Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft mishandling example.com

tinyapps.org

Post reply on HN
Print view View original

21–30 of 93 posts

Re: Microsoft mishandling example.com

#21

Post by ndriscoll »

irusensei wrote: post #5

Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.

Haven't they been telling people to do that since before it became reserved? If so, the problem is more that you can't "reserve" something that's already in wide use, and mdns should've used something like .mdns.

It's like when .dev became a gTLD, knowingly breaking a bunch of setups for a mix of vanity and a cash grab. Obviously dropped the ball on the engineering side.

Re: Microsoft mishandling example.com

#22

Post by thedanbob »

gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

It's more common than you might think. I know of at least one popular email client that stores your credentials on their servers to enable features like multi-account sync and scheduled sending.

Re: Microsoft mishandling example.com

#23

Post by spiffyk »

thedanbob wrote: post #22
gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

It's more common than you might think. I know of at least one popular email client that stores your credentials on their servers to enable features like multi-account sync and scheduled sending.

I would expect such a feature to use end-to-end encryption for the data, so that only the user can see the credentials. It does, right? Right?

Re: Microsoft mishandling example.com

#24

Post by gruez »

spiffyk wrote: post #23
thedanbob wrote: post #22

Earlier quoted context omitted.

It's more common than you might think. I know of at least one popular email client that stores your credentials on their servers to enable features like multi-account sync and scheduled sending.

I would expect such a feature to use end-to-end encryption for the data, so that only the user can see the credentials. It does, right? Right?

>>multi-account sync and scheduled sending

>I would expect such a feature to use end-to-end encryption for the data

How would "end-to-end encryption" when such features by definition require the server to have access to the credentials to perform the required operations? If by "end to end" you actually mean it's encrypted all the way to the server, that's just "encryption in transit".

Re: Microsoft mishandling example.com

#25

Post by tom1337 »

thedanbob wrote: post #22
gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

It's more common than you might think. I know of at least one popular email client that stores your credentials on their servers to enable features like multi-account sync and scheduled sending.

Do you mean Spark? I get why they need to do it that way but I also hate that they have to do it that way because it sucks for privacy.

Re: Microsoft mishandling example.com

#27

Post by [deleted] »

GranPC wrote: post #12

> Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... " Wait, does their autodetect send email and password to their servers, instead of just domain???

[deleted]

Re: Microsoft mishandling example.com

#29

Post by Cthulhu_ »

hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

Would that really make a difference in this case? It's a configuration error / bug in Microsoft's discovery server, they could have a fallback that goes "any unknown address, return this .jp address".

Re: Microsoft mishandling example.com

#30

Post by dec0dedab0de »

gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

I think outlook is pretty much a saas product these days.
Post reply on HN