41–50 of 93 posts
Earlier quoted context omitted.
And? Do you think Gmail is end to end encrypted?
I am talking about the fact that the new default email client on Windows will hand over all your email credentials to Microsoft. This has nothing to do with Gmail.
>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…
Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication. It looks like Microsoft Edge had the _ability to disable_ this added in 2020 or 2021, but it isn't currently the default and the Group Policy unintuitively only applies to unencrypted HTTP Connections.
Are you talking about NTLM hashes? It's a weak hash, but not the same as "sending your password". The biggest difference is that even a weak hash can't be reversed if the password has high enough entropy.
Earlier quoted context omitted.
Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account. https://www.xda-developers.com/privacy-implications-new-micr...
And? Do you think Gmail is end to end encrypted?
>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…
It's more common than you might think. I know of at least one popular email client that stores your credentials on their servers to enable features like multi-account sync and scheduled sending.
It was the Ethernom Beamu, company now defunct.
Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.
Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.
My company used .local for EVERYTHING. I took it as normal at the time, until I got into problems with VMWARE products. Support patiently explained .local is reserved for something else and kindly provided Wikipedia links. They never responded why they used .local in their docs, trainings, webinars they provided, though :)
>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…
Not just an “outlook account” - any account in outlook, with default settings at least.
I run a mail server, mainly for me but a couple of friends have accounts on there too, and a while ago one friend reported apparently being locked out and it turned out that it was due to them switching Outlook versions and it was connecting via a completely different address to those that my whitelists expected sometimes at times when they weren't even actively using Outlook. Not only were active connections due to their interactive activity being proxied, but the IMAP credentials were stored so the MS server could login to check things whenever it wanted (I assume the intended value-add there is being able to send new mail notifications on phones/desktops even when not actively using mail?).
> but this feels like it breaks all sorts of security/privacy expectations.
It most certainly does. The behaviour can be tamed somewhat, but (unless there have been recent changes) is fully enabled by default in newer Outlook variants.
The above-mentioned friend migrated his mail to some other service in a huf as I refused to open my whitelist to “any old host run by MS” and he didn't want to dig in to how to return behaviour back to the previous “local connections only, not sending credentials off elsewhere where they might be stored”.
Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.
Usage of .local for AD predated mDNS. That advice stopped with the advent of mDNS in favor of 'corp. . '.
Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.
My company used .local for EVERYTHING. I took it as normal at the time, until I got into problems with VMWARE products. Support patiently explained .local is reserved for something else and kindly provided Wikipedia links. They never responded why they used .local in their docs, trainings, webinars they provided, though :)