Windows 11 Update 23H2 is stealing users' IMAP credentials

Original Article ↗ Hacker News Discussion ↗

Windows 11’s new Outlook client is accused of silently uploading users’ IMAP/SMTP credentials and mail data to Microsoft’s cloud when they enable “Microsoft sync” for non‑Microsoft email accounts. Commenters argue this is effectively a man‑in‑the‑middle design that gives Microsoft full access to third‑party mailboxes, likely without informed consent and potentially in violation of EU GDPR requirements. The thread also highlights broader concerns about “cloud‑first” lock‑in strategies, security risks if those stored credentials are breached, and recommends alternatives such as traditional Outlook, Thunderbird, or non‑Windows platforms.

Behavior of the New Outlook Client

  • New Outlook on Windows 11 (23H2) offers to “synchronize” non‑Microsoft IMAP/SMTP accounts with the Microsoft cloud.
  • Traffic analysis in the referenced article shows server address, username, and password being sent in a JSON payload to Microsoft over HTTPS/TLS.
  • For those accounts, Outlook no longer connects directly from the PC to the IMAP server; Microsoft’s servers act as an intermediary that fetches and serves the mail.

Security & Privacy Concerns

  • Core issue: Microsoft gains full credentials (or OAuth tokens) and can impersonate the user to their mail server.
  • Several comments stress that TLS only protects transport; it does not prevent Microsoft (or anyone who can MitM that TLS session) from seeing the plaintext password.
  • Worry that credentials must be stored in a reversible form server-side to be usable, increasing breach impact.
  • Some admins report already seeing unexpected logins from Microsoft IP ranges and are considering blocking or throttling those connections.

Consent, Legality, and GDPR

  • The consent dialog mentions “synchronizing” email, calendar, and contacts but does not clearly say that passwords/credentials will be uploaded and stored.
  • Many argue this is not “informed consent,” especially under EU GDPR, which requires specific, clear, and revocable consent for such processing.
  • Some believe this behavior could be illegal in the EU; others note enforcement is slow and uncertain.

Comparisons to Other Services & Protocols

  • Parallels drawn to Outlook mobile, other third‑party mail apps (e.g., Spark), and webmail importers (e.g., Fastmail, Gmail’s fetch feature) that also store credentials to poll external mailboxes.
  • Key distinction emphasized: those are clearly “cloud services,” while a desktop mail client is expected to operate locally unless explicitly stated otherwise.
  • Suggestions that OAuth2/XOAUTH2 or client certificates would be preferable to raw passwords, though still not ideal if the provider can impersonate the user.

Impact on Admins and Users

  • Hosts lose direct visibility into client‑server issues because Microsoft becomes the actual IMAP client.
  • Ideas include blocking Microsoft IPs or serving a “warning mailbox” that explains what is happening.
  • Some users report abandoning “New Outlook” after seeing the vague sync warning.

Broader Reactions: Microsoft, Windows, and Alternatives

  • Strong criticism of Microsoft’s “cloud‑first” and lock‑in strategy; some suggest this fits a pattern of centralizing previously local functionality.
  • Many recommend switching to alternative mail clients (Thunderbird, Claws, etc.) and, more broadly, to Linux or non‑Microsoft ecosystems.
  • Speculation (unclear, not evidenced) that such data could be used for AI training or broader surveillance.