Email or username:

Password:

Forgot your password?
Top-level
Martin Schmitt

@nielsk So would it make sense to block MS on submission and IMAP ports? What legitimate business could they have?

27 comments
Niels K.

@unixtippse If your users use the new Outlook which will replace Windows Mail you can’t block them.

Martin Schmitt

@nielsk You haven't tested whether it falls back to direct communication, though, have you?

Niels K.

@unixtippse No, I didn’t. I just had a support team member telling me that Outlook didn’t work and if we can make it work (it worked for him after a reboot) and that’s why I did what I did.

Leeloo

@nielsk @unixtippse
It should at least be possible to put your mail server on an rfc1918 ip, they wouldn't block corporate mail servers.

Use a VPN if you need access on the go.

Niels K.

@js @unixtippse Well, I operate a mail-platform for external users. I can’t do that because the support-team will kill me.

J$

@nielsk @unixtippse Well, I’d say its not up to you to break your spine to create workarounds for broken-by-design end user software. They have plenty of working clients to choose from.

EndlessMason

@js
That's literally what a support engineer's job is lol
@nielsk @unixtippse

Stefan Fendt

@nielsk @unixtippse

You can and you should block these.

These users need to be protected from themselves.

Nils Nakayama

@stefanfendt
So now a benevolent power should make the rules to save the pheasants from themselves?
That concept isn't new.

@nielsk @unixtippse

Wolf480pl

@nielsk @unixtippse I think from a security point of view, it's better when it doesn't work. More than that, every time your server sees a user successfully log in from a Microsoft IP, it should reset (or disable) that user's password, since you have to assume it's compromised.

railmeat

@unixtippse @nielsk

It sounds like they proxy all the connections so all the mail passes through their servers. I wonder how long they keep it? I guess everyone’s emails become grist for AI.

I wonder what their terms of service say about that?

Niels K.

@railmeat @unixtippse I dunno. But it is more less the same what they do with the mobile Outlook-clients

railmeat

@nielsk @unixtippse

I guess that is the world we live in now. Not really my preference.

Yet another reason to move my computing to self hosted and possibly Linux.

Mr Cool

@railmeat @nielsk @unixtippse If we don't stop companies from implementing toxic business culture, it will get worse. Someday we will live in a world we don't really want to live in. We will no longer own anything, not even our data.
Too many people don't care and even defend these companies.

Tom

@mrcool @railmeat @nielsk @unixtippse

Agreed, except for the word 'someday'.

It will get worse for sure, but that's already the world we live in.

Mr Cool

@Tom @railmeat @nielsk @unixtippse You are right. Even I can see how I'm slowly getting used to it. And that's how it will continue. Small steps, so that people don't realize that their rights and their data are gradually being taken away from them.

X

@mrcool

Too late! We already gave up our entire life to them.
Sadly, this is true.

Chewie

@railmeat if you have time, bandwidth and money, I would highly recommend self-hosting, I've learnt loads by doing it!

seism0saurus 🦕

@railmeat @unixtippse @nielsk

It's documented, that they store the credentials to the Mailservers in cleartext on their servers and fetch the Mails there. It's a shitty design.

railmeat

@seism0saurus @unixtippse @nielsk

Credentials in plain text? I thought we got past that in the’90s.

Where is that documented?

seism0saurus 🦕

@railmeat @unixtippse @nielsk

Otherwise they can't access your Mailservers.
I'm not sure if the data at rest is unencrypted but at least it is reversible since they need it for login to your mailservers.
It is definitely not a standard like bcrypt or scrypt there the credentials are secured by a one way function

heise.de/en/news/Microsoft-lay

@railmeat @unixtippse @nielsk

Otherwise they can't access your Mailservers.
I'm not sure if the data at rest is unencrypted but at least it is reversible since they need it for login to your mailservers.
It is definitely not a standard like bcrypt or scrypt there the credentials are secured by a one way function

Gavin

@unixtippse @nielsk Everything Microsoft does now should be viewed through the prism of surveillance capitalism and the collection of behavioural surplus.

Hijacking your email traffic is a great way to collect data for targeted ads.

alihan_banan

@unixtippse @nielsk why not stop using it altogether instead of going all out sadomaso just to use their crappy software?

Go Up