4 ms·

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" "https://prod.autodetect.outlook.cloud.microsoft

by gruez 10mo ago

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" "https://prod.autodetect.outlook.cloud.microsoft/autodetect/detect?app=outlookdesktopBasic https://prod.autodetect.outlook.cloud.microsoft/autodetect/d...": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy expectations.

thedanbob 10mo ago
It's more common than you might think. I know of at least one popular email client that stores your credentials on their servers to enable features like multi-account sync and scheduled sending.
- spiffyk 10mo ago
  I would expect such a feature to use end-to-end encryption for the data, so that only the user can see the credentials. It does, right? Right?
  - gruez 10mo ago
    >>multi-account sync and scheduled sending >I would expect such a feature to use end-to-end encryption for the data How would "end-to-end encryption" when such features by definition require the server to have access to the credentials to perform the required operations? If by "end to end" you actually mean it's encrypted all the way to the server, that's just "encryption in transit".
    - treyd 10mo ago
      > If by "end to end" you actually mean it's encrypted all the way to the server, that's just "encryption in transit". This is what Zoom claimed was e2ee for a little while before getting in trouble for it.
      - kingstnap 10mo ago
        This is what Google also claims as end to end encrypted in their Gmail end to end thing. Many people including me mentioned this in the comments. https://news.ycombinator.com/item?id=45458482 https://news.ycombinator.com/item?id=45458482 Its entirely their end to their end encrypted. You don't get any privacy.
        fc417fc802 10mo ago
        Use our new open source (modification and redistribution not permitted) app to exchange end-to-end encrypted (from your client to our server) messages with your friends! Having all your data on our service protects your data sovereignty (we do not provide for export or interop) by guaranteeing that you always have access to your full history! Usage also protects your privacy (we analyze your data for marketing purposes) by preventing unscrupulous third parties from analyzing your data for marketing purposes. If we had competent regulators this sort of blatant willful negligence would constitute false advertising.
- tom1337 10mo ago
  Do you mean Spark? I get why they need to do it that way but I also hate that they have to do it that way because it sucks for privacy.
  - thedanbob 10mo ago
    Yeah, Spark. Shame because I really liked their client, but I refused to use it anymore after I realized what they were doing.
- RajT88 10mo ago
  I bought a hardware password manager a while back and the bulk load tool sent all your creds to a cloud service. I have not used it since, and sent the manufacturer a nasty note. It was the Ethernom Beamu, company now defunct.
dec0dedab0de 10mo ago
I think outlook is pretty much a saas product these days.
- DANmode 10mo ago
  What gave it away, the intrusive ads in your free inbox the last ten years, or the “See Plans and Pricing” on the homepage? Christ, my poor grandmother…
tga 10mo ago
Most likely, and nobody cares. Already many years ago I remember installing a firewall on my phone and noticing in surprise that Outlook was not connecting at all to my private mail server, but instead only sending my credentials to their cloud and downloading messages from there. The only Android mail client not making random calls to cloud servers was (back then) K-9 Mail.
nhinck2 10mo ago
Yeah since the Windows 11 2023h2 update.
brulx126 10mo ago
Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account. https://www.xda-developers.com/privacy-implications-new-microsoft-outlook/ https://www.xda-developers.com/privacy-implications-new-micr...
- koakuma-chan 10mo ago
  And? Do you think Gmail is end to end encrypted?
  - brulx126 10mo ago
    I am talking about the fact that the new default email client on Windows will hand over all your email credentials to Microsoft. This has nothing to do with Gmail.
    - koakuma-chan 10mo ago
      Oh you mean even if you don't use Microsoft's email? Now I get it.
  - gruez 10mo ago
    My bank isn't end to end encrypted either, but that doesn't mean it's suddenly ok for Microsoft (or any other company) to suddenly start MITMing my online banking connections.
  - AlexandrB 10mo ago
    Adding a bunch of middlemen that also see the data increases the risk.
  - delfinom 10mo ago
    I think the concern is that it copies the emails of your non-Microsoft accounts that you added to the Outlook app, over to Microsoft servers
- amluto 10mo ago
  This seems like it would completely break any attempt to track access from unauthorized users or devices — any IT department using a backend other than Microsoft’s would need to pretend that all access from MS’s servers is safe.
butvacuum 10mo ago
Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication. It looks like Microsoft Edge had the _ability to disable_ this added in 2020 or 2021, but it isn't currently the default and the Group Policy unintuitively only applies to unencrypted HTTP Connections.
- gruez 10mo ago
  >Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication. Are you talking about NTLM hashes? It's a weak hash, but not the same as "sending your password". The biggest difference is that even a weak hash can't be reversed if the password has high enough entropy.
  - lazide 10mo ago
    Not necessarily, the server can say it only supports basic auth and….
    - gruez 10mo ago
      I don't think there's any evidence that windows sends cleartext passwords. The whole reason why NTLM is a thing is to avoid sending cleartext passwords.
      - lazide 10mo ago
        Outlook appears to be
        p_ing 10mo ago
        The 'https://' disagrees with your 'sending clear text passwords' statement.
        lazide 10mo ago
dspillett 10mo ago
> Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? Not just an “outlook account” - any account in outlook, with default settings at least. I run a mail server, mainly for me but a couple of friends have accounts on there too, and a while ago one friend reported apparently being locked out and it turned out that it was due to them switching Outlook versions and it was connecting via a completely different address to those that my whitelists expected sometimes at times when they weren't even actively using Outlook. Not only were active connections due to their interactive activity being proxied, but the IMAP credentials were stored so the MS server could login to check things whenever it wanted (I assume the intended value-add there is being able to send new mail notifications on phones/desktops even when not actively using mail?). > but this feels like it breaks all sorts of security/privacy expectations. It most certainly does. The behaviour can be tamed somewhat, but (unless there have been recent changes) is fully enabled by default in newer Outlook variants. The above-mentioned friend migrated his mail to some other service in a huf as I refused to open my whitelist to “any old host run by MS” and he didn't want to dig in to how to return behaviour back to the previous “local connections only, not sending credentials off elsewhere where they might be stored”.
- Grisu_FTP 10mo ago
  I might be misremembering but i think it even copies all of your mails to their servers.
1718627440 10mo ago
Always has been.
Neil44 10mo ago
I think the curl -u switch just requires the password field to be filled, there obviously isn't a legit user account test@example.com with a password of password either at microsoft or at the Japanese imap server.
- gruez 10mo ago
  >I think the curl -u switch just requires the password field to be filled Yeah you're right, if you don't specify the password (eg. -u user), it prompts you for it >there obviously isn't a legit user account test@example.com with a password of password either at microsoft or at the Japanese imap server. But presumably the fact it's there at all suggests it's a required parameter? Maybe "password" is just a placeholder, but it's unclear based on the command line transcript alone.
DANmode 10mo ago
See also: Windows 11 telemetry

by gruez 10mo ago

thedanbob 10mo ago

It's more common than you might think. I know of at least one popular email client that stores your credentials on their servers to enable features like multi-account sync and scheduled sending.

spiffyk 10mo ago
I would expect such a feature to use end-to-end encryption for the data, so that only the user can see the credentials. It does, right? Right?
- gruez 10mo ago
  >>multi-account sync and scheduled sending >I would expect such a feature to use end-to-end encryption for the data How would "end-to-end encryption" when such features by definition require the server to have access to the credentials to perform the required operations? If by "end to end" you actually mean it's encrypted all the way to the server, that's just "encryption in transit".
  - treyd 10mo ago
    > If by "end to end" you actually mean it's encrypted all the way to the server, that's just "encryption in transit". This is what Zoom claimed was e2ee for a little while before getting in trouble for it.
    - kingstnap 10mo ago
      This is what Google also claims as end to end encrypted in their Gmail end to end thing. Many people including me mentioned this in the comments. https://news.ycombinator.com/item?id=45458482 https://news.ycombinator.com/item?id=45458482 Its entirely their end to their end encrypted. You don't get any privacy.
      - fc417fc802 10mo ago
        Use our new open source (modification and redistribution not permitted) app to exchange end-to-end encrypted (from your client to our server) messages with your friends! Having all your data on our service protects your data sovereignty (we do not provide for export or interop) by guaranteeing that you always have access to your full history! Usage also protects your privacy (we analyze your data for marketing purposes) by preventing unscrupulous third parties from analyzing your data for marketing purposes. If we had competent regulators this sort of blatant willful negligence would constitute false advertising.
tom1337 10mo ago
Do you mean Spark? I get why they need to do it that way but I also hate that they have to do it that way because it sucks for privacy.
- thedanbob 10mo ago
  Yeah, Spark. Shame because I really liked their client, but I refused to use it anymore after I realized what they were doing.
RajT88 10mo ago
I bought a hardware password manager a while back and the bulk load tool sent all your creds to a cloud service. I have not used it since, and sent the manufacturer a nasty note. It was the Ethernom Beamu, company now defunct.

dec0dedab0de 10mo ago

I think outlook is pretty much a saas product these days.

DANmode 10mo ago
What gave it away, the intrusive ads in your free inbox the last ten years, or the “See Plans and Pricing” on the homepage? Christ, my poor grandmother…

tga 10mo ago

Most likely, and nobody cares. Already many years ago I remember installing a firewall on my phone and noticing in surprise that Outlook was not connecting at all to my private mail server, but instead only sending my credentials to their cloud and downloading messages from there. The only Android mail client not making random calls to cloud servers was (back then) K-9 Mail.

nhinck2 10mo ago

Yeah since the Windows 11 2023h2 update.

brulx126 10mo ago

Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account. https://www.xda-developers.com/privacy-implications-new-microsoft-outlook/ https://www.xda-developers.com/privacy-implications-new-micr...

koakuma-chan 10mo ago
And? Do you think Gmail is end to end encrypted?
- brulx126 10mo ago
  I am talking about the fact that the new default email client on Windows will hand over all your email credentials to Microsoft. This has nothing to do with Gmail.
  - koakuma-chan 10mo ago
    Oh you mean even if you don't use Microsoft's email? Now I get it.
- gruez 10mo ago
  My bank isn't end to end encrypted either, but that doesn't mean it's suddenly ok for Microsoft (or any other company) to suddenly start MITMing my online banking connections.
- AlexandrB 10mo ago
  Adding a bunch of middlemen that also see the data increases the risk.
- delfinom 10mo ago
  I think the concern is that it copies the emails of your non-Microsoft accounts that you added to the Outlook app, over to Microsoft servers
amluto 10mo ago
This seems like it would completely break any attempt to track access from unauthorized users or devices — any IT department using a backend other than Microsoft’s would need to pretend that all access from MS’s servers is safe.

butvacuum 10mo ago

Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication. It looks like Microsoft Edge had the _ability to disable_ this added in 2020 or 2021, but it isn't currently the default and the Group Policy unintuitively only applies to unencrypted HTTP Connections.

gruez 10mo ago
>Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication. Are you talking about NTLM hashes? It's a weak hash, but not the same as "sending your password". The biggest difference is that even a weak hash can't be reversed if the password has high enough entropy.
- lazide 10mo ago
  Not necessarily, the server can say it only supports basic auth and….
  - gruez 10mo ago
    I don't think there's any evidence that windows sends cleartext passwords. The whole reason why NTLM is a thing is to avoid sending cleartext passwords.
    - lazide 10mo ago
      Outlook appears to be
      - p_ing 10mo ago
        The 'https://' disagrees with your 'sending clear text passwords' statement.
        lazide 10mo ago

dspillett 10mo ago

> Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? Not just an “outlook account” - any account in outlook, with default settings at least. I run a mail server, mainly for me but a couple of friends have accounts on there too, and a while ago one friend reported apparently being locked out and it turned out that it was due to them switching Outlook versions and it was connecting via a completely different address to those that my whitelists expected sometimes at times when they weren't even actively using Outlook. Not only were active connections due to their interactive activity being proxied, but the IMAP credentials were stored so the MS server could login to check things whenever it wanted (I assume the intended value-add there is being able to send new mail notifications on phones/desktops even when not actively using mail?). > but this feels like it breaks all sorts of security/privacy expectations. It most certainly does. The behaviour can be tamed somewhat, but (unless there have been recent changes) is fully enabled by default in newer Outlook variants. The above-mentioned friend migrated his mail to some other service in a huf as I refused to open my whitelist to “any old host run by MS” and he didn't want to dig in to how to return behaviour back to the previous “local connections only, not sending credentials off elsewhere where they might be stored”.

Grisu_FTP 10mo ago
I might be misremembering but i think it even copies all of your mails to their servers.

1718627440 10mo ago

Always has been.

Neil44 10mo ago

I think the curl -u switch just requires the password field to be filled, there obviously isn't a legit user account test@example.com with a password of password either at microsoft or at the Japanese imap server.

gruez 10mo ago
>I think the curl -u switch just requires the password field to be filled Yeah you're right, if you don't specify the password (eg. -u user), it prompts you for it >there obviously isn't a legit user account test@example.com with a password of password either at microsoft or at the Japanese imap server. But presumably the fact it's there at all suggests it's a required parameter? Maybe "password" is just a placeholder, but it's unclear based on the command line transcript alone.

DANmode 10mo ago