Outlook service is storing decrypted password in server memory – how insecure is it?

Question

I am evaluating the possibility of using Outlook mobile client with an on-premise Exchange 2013 server. However it seems that the app sends quite a bit of data to Microsoft's cloud servers. It also stores users' decrypted passwords in the cloud server memory. From the TechNet article:

After the Outlook service has decrypted the password at runtime, the service can then connect to the Exchange server to synchronize mail, calendar, and other mailbox data. As long as the user continues to open and use Outlook periodically, the Outlook cservice [sic] will keep a copy of the user's decrypted password in memory to keep the connection to the Exchange server active.

This bit worries me in particular, but I'm not sure why. Can somebody please explain whether this is a big security risk? Is Microsoft's design acceptable, or bad enough to abandon the idea of using Outlook for mobile? Which factors should I consider?

Answer 1

I believe it is fairly standard to keep secrets in memory. Why it is generally better not to store passwords themselves, but rather use tokens/keys, it is not too bad IMO. The app has to store some kind of authentication token/key anyway, so by not using password, the only gain would be that an attacker capable of obtaining said key/token would loose access after the key/token were changed (you logged out). Because they would still be able to access your current and old mail at least until you logged out/had to type password again, this would be of little comfort.