Microsoft steals access data: Beware of the new Outlook

It was beyond shocking to see the level of data collection by O365, especially outlook. Think about typing out an email, it might take you some time and you might make revisions along the way. O365 does regular differential backups to that draft and stores it in exchange. Doing an audit on a user account's email showed me just that. The name Windows is an apt name, anyone can just look through and see what's going on now a days.

Google translated: https://www-heise-de.translate.goog/news/Microsoft-krallt-si...

At this point, it should be classified as a Trojan. They’ll probably pass it off as a “misconfiguration”

Article is in German language.

From my limited German it seems that Microsoft transfers all email-related information to a Microsoft-owned server on signup; including not only the access data (ie. SMTP passwords of all acounts, and such) but also the contents of all the the emails.

Isn’t this how the mobile Outlook app works? It takes all your account info, saves it to a proxy in the cloud, which is what makes the connection to your mail accounts. Then the mobile app talks to the proxy.

If that's true, I'd consider it almost criminal. The article mentions that Outlook sends the credentials of all email accounts on the system (e.g. gmail, all IMAP accounts) to Microsoft.

Let me guess: Implementing IMAP and SMTP is too hard in whatever javascript framework they used in the new Outlook app, so they threw a JMAP proxy into Azure and called it a day?