Proton Mail says that the new Outlook app for Windows is Microsoft's new data collection service

Lee Duna@lemmy.nz to Technology@lemmy.world – 699 points –
Proton Mail says that the new Outlook app for Windows is Microsoft's new data collection service - gHacks Tech News
ghacks.net
162

Yeah no shit, and you do think I have a single goddamn bit of influence over my corporation's choice of email client??

They can leech all the data they want from my employer. I don't give a fuck. Never use company assets for personal business as an addendum.

Just be a little more careful with your own stuff, s'all.

Depends on your sector of work. Imagine you’re a therapist or a lawyer…

A lot of healthcare and education institutions use Outlook as well, so I wouldn't be surprised if mental health or legal uses it too. There may be rules about what kind of client/student/patient information can be sent over email, and often there are healthcare/institution specific variants of the office suites which (are supposed to) meet regulatory requirements

I think the other comment applies regardless. Do work things on the work device/account and let the workplace handle any other concerns. When it comes time to discuss alternatives, you can make a case for something else

I mean it even harvests typing data and Outlook also includes calendars etc… It’s really bad.

But yes, I just suggested a re-evaluation of the use of Microsoft Outlook to my company …

What would you get them to use instead? I use Proton personally, but I doubt many companies are using it at scale.

Use geary as a client with a private company selfhosted mailserver.

A company would use a Microsoft 365 plan that includes Outlook for Office 365, not a Windows Mail app. An the MS365 agreement would come with protections of company data from sharing with advertisers.

In other words, I wouldn't worry if my company used Outlook. But never log in to your private mailbox from a corporate device.

Cloud services who want the business of healthcare providers usually offer a separate service for customers who need enhanced privacy.

Google etc have this option.

Also Microsoft has “pay for enterprise control” for businesses. Businesses can pay for their data not to be collected or at least sent to a business controlled server.

All of it is compatible with HIPAA.

There is more than one country on this planet.

Yes, and plenty of them use HIPPA or variants of it as a standard. There will certainly be a control mapping from any other law or standard used and 365 is going to be mostly compatible with them all.

Not trying to dismiss your view, but I am not aware of any country outside US using HIPPA as a standard. I'm also not an expert in this so probably mistaken. Which country are you thinking of?

It isn't HIPAA in other countries. But it is similar enough that you can easily find white papers and crosswalks in compliance communities. The difference between HIPAA and gdpr is mostly informed sharing and where that's permissible https://www.microsoft.com/en-us/industry/blog/healthcare/2018/05/14/gdpr-implementation-hipaa-compliance-what-you-need-to-know/

Linked on that page is a PDF example. The execution and requirements are mostly the same.

I see what you mean yes. Some common principles can be found outside of the US

There are different versions of Outlook depending on your subscription. Companies that do things properly, never see the problematic, "free version" of Outlook. They have very fine control over the features and data collections they enable.

pretty sure when you bring that up to your company, that another company will have access to internal communication, that they will do something against it. It's a willing data breach.

There's no other company with all the required certification that can replace Microsoft office suite so all corporations are stuck with it and tbh nobody cares.

Perhaps nobody in the US or in jobs with non-sensitive data cares about that. In the EU this could backfire hard against Microsoft.

There are plenty of other services that have the compliance check boxes. Most of them are garbage, expensive, and don't come with 5% of the other tools that MS does.

There is a choice, and companies choose ms because it is best.

well, as far as you use it just for your work, who cares, right? It's the same as I'd never use Lastpass, my corp use it and even offered it for our personal use :D thanks, but no thanks! For personal use I would never use any microsoft solution.

No shit. There's a reason they are killing the nice and simple Windows Mail app; it allows you to sync with your email without Microsoft servers between.

Also, the biggest issue for me is the UX. I use outlook for my work email and like to separate my work and personal life, so soon I just won't have an app for my personal email on my PC.

If anyone knows of a similar windows mail app with good touch support and without such a traditional mouse designed UI, please share it.

The new thunderbird UI looked neat and modern.

They're still working out some kinks, but yes, the new UI of Thunderbird 115+ is pretty good.

Thunderbird has a new UI?

I'm on 115 and i dont notice anything different from how its always been.. (This isnt some joke, or insult, or anything. I genuinely don't notice anything different?)

If you update from a previous version then it configures itself to be similar to the old UI. If you do a clean install it looks very different.

I've been using Thunderbird since forever. It's not perfect but I like it better than bloated and laggy Outlook.

I've been paying for mailspring for a few years now, and I love it. It has touch and gesture support, is open source, and is available on Windows, MacOS, and Linux.

Its paid plan includes some nice features like email tracking - which you can't really get from just a simple client and (needs a server to track who has opened an email and when) - and id lookup, for things like quickly seeing the LinkedIn profile of a sender not in your contacts list.

Definitely my favorite desktop client by a wide margin, and one I would recommend wholeheartedly.

Edit: Just to be clear, it's available for free as well.

Thank you for actually reading my comment and suggesting something appropriate, though I'm not convinced by the UI images. I'll have to test the touch support myself, but I'll check it out.

Is it a local-only client, or does it download email on their cloud servers first?

Local only.

Even if you pay for their subscription, when you get to a new computer you need to manually authenticate with each service. But, it remembers which accounts you have, so it's faster than manually setting up each account from scratch. Basically "we know you have Gmail, xmail, ymail - tap each account to reauthenticate"

It's a good way to have (part of) the convenience of a cloud service, while combining it with the security of local only clients.

Edit: all of this is optional, you can choose not to let their cloud service know of any of your accounts.

I really liked the mail app, the outlook one sucks

What especially galled me was as I was updating my laptop before flashing to Linux the new outlook will not work unless edge installed, I had just uninstalled that pile of garbage.

Ah well, at least pop_os works great 😃

If you're still using Windows 11, they're still collecting your data. Sure, no need to give them more, but maybe that's the push you need to move elsewhere. There are really good options.

Wino Mail has a pretty good UI similar to the Mail app. You can find it in the Store.

What part of Windows (or Microsoft software in general) is not a data collection service?

If you aren’t using an insider edition then Notepad is still safe

... for now. They've already replaced the old Notepad with a bloated UWP version, so it probably won't be long before it starts sending telemetry as well.

bloated?

I think then new Notepad is just perfectly fine.

The tabs are nice, but I notice it takes 3x as long to open (TBF it's still under a second) and take up 10x the memory (12MB vs 1.2MB), for basically doing the same thing as the old version.

When I look at my Pi Hole dashboard while my girlfriend's Mac is booted, I'm surprised by how many requests are blocked, given that apple somehow has the reputation of respecting their user's privacy.

And when she boots into Windows 10 MS's data stealing gets downright creepy.
I am lucky enough not to have a Windows 11 PC on my network but I think I would see even more denied requests.

Outlook honestly was not that bad for a while, but of course Microsoft does what Microsoft does. I've been using Thunderbird for about a year now and it is very full featured coming directly from outlook.

I use Outlook on my work Mac, and am forever amazed at how hard they pushed on getting me to switch to "New" Outlook, but how many features they never bothered to port over. Like, I can't export my mailbox without having to switch it back to 'old' Outlook. Calendars straight up don't work half the time and there's no obvious button to switch from a list of events for the month, back to a monthly calendar view.

Outlook for Mac is a fucking mess. I really do need to switch over to Thunderbird.

Does thunderbird support exchange protocols or just IMAP

I use if for exchange and gmail - it's pretty robust. Plus, they are approaching completion of their mobile app which has similar capabilities

Looks like it uses IMAP. Nothing wrong with that. It is just common practive when locking down Exchange Online to tick the box in Conditional Access that disables "legacy protocols", which includes IMAP. I've been using eM Client which uses EWS but doesn't support push-mail so still on the look-out for something else.

What was the hardest thing about the transition?

Personally, i got pretty used to the focused view from Outlook. Other than missing that, it's been pretty great.

For a few years, I had hope that Microsoft would become a respectable, user-oriented, even FOSS-friendly company, but they finally seem to have settled on AI enshitification as their main business model.

FOSS friendly company

I'm not sure what you are smoking but you're high as balls dude. If there is any company that has as it's motto "fuck and destroy open source" and as slogan "fuck everything for money", then it's Microsoft.

Microsoft paid SCO to make false claims against Linux in an attempt to destroy Linux and extort large companies away from Linux. The destroy part failed, but they got multiple large companies to steer away from Linux. Normal people would go to jail for that, Microsoft execs not so much.

Totally agree with that. MS is an evil fuck company hellbent on destroying Linux from the inside. But Linux is not a container or box or thing one can just destroy. It's been fun watching them support Linux to try to infiltrate something. They haven't realized that there's nothing to infiltrate.

They haven’t realized that there’s nothing to infiltrate.

There's always something. The whole point of infiltration is that it shouldn't be detected until the frog is edible.

Ridiculing one's enemy is just always the wrong thing to do, no exceptions.

They're latest strategy is to be FOSS.... Ohh look at us! We can run Ubuntu from Windows now! We give money to Foss for development. Let's give foss GitHub so they can store all their software safely with us!..blah blah bam! Let's make this free software not free anymore...let's fire these key Foss people...let's make GitHub hard to access. Microsoft is a sneaky bastard for sure.

To be fair, Microsoft is a big company with various divisions. Parts of Microsoft are doing really great work in the FOSS area I would say, but really only if you're a developer. As a general user... they do kind of suck yet.

WSL was a good start, change comes slowly to monoliths but they always have shareholder value as their defining principle so it’s a real tightrope.

Change to Linux on main PC when?

When gaming is 100% the same on Linux you'll see more people pick it up.

It's already happened — 90% of games will work flawlessly now on both Windows and Linux. It's just that the remaining 10% are different on each platform, for various reasons. Pick your poison. Usually it's those 10% that will dictate the decision for you — but the OS itself has stopped making a difference for gaming years ago.

I mean... Yeah.

Thats what i thought but holy shit its so much worse.

Its not even data that is needed for outlook but like pretty much everything on your pc.

including your username and password, send in clear text

I agree with the article’s statement. How the fuck is this legal.

Wait what I just thought this was another round of whining and clutching pearls over microsoft stuff being spyware but thats actually fucked.

You thought until now people whine for no reason?

People whine about the same thing over and over and over, somehow acting shocked and outraged when microsoft does each month what its been doing for decades. Make their product somehow even more shitty and erode their customers experience so they can sell you the same product with a new paintjob. Big tech sucks, they want to squeeze you dry for every nickel you ever owned, and your private information too. Its sold to anyone who wants including your government and they don't even bother storing it securely. You know this. I know this. Even the average non tech person knows this. We've all known it for a very long time now.

Don't like it? Too bad, not changing any time soon. Kind of just have to accept microsoft cuckery if its for your work. For personal use though theres always the option to switch to linux, start using open source software, and get a new email through a public acess unix server like tilde.team

But no, theres always some excuse lazy and stubborn people unwilling to compromise have, to not do any of that either. Cause that one videogame you really like doesn't work on linux cause shitty anticheat, or you think you need that one adobe product that does have open source alternatives but aren't as good as a corporate product, or your online accounts are already tied to gmail/outlook and it would be too much work to switch it all over to a new email. Options exist, people just don't want to take them up because they can't stand being inconvinenced or relearning their computer software.

So I have no more sympathy for people who willingly use windows or outlook or youtube or any corporate product and then wonder why that product continues to get worse while they charge you more money for it + a subscription now.

Sorry for the 5 paragraph essay, I guess im just tired of seeing the /technology outrage circlejerk about this weeks episode of 'corporate products are shit and getting shittier by the day'

Hey Proton how about you quit privacy-washing and actually prioritize and release feature parity products for Linux so your customers aren't being herded onto windows' data harvesting platform just so they can use your supposedly privacy forward products

I don't use proton so forgive me if this is a stupid question...

But do you need an app? Can't you just use whatever browser you want for their services?

Of course you can access everything through the web on Linux. I really like Proton's web mail interface. Unfortunately, Proton does not have a Linux analog to their windows client that provides automatic file syncing. I think that what the commenter is complaining about.

There is a dedicated Linux client for Proton VPN and in my experience it integrates quite well on Debian-based distributions.

Also, there's Thunderbird if you NEED a fat client for your email. Except Proton's strength is where the service is located and the security of access. Having a full copy locally on your system kind of defeats that.

If you have properly implemented LUKS I don't see any reason that should be a concern.

Unless you also employ very strict sandboxing, a rogue app or script could read those emails from your running system while LUKS is unlocked. There are plenty of CVEs relating to code execution; an infected JPEG, browser exploit, or any number of other things could expose your Thunderbird email database or the running memory to an attacker, particularly if you use "secure" services like Proton because you're the kind of person who would be targeted by state actors.

1 more...

You need a special app that they call a "bridge" because Proton doesn't support normal IMAP and SMTP, so you have to use the bridge to be able to use normal email clients.

But they are now porting their webmail as a cross-platform desktop Electron app, after which they'll just likely discontinue the bridge "for safety". And so this issue will become moot.

I'm grateful you put "for safety" in quotes there. That's definitely bullshit talk. I'm further grateful that I just self-host my email. I can skip the bullshit of companies making random decisions that are ultimately against my wishes.

1 more...

The Linux Experiment recently interviewed the CEO who answered this question.

Basically it's the same as anything else. Linux requires more effort to code for due to its variety of distributions, and has a significantly smaller userbase.

In short, don't blame Proton, blame the (lack of) users.

That's a bullshit excuse. Looks at Arch's AUR. Look at Gentoo's guru. What happens for proprietary stuff is a deb or rpm package is downloaded, extracted and files copies where they should be. That's it. And it works, because the cornerstone of the system is libc and the kernel. And these, for the overwhelming majority of applications, behave exactly the same on all distros.

I think the bigger issue is the variety of distros that end up not being compatible. Even if you overall have a lot of Linux users if they, for the sake of argument, distribute evenly between all distros then it's still a lot of effort to code. The only difference is that the argument will change from "Linux has a small userbase" to "Distribution X has a small userbase".

Linux doesn't just need more users to be worthwhile to develop for, it also needs a distro agnostic solution to run software. That or significantly reducing (or streamlining) the amount of distros so the developers would have far less configurations to account for.

Flatpaks and nix packages work on pretty much every distro.

I mean, can’t you just package your app in flatpack or even snap? Bam, your app works on 99% of distributions for little effort. That’s what Spotify does, and I’d argue they have even less incentive to support Linux than proton does

Spoken like someone who has never developed a app package

I don't know, I'm not a developer. Lots of companies don't make their products available on Linux, most cite similar reasoning, so it's unsurprising. But I agree it's disappointing. I really wish Linux was more user-friendly.

He also answered this claim, it is right for apps that aren't stuff like Proton VPN that can't work in a sandboxed environment. They are working on it iirc

Sure, as long as you don't need any integration with other software, don't need arbitrary IPC, and actually keep some dependencies in line with some common denominator because there's only so much you can do with static linking (oh excuse me, distributing the shared libraries in the same package as your binaries as if it's a new thing) once it reach the "program must actually run" part.

Flatpack and every other similar solution that are described as "works everywhere" always come with a heck of limitations.

I finally said screw it and am leaving Proton for a proper paid service. I never upgraded Proton to a paid tier because it never matured enough for me to use for real. I never once migrated contacts over to it (just a couple people who understood I was testing it).

Yea, so there's a connection to my credit card. At least it's with a professional org that has proper modern mail management (something post-2000), and gives you tools to manage your email.

I really wanted Proton to work out so I could recommend it to friends and family. But it's a terrible user experience. I missed 50 emails because it keeps moving them to spam even after I set the sender as not spam. Oh, and spam management requires (according to support) logging into the web, not thru the mobile client. 🤦‍♂️

Can you imagine telling a customer this with a straight face and not seeing a problem with it? I'm using your app and can't manage spam?

I mean, this is the mail service whose own docs candidly state that their mobile app "sometimes doesn't work". 'Nuff said.

Don't worry, they're preparing to discontinue all their desktop-native apps in favor of webmail (and webmail running in Electron).

After which I expect they'll start squeezing their paying customers, since they won't be able to leave anymore. Or sell the company, get out with "clean hands" and a wad of cash, and let someone else do the squeezing.

1 more...

I got a popup saying "wanna try the new Outlook app"? So I did and the fucking thing immediately inserted ads that resembled email into my inbox. If this is the future I'll install Thunderbird.

Thunderbird is great!

This is why I don't get excited when I hear some software that I already use and works fine gets an update. More often than not the update makes the software worse.

It used to not be the case, but as of the past decade or so, it seems like more and more software is getting lower quality or substantially bug ridden. Not just on windows either. It's everything now.

Back in the day, each update used to fix bugs, add genuinely useful features, and were eagerly anticipated. Now, I get to do lovely things like RMA a bricked steam deck on stable channel or listen to New Teams' ringer doubling, once before a call is picked up, and ringing again after the phone is answered. I wish I was joking for either of these.

It’s basically gmail. It’s a web/email server that you give your creds over to . It has an offline mode that I guess makes it an app.

Yeah they read your shit.

For consumers, yeah they scan your shit to sell advertisements to you. For Business customers —that could get real illegal real quick.

MS has much better privacy for licensed customers. It’s well documented and in their MSA.

I am aware this comes from a competitor and they want to go all out. However, what is unclear to me, does this also happen to paying users?

For my small business I use Office 365 Business Essentials, whatever it's called now, the cheapest one. Been using it for many years and for the price/features, it's pretty unbeatable. I use the new Outlook on my workstation since a few months, it's pretty slow and not feature complete but was ok. I'm in the EU and haven't been prompted with that window where it talks about advertisers. Will check Monday if I see a list of advertisers but I think for paid users it's not the same.

For personal mail, I use Thunderbird, I even donated to them. I like it but would have been great if it had a view like Outlook. At the moment it has table view and cards view. Wish the cards view would more customizable.

Proton has a business plan, too.

I know but I don't see any benefits to switching. It's a little more money for fewer features and it's still a somewhat new product.

I've read some reviews and a lot of people complained about their mails not being sent/received. Might be a limited thing but my email is working so I don't feel brave enough to start messing around with it and clients not getting my emails.

As if the old outlook app wasn’t as …. Oh Shit! This is more egregious

Uninstall that shit.

Edit: if you HAVE to use Outlook (because of work, etc), use the web version of it exclusively.

I give the web version credit, it's pretty swell.

The web version and the new version look and feel nearly identical for me. Been using it at work for 6 months now.

What's the privacy conscious, and future-proof way to have email, that isn't as crazy expensive as Proton?

Yeah, that update was the final push that moved me to Linux on my primary computer. I’ve used Linux for about 20 years on everything that wasn’t my gaming PC and between the advancements made by Valve and the increasing invasive nature of Windows put an end to my relationship with Microsoft.

I liked Windows Mail for its simplicity but between the ads and the tracking for Outlook I guess I'm moving to something else. Now I understand why my mail accounts give Oauth or temporary passwords to external clients, because otherwise M$ would have them.

TBH when I got this exact pop up on my last windows laptop (dell xps13) I actually panicked and installed PopOS on it.

I didn't feel like distro hopping, I just needed it to work. I guess that shows how I feel about PopOS at the moment.

Hey at least you picked a great distro to settle on!

As someone with an iCloud account, every time I try to use Outlook it randomly deletes emails from my iCloud account. I’ve posted this multiple times on Microsoft support site with others confirming and since it’s been more than year with no acknowledgment or fix I am convinced it’s a feature not a bug. YMMV.

Just stop using it with outlook then?

I wasn't asking for your advise but was merely pointing out experience that others may not want to repeat. I don't use Outlook at all.

You sure you did not use POP3?

Yes I went over all settings multiple times with Outlook support. It's a bug/feature they are not interested in fixing.

On that topic, is there an alternative for a mail client + calendar for Win 11 that doesn’t look and feel like a Windows 95 exe named Thunderbird?

Thunderbird did get a UI overhaul semi-recently so it might offer what you're after now.

I also liked eM Client which has a free version.

This looks like Win 95 to you?

To be fair, that is the concept art, the real thing looks more like this:

thunderbird interface showcase from official blog

Certainly not Windows 95, but not as good as the concept art. Yet people still complain A LOT, because it breaks theor two decade old CSS and "looks like a electron app" (whatever that means...).

If someone tells me "it looks like an electron app" I assume they mean "doesn't have a native window bar"

Actually this the first time I noticed Thunderbird don't have a native window bar LOL.

Like who looks at window bar all day?!

There’s surprisingly few standalone email clients for normal people on desktop platforms as far as I know.

I’ve been using Thunderbird and loving it. They’re developing a mobile app now as well!

Is there a solid alternative that isn't as prohibitively expensive as Proton? It's like, stupid expensive, even for basic email service with very small storage

It's almost as if Microsoft doesn't do that already!

Like if proton was a VPS kind of thingy, even like some form of managed mail service through a docker container or something, where the user had control? That would be nice. But even then, who's to say they aren't monitoring the mail communication from the other end of that? You can't really trust any of these mail providers, because they simply have too much control over the days.

No sh*t.

But, TBF, email as a system doesn't need ProtonMail too to be kinda private.

PGP, mixmasters, all those things born around the same time as me.

That's if we lived in a world where "key party" weren't perceived as related to sex.

Unlike proton mail , microsoft offers basic IMAP POP functionality of its desktop app for free, Maybe proton should offer the same "essential" email functionality for free before criticizing Microsoft. there are many ways to monetize a service without rendering the free version legless.

there are many ways to monetize a service without rendering the free version legless

Like Microsofts data collection for targeted advertising?

Proton encrypts and decrypts your data on your machine. The secure key for this lives on your machine and never leaves. Proton do not have a copy of your key because if that key is shared with anyone, human or program, then it is no longer secure. In order to build the feature you're talking about, that security would have to be broken. Not changed: broken. Made ineffective. Thus defying the entire point of the product.

I recommend further study. This will get you started: https://www.eccouncil.org/cybersecurity-exchange/cyber-novice/free-cybersecurity-courses-beginners/

just let me encrypt my data locally. I don't trust their obfuscated JavaScript to handle my encryption keys. Give me IMAP and I'll use my good old client with my OpenPGP plugin.

Your data is encrypted locally with Proton. Your second sentence is what you really mean, and I'm not saying you have to use or trust Proton, just that because of that local encryption of the data, third party apps can't access the data.

Your described setup takes knowledge (and patience!) which customers of Proton do not possess. If you do, Proton is not the product for you, but it doesn't matter because you can build and maintain what you need.

It's in the works, paid users can test. Then it'll be a free desktop client.

They have had desktop bridge app for years but it is only accessible to paying users.

I'm surprised that the developer of a privacy-focused product would accuse its competitor of not being good for privacy.

PROTON WORKS WITH THE FEDS PROTON WORKS WITH THE FEDS PROTON WORKS WITH THE FEDS PROTON WORKS WITH THE FEDS ProtonMail Gives Up Logs on User, Then Scrubs Website of No IP Logging Claims it gave out thousands of ip adresses over the years

You understand how the internet protocol works right. This argument has been going for a long time now. Yes, they gave up IP address because they couldn't win in court. They're like the only company who will fight tooth and nail for you in court but the feds ordered them to do so, so they had to comply. The messages were all end to end encrypted and other than what metadata was requested, they didn't get much.

Edit: Additionally, if you use protonvpn, mullvad, or any no-log vpn, you would probably be immune to this.

Yeah, based on a legal request - that's how it should be. Our problems are not police listening in on criminals but unwarranted mass-surveillance.

Email by its nature is not private or secure. You can do all sorts of things to try and make it private or secure but at the end of the day it's still email. It's going to sit somewhere plain text.

If you want a secure communication channel use something like signal.

People spend a lot of time and money trying to fight with the nature of email.

That's my problem with proton as their marketing would lead you to believe their email is completely encrypted. Their marketing really needs a asterisk that tells you exactly what is encrypted and when.

They did not disclosing any content of any email. They disclosed the very little they have. Once they have been forced to log IP addresses and that was turned to law enforcement, another time they were forced to disclose a recovery email address. These facts if anything should help build trust in proton, as they show how little they collect and therefore can disclose. With signal is the same, they collect super minimal info (the time you last logged in and a couple more data points, I think), and that's what they disclosed in the past.

It's a non-news.

3 more...