Microsoft lays hands on login data: Beware of the new Outlook

How do you think login works for almost all network/web services? Very few do anything different. I wish they would, of course. Crypto/signature logins please!

It's also comforting that the path says "beta" so you know your email credentials are being sent to a secure location.

> It sends secret credentials to Microsoft servers

So in a work environment it probably can never be used? I'm willing to bet that it won't make a single bit of difference.

You can rely on Microsoft to come up with the next abuse and make a security hole out of it.

> free

There is the one trap-word. I am practicing a firewall-hygiene from the good-old ZoneAlarm days. If I don't need the software to 'get out', it is blocked. I only allow my Outlook to 'talk' to my mailbox carrier to bring in the emails. All other target IPs are blocked. So it can't 'phone home'. But again I'm on Office 2013 (and it still tries to phone-home).

It's also about ten times slower to launch than Mail.

Is this the same company that once created remarkable technological innovations like Windows XP, .NET Framework, Visual Studio Express, etc? I really hope it still is!

Is this new Outlook part of that new age Metro Interface or Windows Store apps? That's one of the first things I recommend everyone to get rid of as part of the windows de-bloat process.

I wonder how long this will work? If I was Google, I'd think about banning IMAP logins from the Azure servers that are doing this syncing.

I really love how they made a slick and fast mail app for windows, even if it it didn't support everything. but it did its job of being a fast email client.

Then they decided not anymore and replaced it with a bloated one...

Outlook is terrible, period.

I've been running the O365 Outlook version at my company and they broke simple things. I want to search for an email, so I select the folder, then click search and start typing.

In the new Outlook, the moment I press the first key for my search query, the focus moves off of the search bar, for no reason whatsoever, so every. single. fucking. goddamn. time. I want to search, I select the folder, click into the search box, type 1 character, move my hand off the keyboard, over to the mouse, to re-click into the goddamn search box, then continue typing.

That's Microsoft "improving" a product.

Man, I fucking hate these people.

I hate this new “mvp” philosophy where they redo an existing product and leave our features.

“Let’s get it working and add in future releases” makes sense for new products but is so dumb when it’s reworking existing products to make the crappier.

Microsoft does this all the time. They also do stuff like decide that Teams won’t have wikis any more. Because, like, nobody wants wikis in their collab suite.

There's a huge list of missing features here if anyone cares.

https://old.reddit.com/r/sysadmin/comments/13lo7u6/list_of_n...

I turned on new outlook briefly when the banner popped up at home.

Then I got rid of it entirely when the top unread email was an ad instead of actual emails. The fuck?

Aren't you describing Lotus Notes?

I use Thunderbird on my mobile and desktop.

Thunderbird needs to get to the 21st century before general public starts swapping out MS or Google mail, calendaring, and contact solutions. As it is, the GUIs on need a Jacob Nielsen-style usability revamp.

It 'just works'.

I've got Office 365 for Business for my personal email. Comes with OneDrive for Business (built on SharePoint) with 1TB storage, all the Office apps, Bing Chat(GPT) for Enterprise, Outlook app on Android/iOS etc. etc. Integrates perfectly on Windows.

The email service is great, works as expected and emails don't go undelivered with great spam filtering.

Can't think of a better provider. I used to be with Google Workspace but after transferring my Google account it's irreversible and can't go back to a 'personal' account while losing access to many Google services like (I know it's dead now) Stadia. Had to create a new 'personal' Google account and transfer everything over manually after doing a takeout - lost a few things like my old YouTube account and Google Play purchases.

Storing all of your data in a server that you have no control over and no option to not be a part of, exposing you to more attack vectors, solely for Microsoft to generate revenue from you...is for your protection!

-Microsoft probably.

Funnily enough (?), according to the article’s screenshot, the web service behind this is actually called ShadowService

I was disillusioned almost a decade ago and switched to LibreOffice back then itself. The only caveat is that the Microsoft's DOCX format isn't fully compatible with open ODT, so documents saved with one word processor may have slight formatting issues in another but I've stopped caring about it now and try to push everyone in my circle to adopt LibreOffice only. My hunch is that in about a decade or so, almost everyone will.

Long long ago, Outlook Express was all I ever needed. Simpler and fast. Not sure what happened to it

I look forward to seeing the EU take this on:

> The German Federal Commissioner for Data Protection and Freedom of Information, Ulrich Kelber, is also alarmed: On the social media network Mastodon, he described the data collection as "alarming" and announced his intention to pursue the issue at European level through the data protection authorities as early as next Tuesday.

https://social.bund.de/@bfdi/111381793883035665

They didn't get away with bundling the browser, but practically, that went nowhere, and they still keep pushing Edge at every turn.

One of my pet peeves against Microsoft is, precisely, how they bundled a mail client with their office suite, and one hostile to standards at that. A mail client that, somehow, only worked properly with other Office elements, and, at some point, it created interoperability issues if sender, receiver, and mail server, weren't all running Microsoft software.

Oh god.

They have precedent for this. Word (app), Word (Teams), Word (online office 365 thing). All slightly incompatible.

Most of the issues I've seen have been in the Outlook client app.

The problem is Microsoft using its servers as the middle man, without fair warning. Not what you mentioned.

“If you are trying to login to IMAP hosted by Google or Fastmail, why should Microsoft need to be contacted let alone given the password?” is how I read the article…

Now, I know the answer is so that you can have push notifications sent to your mobile phone with every IMAP poll Microsoft does on your behalf, but that’s because the architecture of the new Outlook app likely borrows features of the Accompli mobile app they bought and maintained as Outlook mobile. That the desktop app re-uses the same APIs as the mobile app rather than process mail locally makes sense from a code reuse and efficiency standpoint, but really only because your accounts can seamlessly carry over to all your devices.

It’s arguable that the distinction between keeping your password in the cloud and keeping your password local is a security risk. However, if you previously used Outlook.com to check your IMAP email, and maybe this is where the feature derives from, then you already provided your IMAP password to Microsoft on the web. Likewise Google for importing IMAP to Gmail. We do this because it is nicer to get one inbox and one push notification across multiple accounts - when we want cloud providers checking emails for us.

It is less clear why a desktop app would do this unless you opted in to fancier service of some kind - e.g. viewing emails on the web when not at this device, or push notifications to your mobile phone, etc.

If Microsoft wanted to read your emails even with a locally stored and never shared IMAP password, they could still send telemetry derived from the local client to build an advertising profile based on local emails, or to display targeted ads. They don’t technically need your password to read your emails if you are using their email client.

The concern is someone logging into Gmail is sending plain text passwords and email contents to Microsoft. That’s why sending plain text passwords over an encrypted channel is a concern.

It would be fine if Outlook was backing up encrypted data and then not sending the decryption key to Microsoft servers.

The question is, why does Microsoft need your Gmail password at all to begin with? Thunderbird works perfectly fine with Gmail without sending Mozilla your password.

It is conceivable that they wanted to express "although encrypted in transit, it is not hashed and Microsoft can recover the full password". However, you'd have to be very charitable to interpret the articale like that.

This is not a translation error either. The same mistake can be found in the German original.

> Did whoever write this realize you need to be able to recover the cleartext for this to even work?

The first author of the article has a degree in 'commercial information technology' and has worked as a sysadmin, so I assume they do understand that this is necessary, they may just have done a bad job of expressing that.

An article in a technical outlet should still do better in such regards.

It's to distinguish this behavior from password managers. Here, the message is sent to Microsoft in an encrypted form, but Microsoft can decrypt it to access the underlying password. For password managers, the remote server receives a password in an encrypted form, and cannot decrypt it to access the underlying password.

It could have been phrased better, but the clear message is that Microsoft has pilfered access to unencrypted passwords, regardless of any transportation-level encryption.

you are not the customer - the management of you, is the customer. The management of you, does want this in many cases.

Do you use web based clients to access third party accounts?

This isn’t even true for every webmail.

Some run locally in the browser.

Many don’t send the credentials to be saved cloud-side.

Except disguised such that people think it is not webmail. They are replacing a desktop IMAP client (which stored data locally) with a webapp that (it sounds like) copies all of your Google Mail to a Microsoft server.

I do think this is a big deal, certainly my expectation was that the New Outlook work alot like the old Mail app.

This smells like clueless users wanting outlook on their phone without wanting to do any set up

Don't know why you're getting downvoted. I couldn't figure out how to get past it, but it looked like the article is in English.

Could it be the cookie prompt?

The page has 15+ trackers on it, so it must definitely ask for consent, and it shows as a big dialog with 3 buttons at the bottom.