Outlook: a privacy nightmare

Outlook has been one of the most popular email programs in the world for years. Many people use it out of habit, because it comes standard with Windows, or because they also use it at work. Yet we, as a hosting provider that values privacy and transparency, strongly advise against using Outlook (especially the newest versions) for your own mailboxes hosted at WebOké.

Microsoft always reads along

The core of the problem: your email traffic does not go directly between your computer and our hosting servers, but always through Microsoft's cloud servers.

How does this work exactly?

The newest versions of Outlook (the so-called "New Outlook" for Windows and Mac) work very differently from traditional email programs. What most people don't know:

1. You enter your email address and password in Outlook.
2. Outlook sends this information to Microsoft's cloud servers.
3. Microsoft stores your email address and password, and then synchronizes all your emails (including sent messages and attachments) with their own servers.

Your computer never talks directly to your mail provider's server: Microsoft always sits in between as a hidden middleman.

Microsoft stores your emails, even if you don't want it to

• All your incoming and outgoing emails are stored in Microsoft's cloud.
• Even if you later remove your mailbox from Outlook, your emails and login credentials remain stored on Microsoft's servers.
• You no longer know who has access to your data, how long it is kept, or what happens to it.
• In DirectAdmin you can still manage your own mailbox and change the password, but everything that was ever synchronized via Outlook is also stored on Microsoft's servers.

Why do we find this concerning?

You lose control over your data. All your email history is in Microsoft's cloud and stays there. Microsoft can make changes to your mailbox on your behalf, without you knowing.

Privacy is not guaranteed. Microsoft is an American company and falls under American legislation. Data can be viewed, analyzed or shared with third parties or governments, even if they claim the data is stored in Europe.

It happens out of sight. Microsoft does its best to hide this practice. Many people think they are just setting up an innocent IMAP connection, while much more is happening in the background.

How it normally works with IMAP

With a normal email client (like Thunderbird or Apple Mail), it does work as you would expect:

• Your email client connects directly to your hosting provider's server, in this case WebOké's hosting servers.
• Emails are only on your computer and your hosting provider's server, nowhere else.
• You remain in control of your data and can always access it via DirectAdmin.

Read more

• Heise.de: Microsoft lays hands on login data, beware of the new Outlook
• Office-watch.com: Beware the privacy trap in Outlook
• XDA Developers: Privacy implications of the new Microsoft Outlook