Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft mishandling example.com

tinyapps.org

Post reply on HN
Print view View original

31–40 of 93 posts

Re: Microsoft mishandling example.com

#31

Post by tga »

gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

Most likely, and nobody cares.

Already many years ago I remember installing a firewall on my phone and noticing in surprise that Outlook was not connecting at all to my private mail server, but instead only sending my credentials to their cloud and downloading messages from there.

The only Android mail client not making random calls to cloud servers was (back then) K-9 Mail.

Re: Microsoft mishandling example.com

#32

Post by tialaramex »

hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

It so happens that in this very specific case your obviously bad choice didn't make anything worse, that doesn't make it a good choice.

"Aha, the defective trucks only cause injuries to people who have their hands on the wheel at highway speeds, but I've never bothered holding the wheel at high speed, I just YOLO so I wouldn't be affected"

If people had used IANA's reserved TLDs they too would be unaffected because although Windows will stupidly try to talk to for example autodiscover.example that can't exist by policy and so the attempt will always fail.

Re: Microsoft mishandling example.com

#33

Post by ThePowerOfFuet »

wongarsu wrote: post #16
hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

brb, just filing paperwork to apply for the .tmptest gTLD /s

$100K

Re: Microsoft mishandling example.com

#35

Post by nhinck2 »

gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

Yeah since the Windows 11 2023h2 update.

Re: Microsoft mishandling example.com

#36

Post by brulx126 »

gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account.

https://www.xda-developers.com/privacy-implications-new-micr...

Re: Microsoft mishandling example.com

#37

Post by butvacuum »

gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication.

It looks like Microsoft Edge had the _ability to disable_ this added in 2020 or 2021, but it isn't currently the default and the Group Policy unintuitively only applies to unencrypted HTTP Connections.

Re: Microsoft mishandling example.com

#38

Post by koakuma-chan »

brulx126 wrote: post #36
gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account. https://www.xda-developers.com/privacy-implications-new-micr...

And? Do you think Gmail is end to end encrypted?

Re: Microsoft mishandling example.com

#39

Post by brulx126 »

koakuma-chan wrote: post #38
brulx126 wrote: post #36

Earlier quoted context omitted.

Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account. https://www.xda-developers.com/privacy-implications-new-micr...

And? Do you think Gmail is end to end encrypted?

I am talking about the fact that the new default email client on Windows will hand over all your email credentials to Microsoft. This has nothing to do with Gmail.

Re: Microsoft mishandling example.com

#40

Post by gruez »

koakuma-chan wrote: post #38
brulx126 wrote: post #36

Earlier quoted context omitted.

Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account. https://www.xda-developers.com/privacy-implications-new-micr...

And? Do you think Gmail is end to end encrypted?

My bank isn't end to end encrypted either, but that doesn't mean it's suddenly ok for Microsoft (or any other company) to suddenly start MITMing my online banking connections.
Post reply on HN