Microsoft steals access data: Beware of the new Outlook (German) | Hacker News Reader

Microsoft steals access data: Beware of the new Outlook (German)

heise.de

161 pointsdoener40 comments

I recently bought a surface 5 for my parents, who need a windows machine for their accounting software.

My initial impression was, this is pretty cool. They’ve replicated to Apple unboxing experience, and it even tries to do a passable job of the Mac startup and setup experience.

Until:

- I can’t log in without a Microsoft account (apparently you can remove this later, but I still haven’t worked out how to do it, and I’m not about to set my parents up with another email/password combo, so they’re using mine to start

- it asks for a keyboard locale, which then relocated the @ symbol somewhere totally bizarre (why it would allow this instead of forcing the keyboard it is installed with is beyond me, and I just chose UK vs USA, as I am used to this choice being more important for autocorrect and AUS spelling is more UK than US. No - apparently there are a bunch of keyboard layout differences that will then mean you need to google in an external device to work out why the @ symbol has moved, which means you can’t log in with your Microsoft account

- there’s 45 minutes of software updates

- ‘New’ outlook is the default choice. My parents use Google workspaces. The message informing me that all their email would be mirrored on Microsoft servers was horrifying. It took me an hour to determine it still had ‘old’ outlook installed but it was not default.

- I was continually horrified at how it tried to sell me things or inject ads or data or news feeds into every component of the operating system

Bottom line, it’s going back to the store. It’s nice that in their move to compete with Apple they’ve also introduced a 60 day no questions return policy.

You mention they still need windows for an accounting software, did you decide to go with another PC brand then and might I wonder if these issues would be different with another brand?

I chose a surface 5 because I was hoping the build quality would be better. I haven’t looked deeply into it - coming from outside the windows ecosystem for so long now I was hoping to achieve something with better support (ie return to Microsoft store) as opposed to trying to deal with an online support service that asks you to post your device in (they also live regionally so… electronics support is always an issue for them).

Overall the experience makes me think that it’s going to ultimately be a windows 11 issue (this is apparently the ultimate requirement for the accounting package) - unless the way another OEM configures manages to avoid the Microsoft account, advert pushing and O365 direct to New Outlook?

(As a side note, I’ve previously had them using parallels on a Mac. It worked but it was hard work. My parents are both brushing 70. They’re familiar with Outlook - when buttons change it blows their mind. I’m sure everyone in here has had to deal with parental tech support - now try managing it when you’re 900km away and they’re using an operating system you’re not even familiar with any more)

Yes, my experience with Windows 11 is that everything is constantly, in my case a Dell machine with extra OEM bloat to deal with. It can be harder for older people to deal with that, I'm already 30 and finding all that harder to navigate already.

Maybe sticking with an older version of that software that doesn't need windows 11 might be the best option if possible.

I do on site IT and carry scripts on a thumbdrive to remove crapware, disable cortana and block bing from search. I've cleaned hundreds of Win10/11 installs (some repeatedly, sadly).

> - it asks for a keyboard locale, which then relocated the @ symbol somewhere totally bizarre (why it would allow this instead of forcing the keyboard it is installed with is beyond me, and I just chose UK vs USA, as I am used to this choice being more important for autocorrect and AUS spelling is more UK than US. No - apparently there are a bunch of keyboard layout differences that will then mean you need to google in an external device to work out why the @ symbol has moved, which means you can’t log in with your Microsoft account

I'm sorry, but obviously the keyboard layout moves keys. How else would you expect someone to type using dvorak, have Z and Y keys swapped on German language keyboards or swap keys to perform the most common function for a language. ö and é for example are on the same key but swapped in which one you need Shift for between German and French layouts.

I’ve been a moderately competent user of computers for 33 years. At no point, ever, in the setup of a new device, has a changed setting at the start of a hardwired laptop keyboard then resulted in the inability to then input correctly. You may be absolutely correct, but from a user experience perspective, what the actual fuck? It wasnt like I was plugging in the dvorak version or was connecting my french layout keyboard by PS/2. It is literally the keyboard it came with. On a Mac you can later change the option, but the bloody thing already knows what keyboard it has and won’t let you make a user hostile mistake at the beginning of your setup journey. Imagine the confusion for the average person

Why wouldn't it change the layout immediately? If the user changes the setting, I would imagine at least a sizeable portion of those users want to use their desired keyboard layout to enter their information and might be unable to do so using whatever layout is selected by default.

> … the bloody thing already knows what keyboard it has and won’t let you make a user hostile mistake at the beginning of your setup journey.

Do you mean, as the rest of your post suggests, something like "it will let you make a user hostile mistake"?

> - I can’t log in without a Microsoft account

I don't know if there's something special about the Surface for this but during a regular Windows installation, if there is no Internet connection it offers you the option to create a local-only account.

Not that this excuses the incredibly dark pattern.

I did read that online when I was doing some research alongside getting it set up however it was not immediately obvious how to achieve this (including by trying to boot it without giving it the option of connecting to a network). It seemed to me at the time of setup that it would only let me proceed once it had a network connection

This is no longer the case in Windows 11. The "trick" to disconnect from the internet worked in the 10 setup procedure, but not 11.

The new method to create a local account at installation is to attempt to login to a known bogus account. Enter "no@thanks.com" as a username and keyboard mash the password. The installer will tell you that account is locked and then offer local account creation.

It's a stupid thing. Utterly stupid.

> I don't know if there's something special about the Surface for this but during a regular Windows installation, if there is no Internet connection it offers you the option to create a local-only account.

A new windows 11 install (non pro, donwloaded from the ms website) will never allow this. You'd have to do command line trickery or physically remove all network cards. I found this out the hard way and got myself a cheap pro key instead, which still requires trickery but less.

This is no longer the case on recent versions of windows 11, if there is no connection it will simply block you from setting up until you connect to the internet.

There is a way to bypass it on W11 Pro, you have to boot with ethernet disconnected, then once at the account creation screen hit Shift+F10, enter `oobe\bypassnro`, reboot, and start the setup again and it will allow a local account.

At least for now, they'll remove that soon I'm sure.

It sounds like the new Outlook is a thin wrapper around the cloud version, so the IMAP sync happens in the cloud, not locally. I wonder how MS is supposed to do this without having the remote IMAP password transmitted to the cloud version of Outlook.

This sounds less like "Microsoft steals your data" and more like "Microsoft replaced Desktop Outlook with OWA".

ssshhh non-inflammatory common sense replies have no place in a Microsoft hate discussion

That’s true! But isn’t having that sort of access to your non-Microsoft email account a second order effect of the change to a OWA? A lot of users are being shown the “new outlook!” toggle and are trained to just assume updated = safer. They’re not really communicating the effect it has, even if it’s just a change from a desktop app to a bundled web app.

It's going to be a problem when some people end up murdered because their credentials leaked through this thing.

Sorry, I think you'll need to walk me through this step-by-step.

1. User enters their IMAP credentials into desktop web app.

2. Web app transmits credentials to the backend where it is used to sync e-mails between Azure and third-party IMAP server.

3. Somehow the credentials leak to some untrusted third party.

4. User is murdered.

This feels like some rather important steps were skipped. If your threat scenarios include "being murdered because someone got access to my e-mail account", yeah, maybe just use Thunderbird to begin with.

So you can't read your email if outlook.com is down, or Microsofts authentication backend?

This also strikes me as pretty bad. The application that New Outlook is replacing was more of a regular IMAP client and managed mail locally, making this new behavior a big departure.

Also: how long does Microsoft expect this to work? If I was Google, I'd think about banning IMAP logins from the Azure servers that are doing this syncing.

It's a grim outlook for privacy.

Discussion: https://news.ycombinator.com/item?id=38212453

I recently got a new Windows 11 computer. I was forced to create a Microsoft account to login in. There is no reasonable option to bypass it. I copied some files over to the Desktop, and I was later completely horrified to realize that Microsoft had uploaded everything on my desktop to their servers (OneDrive). They shouldn't copy all your data to their cloud without making it explicit!

Right on all accounts. I've serviced MS shops for 3 decades. Presently, I approach Windows (and most MS offerings) as a hostile product.

[dupe]

More discussion: https://news.ycombinator.com/item?id=38212453

Maybe give the poster the benefit of the doubt as it's a totally different link. Let's be nice to each other

Fair. It's a serial problem with some accounts.

Then I hope I just didn't defend one of those haha

It's actually the same link, only that this one didn't go through some random translation service. But yeah, it means that both HN's duplicate detector and a quick search to see if the link has already been posted wouldn't find it.

Microsoft steals loads of data. Using windows means you are out in the public, let alone using other microsoft products.

Switch to Linux today.

Use Thunderbird.

Agreed. I'm on macOS, recently migrated from Outlook, no problems. I moved local folders over one-by-one; a slight chore, and lost a few messages, but single figures out of thousands.

Yeah, it's bullshit that they want me to store my, frankly more valuable, Google accounts access information in the Microsoft cloud.

Is Thunderbird good these days?

I'm a happy Firefox user, but heard many horror stories (not recently) in fact attended a talk which gave Thunderbird as an example of terrible software...

Long story short, would love to use it if it's good.

It's decent. I haven't found any better alternatives, although these days I just use the webmail from my email provider.

It's been improving a fair bit lately. Until a year or so ago, not much work had been done on it.

The new Outlook also uses the Edge browser rather than a stand alone application. I did not like that Outlook was made into a web application, and wish to hell I could remove the Edge browser permanently. I prefer a local mail client.

Well fuck...I switched to it because the normal outlook won't synch a single folder for some reason.

FFS...

Passwords are useless when you're writing the code doing the password algorithms and controls.

Reply on news.ycombinator.com