidence is for lying. Because they're not. When creating an IMAP account, c't was able to sniff the traffic between new Outlook and the Microsoft servers. It contained the target server, log-in name and password which were sent to those Servers of Microsoft. Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel. Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook. ref: https://www.heise.de/news/Microsoft-lays-hands-on-login-data-Beware-of-the-new-Outlook-9358925.html https://www.heise.de/news/Microsoft-lays-hands-on-login-data...
- NoZebra120vClip 3y ago> you probably didn't intend Microsoft to have your credentials for But you just gave Microsoft your credentials! How could you not intend that? They're pretty clear about this: if you set up a 3rd party IMAP account, then yeah, credentials get used. If you set up an OAUTH2-capable account, then it uses that instead. That's why it's a lie, because of course if c't has some custom bespoke IMAP server, it's going to need credentials, and the user is going to intentionally hand them over so it can retrieve the mail.
- thesuitonym 3y agoIt's one thing to give the locally installed instance of the Outlook client your password, it's another for Outlook to send it in plain text to Microsoft's servers.
- int_19h 3y agoI don't think it's clear at all if you're using the "New Outlook" app as opposed to web client. Traditionally, desktop email clients would handle credentials by directly using them to log in, not by sending them to a web service that logs in on their behalf.