Microsoft lays hands on login data: Beware of the new Outlook
Microsoft’s new free Outlook client for Windows, which is replacing the built‑in Mail app and eventually classic Outlook, is drawing criticism for transmitting users’ third‑party email credentials and contents to Microsoft servers for cloud-side syncing. Commenters argue this design blurs the line between a local desktop client and a webmail service, raising privacy, security, and compliance concerns—especially for corporate and EU/GDPR-governed environments—while offering little transparency or user control. Many also complain that the “new Outlook” is slower and less capable than previous clients, prompting recommendations to stick with older versions or switch to alternatives like Thunderbird or eM Client.
Credential Handling & “ShadowService”
- New Windows “free” Outlook replaces Mail and eventually classic Outlook.
- For IMAP accounts (e.g., Fastmail, mailbox.org), the app sends email credentials and content to Microsoft servers via an API path including
/ows/beta/ShadowService/getShadowToken. - Data is TLS‑protected in transit but arrives at Microsoft in cleartext, enabling server-side IMAP access and syncing.
- For Google accounts, some reports say OAuth2 tokens are used instead of the raw password, but Microsoft still holds tokens enabling account access.
Security, Privacy, and Consent Concerns
- Many see this as Microsoft acting as an unannounced middleman between users and third‑party mail providers.
- Critics emphasize lack of clear, front‑and‑center disclosure and opt‑in, contrasting this with explicit “import” flows in services like Gmail.
- Some argue the main issue isn’t encryption-in-transit, but that Microsoft can recover and reuse users’ secrets to poll mailboxes.
- Work environments are reported to ban new Outlook and Outlook Mobile for this reason.
Comparison to Other Clients and Webmail
- Some note that webmail services also handle credentials on their servers, but stress that users usually know they’re using webmail.
- New Outlook is described as effectively a web app (like Outlook webmail) packaged as a desktop client, unlike traditional local IMAP clients (e.g., Thunderbird).
User Experience & Product Quality
- New Outlook is widely criticized as slower, more bloated, and missing established features (e.g., classic message list views, image-loading controls, reliable search).
- Reports of intrusive ads at the top of the inbox and regressions from the older Mail app and classic Outlook.
- Complaints about Microsoft’s pattern of “MVP” rewrites that ship with reduced functionality.
Corporate, Regulatory, and Policy Angles
- A German federal data protection authority reportedly plans to pursue the issue at EU level.
- Some see this as part of a broader trend: aggressive data collection, telemetry, and potential AI training on user content.
Alternatives and Workarounds
- Users mention firewall rules to block “phone home” behavior and sticking with older Office versions.
- Alternatives cited include Thunderbird, LibreOffice (for Office replacement), and eM Client.
- Consensus: third‑party IMAP clients that don’t proxy credentials through their own servers avoid this specific issue.