I am evaluating the possibility of using Outlook mobile client with an on-premise Exchange 2013 server. However it seems that the app sends quite a bit of data to Microsoft's cloud servers. It also stores users' decrypted passwords in the cloud server memory. From the TechNet article:

After the Outlook service has decrypted the password at runtime, the service can then connect to the Exchange server to synchronize mail, calendar, and other mailbox data. As long as the user continues to open and use Outlook periodically, the Outlook cservice [sic] will keep a copy of the user's decrypted password in memory to keep the connection to the Exchange server active.

This bit worries me in particular, but I'm not sure why. Can somebody please explain whether this is a big security risk? Is Microsoft's design acceptable, or bad enough to abandon the idea of using Outlook for mobile? Which factors should I consider?

  • it's difficult for computers to do things without RAM, and if your RAM can't be trusted, you probably got much bigger issues than an outlook password. – dandavis May 20 '18 at 20:42

I believe it is fairly standard to keep secrets in memory. Why it is generally better not to store passwords themselves, but rather use tokens/keys, it is not too bad IMO. The app has to store some kind of authentication token/key anyway, so by not using password, the only gain would be that an attacker capable of obtaining said key/token would loose access after the key/token were changed (you logged out). Because they would still be able to access your current and old mail at least until you logged out/had to type password again, this would be of little comfort.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.