Hacker News Reader

Comment by mynameisvlad | Hacker News Reader

What use would a hash of the password be when the purpose is to log in as the user?

You're correct it's necessary for how they use this, to impersonate a user and 'clone' their email data. But then, that is the problem, they shouldn't be able to do this at all.

Okay but the existence of a problem does not change the simple fact that it's encrypted. So many people arguing against this point out of some misguided sense of fuzzy logic.

It is encrypted in transit, but Microsoft is on the receiving end of that transit and gets the plain text password. The encryption does nothing to prevent the third party, that is Microsoft, from impersonating the user and reading all their mail.

How would a hashed password fix that problem?

It would make it harder for them to impersonate their users and read all their mail. I would still be concerned that they want to run a rainbow table attack against it though. They should not steal user credentials at all, because it is simply not necessary for a functioning email client.

What?

They would use the hashed password to login to the server, using something like XOAUTH2. That’s the point of the hashed password. It accomplishes nothing other than revocation, which can be done already by changing your password.

What you are referring to is called an access token and has nothing to do with hashed passwords. A hashed password cannot be used directly to authenticate, otherwise it would not be a hashed password, but just a password (or access token, which is the same really).

I don't understand how hashed passwords got into this discussion though. My point is that microsoft should have no way to authenticate as an outlook user against their third party mail provider without the user explicitly giving them permission to do so and what they do is strictly unnecessary to provide the functionality of an email client.

It's worse: anybody who can proxy the communication between Outlook and the MS servers can impersonate the user.

It is not entirely clear to me from the article that this is the case. I'd assume that they had to at least install their MitM certificate into the OS's trust store to intercept that message. If not then this is indeed even worse.

sigh It's literally encrypted. You can try to derail the topic, but we're arguing about a very simple fact here. It's either encrypted or not. It's not complicated.

Yes, it is literally encrypted in transit. This encryption, however, does not offer any value in protecting the user from microsoft stealing their credentials, because microsoft is the recipient of that encrypted message and is able to decrypt the credentials and therefore has access to the plain text password.

Just like this comment I am writing is literally encrypted when it is send to HN, and still everyone can read it.

Okay, I thikn the problem is, when someone says that something is "sent in plaintext" that usually means that it's interceptable. However, in this case, maybe, the author means that "it's being sent in a form that they can use, not just being stored like LastPass or something". Of course, the entire point of the article is that it's being sent in a format that they can use to connect to your server, so it's a strange statement to drop in the middle of the article.

First of all, the article shows that it is indeed interceptable (although they didn't mention which additional steps, if any, were necessary to achieve that).

And yes, the issue is obviously that it is send in a way that microsoft can (ab)use.

> [...] tunneling [through an encrypted channel] back to their servers in plain text

Seems pretty clear to me. The message that is send contains the password in plain text. Any encryption that is applied in transit is absolutely irrelevant and meaningless. Just microsoft receiving the credentials is only marginally better than anyone getting them. In both cases the account will be compromised.

You're free to throw away the common-sense definitions for things, and substitute your own, but I'm going to call you on it, and you shouldn't expect people to do otherwise.

I did not throw away any common-sense definitions. I never denied that the message is sent encrypted, i.e. is encrypted in transit. That is entirely irrelevant here though, since MS will be able to decrypt the message because they specifically are the recipient of that encrypted message and therefore will have it in plain text. If you do not see a problem with that you are free to comment your mail credentials here; they will be encrypted so that shouldn't be a problem, right?

Gur rkpvfgrapr bs rapelcgvba qbrf abg punatr gur fvzcyr snpg gung jung gurl ner qbvat vf onq sbe frphevgl naq ubeevoyr sbe cevinpl.

it is not a hash

They didn't say it was. They were asking what use a hash would be.

Reply on news.ycombinator.com