▲ 340 ▼ Warning: New Outlook sends passwords, mails and other data to Microsoft | mailbox.org (mailbox.org) submitted 2 years ago by bbbhltz@beehaw.org to c/technology@beehaw.org 65 comments fedilink hide all child comments
[–] Meganium97@lemmy.blahaj.zone 5 points 2 years ago* (2 children) | Creates account with service provider | Surprised when megically, service provider has password I don't get it. permalink fedilink source hideshow 4 child comments replies: [–] bbbhltz@beehaw.org [S] 17 points 2 years ago Using the Outlook client with a none-Outlook email shares the data with Microsoft. So, a bit surprising. permalink fedilink source parent [–] SexualPolytope@lemmy.sdf.org 8 points 2 years ago* (last edited 2 years ago) (1 child) Service providers aren't actually supposed to know your password. Passwords should always be sent after hashing on client side. Only the hashes are matched on server side. Edit: Not accurate, read replies. permalink fedilink source parent hideshow 2 child comments replies: [–] vox@sopuli.xyz 8 points 2 years ago (1 child) nope hashing is usually done server-side. also counter-intuitively server-side hashing is considered more secure than client side (in case of client side hashing hash becomes the password) permalink fedilink source parent hideshow 2 child comments replies: [–] SexualPolytope@lemmy.sdf.org 3 points 2 years ago I'm not an expert in this, and I did look around after reading your comment. Looks like the password is usually sent as-is, then hashed server side, and matched against hashes in the database. So, the hashes are what's stored in their database. So, ideally, the server shouldn't know your password. Also, it can be hashed from client side too, but that becomes redundant since everything is tls encrypted anyway. permalink fedilink source parent
[–] bbbhltz@beehaw.org [S] 17 points 2 years ago Using the Outlook client with a none-Outlook email shares the data with Microsoft. So, a bit surprising. permalink fedilink source parent
[–] SexualPolytope@lemmy.sdf.org 8 points 2 years ago* (last edited 2 years ago) (1 child) Service providers aren't actually supposed to know your password. Passwords should always be sent after hashing on client side. Only the hashes are matched on server side. Edit: Not accurate, read replies. permalink fedilink source parent hideshow 2 child comments replies: [–] vox@sopuli.xyz 8 points 2 years ago (1 child) nope hashing is usually done server-side. also counter-intuitively server-side hashing is considered more secure than client side (in case of client side hashing hash becomes the password) permalink fedilink source parent hideshow 2 child comments replies: [–] SexualPolytope@lemmy.sdf.org 3 points 2 years ago I'm not an expert in this, and I did look around after reading your comment. Looks like the password is usually sent as-is, then hashed server side, and matched against hashes in the database. So, the hashes are what's stored in their database. So, ideally, the server shouldn't know your password. Also, it can be hashed from client side too, but that becomes redundant since everything is tls encrypted anyway. permalink fedilink source parent
[–] vox@sopuli.xyz 8 points 2 years ago (1 child) nope hashing is usually done server-side. also counter-intuitively server-side hashing is considered more secure than client side (in case of client side hashing hash becomes the password) permalink fedilink source parent hideshow 2 child comments replies: [–] SexualPolytope@lemmy.sdf.org 3 points 2 years ago I'm not an expert in this, and I did look around after reading your comment. Looks like the password is usually sent as-is, then hashed server side, and matched against hashes in the database. So, the hashes are what's stored in their database. So, ideally, the server shouldn't know your password. Also, it can be hashed from client side too, but that becomes redundant since everything is tls encrypted anyway. permalink fedilink source parent
[–] SexualPolytope@lemmy.sdf.org 3 points 2 years ago I'm not an expert in this, and I did look around after reading your comment. Looks like the password is usually sent as-is, then hashed server side, and matched against hashes in the database. So, the hashes are what's stored in their database. So, ideally, the server shouldn't know your password. Also, it can be hashed from client side too, but that becomes redundant since everything is tls encrypted anyway. permalink fedilink source parent