EU Parliament, Universities Warned Against Using Microsoft's Mobile Outlook App

[6Foot2]

Link: EU Parliament, Universities Warned Against Using Microsoft's Mobile Outlook App

 

"...Many in the EU Parliament, as well as in universities throughout the world, use Outlook, whether on the desktop or mobile. The security concerns exist only for the mobile app so far. This appears to be because it's not a Microsoft-built app; it was Accompli, which Microsoft acquired back in December. Microsoft then renamed the Acompli app to "Outlook for iOS and Android" but kept all of its functionality (including the intrusive privacy policies) intact..."

[Arthur]

The main issue is that even if a company has its own email servers' date=' the email data first goes through Acompli's (now Microsoft's) servers, where it's copied, indexed and saved for later use. This was described as a "feature" in Acompli's privacy policy that allows email to be delivered slightly faster the next time it is accessed. Microsoft currently doesn't have such a service for its desktop Outlook, so this only happens when the mobile app is used.[/quote']

What about other e-mail services like CloudMagic that also index and save your e-mail on their servers (and store your username and password if your e-mail account doesn't support OAuth). Why isn't anyone making a fuss about them? It all seems like double standards to me.

 

https://cloudmagic.com/k/privacypolicy

 

Accounts are added to CloudMagic through OAuth authentication (where possible). OAuth is a secure mechanism which gives us access to your data without letting us know your password.

 

Where OAuth is not supported, we keep your account username and password in our secure servers.

 

 

Another security issue is that both the username and password would also be saved and accessed by Acompli' date=' which is why the IT departments of the EU Parliament asked for a password change. Acompli and Microsoft now know the login credentials of the people who have been using the mobile Outlook app. The app also collects other sensitive information, such as contacts and calendar data.[/quote']

Not for Google accounts since they authenticate using OAuth.

 

www.acompli.com/privacy-policy

 

Some email accounts (ones that use Microsoft Exchange, for example) also require that you provide your email login credentials, including your username, password, server URL, and server domain. Other accounts (Google Gmail accounts, for example) use the OAuth authorization mechanism which does not require us to access or store your password.

Edited February 10, 2015 by Arthur