Windows 11 Update 23H2 is stealing users' IMAP credentials (www-heise-de.translate.goog)

Article summary

Windows 11 Update 23H2 may upload users' IMAP credentials to the Microsoft cloud if they accept the new version of Outlook. The credentials are sent in plain text over an encrypted connection. This has raised concerns about data security and user consent. The issue was uncovered by a German IT magazine.

Main themes

• Data Security
• User Consent
• Microsoft Privacy Practices
• Alternative Email Clients
• Operating System Security
• Authentication Methods

What commenters say

• Microsoft's decision to upload IMAP credentials without explicit user consent is a major security risk.
• The use of TLS encryption does not mitigate the risk of password exposure to Microsoft.
• Storing passwords in plain text, even if encrypted in transit, is a significant security vulnerability.
• Alternative email clients and operating systems may offer better security and privacy options.
• Microsoft's actions may be driven by a desire to collect user data and promote paid subscriptions.
• The lack of transparency and user control over data sharing is a major concern.
• Some commenters argue that using passwords with IMAP is inherently insecure and alternative authentication methods should be used.
• Others suggest that Microsoft should use more secure methods, such as encryption with temporary public keys or hardware security modules, to protect user credentials.