I decided to switch my custom domain from Gmail to the new Outlook.com and used Windows Live Admin Center[1]. After changing my DNS settings to verify that I own the domain, it gave me an option to add a current email account to this domain. So I typed in the email address that I typically use.
When I opened Outlook.com I noticed that someone else's name was showing up. I went to the profile and changed it. Then I went to the People section and noticed there were a lot of contacts listed (a couple of hundred probably), and someone tried to talk to me on Messenger. This seems like a pretty big bug. I'm not sure if it imported the wrong data into my new account or if it linked my account to this other persons. Either way, pretty big security concern.
However, I would never ever change my primary email to a new service that has not really been tested in the wild yet. Maybe in six months or a year, if everything runs stable by then.
Go to the little gear in the upper-right corner next to your name and click "Feedback" in the resultant popup. I don't know the exact details of your email address and the steps you took to get into this state, otherwise, I would just provide feedback myself.
Disclaimer: Microsoft Employee. Not part of the team that made this.
I wish I had been paying more attention while I was doing it. I know that I did these three steps
1) Added my personal domain to the domain list.
2) Inputted my me@mydomain.com email address into some form.
3) Went to Outlook.com and saw someone else's name, and some else's contacts.
I'm pretty sure #2 is where the problem occurred. Hopefully someone at Microsoft familiar with the process will be able to figure this out. I'll provide the feedback.
While on the topic of things to fix: When I was signing up, I hit a 16-character password limit.
Now, could anyone explain why you would put a limit of 16 characters in a password on a modern web-service? Don't the recommendations for a very safe password normally specify more than that?
I see much reason for setting a minimum amount, but not a maximum of less than a hundred characters (to give some room) at least.
I completely agree. It's ridiculous...but that's Microsoft. And I'm not just bashing them here. It seems to be something about how they implement passwords. When I was doing research for Cryptasia, I found that Hotmail/Live was by far the most restrictive of any service out there--and I was examining at hundreds. Only banks (lol) come close.
You should always limit the password length to whatever size at which the underlying storage or scrambling mechanism stops working or loses entropy. Likely, Microsoft uses a shitty hash function to scramble passwords.
The common gospel around here is to say "Use bcrypt.", but very few people say (or know?) that its maximum input length is 55 bytes, i.e. 55 ASCII characters, or far fewer unicode characters. Most implementations actually cut off the remainder, which is a very dangerous thing to do since you might have people who use a relatively simple passphrase followed by a strong password which happens to be beyond the maximum length, and is lost.
For most other hash algorithms, if you use a hash function with an output size of 256 bits, you will lose entropy if the input contains more than 256 bits of entropy. It is a little hard to measure what the maximum length should be for e.g. passwords, but the length should almost never be unlimited. It conveys a false, and in some cases, e.g. with bcrypt, quite dangerous sense of security.
Er, wait a second, how is it even possible that they validate my login just typing the first 16 chars of my old (longer) password. Were they clipping passwords to 16 chars before and not telling anyone? That sounds bad, but the alternatives sound much worse.
It took me a good 10 seconds to locate it. Also, I signed in with my Microsoft ID which was confusing as it logged into outlook using my existing, non-microsoft email. If you don't have an @outlook.com email, it'd be nice for them to pop a prompt.
If you create a new account, it will allow you to select an @outlook.com email address. There is no ajax on the account name, you'll have to enter the captcha to know if your chosen email address is available.
- Click your username in the upper right, click sign out
- click the 'sign in' button on the next page
- click the white 'sign up' button on the bottom left
- see @outlook.com text box four entries down
Yea, re-typing that captcha about 9 times was the most annoying part. (I only tried 3 different addresses, but it didn't like what I typed in the captcha the other 6 times.)
You can sign up for a new one on the outlook.com site but I have no idea how to migrate an existing hotmail.com address to outlook.com.
I can't even get to the new outlook.com with my hotmail.com address; it was only after creating a brand new outlook.com address that I was able to see what all the fuss was about
You should simply be able to do it by: logging in into your hotmail account and going to http://outlook.com while still logged in. After that, go into mail "More mail settings" (click on the upper-right gear) and choose "Create a Outlook alias" if you want to add e-mail aliases @outlook.com
But now that you already signed up for a new account it may not work straight away...
I think they should also fix the inadvertent unselection of selected messages when you switch pages. And the weird ajax delay when deleting messages, during which the old messages are still visible and can be reselected briefly, before they disappear. The whole thing feels plasticky to me.
(I just spent a long time browsing through and deleting the ~3000 old spam messages in my Hotmail inbox, ~30 at a time. I much prefer the feeling of control and stability that Gmail gives you when doing something similar.)
There's actually alot of things they could fix to improve the user experience. Just signed up for an account and it wasn't overly pleasant.
List of a few gripes:
* No ajax on name availabilty
* very limited secret question options ( min of 5 chars for answers)
* Wasn't overly obvious which fields were required until you hit submit ( in the end I think they were all required)
* Initially there was a smug looking guy on the login page(pretty nitty picky) he seems to be gone now but if goto www.outlook.com you get a broken image
I don't think it would need to be a button. But I would place the 'Send' item in a corner, either by moving the Outlook logo to top-right corner, or by moving the items to that corner, and reversing their order (so that 'Send' would be the closest to edge).
I don't see Microsoft's name or logo anywhere in the outlook.com interface. I do see Google in Gmail however...
This is a refreshing take on email, I have been growing tired of the sluggishness of Gmail myself. I also like the way the ads look on the right and when you hover you see an image of the product. I have always hated the way Google ads look.
The top bar seems to be the place where all action items are like sweep and delete so that is where I looked first and found it. I prefer the way outlook application has it though. A big button right in the front.
When I opened Outlook.com I noticed that someone else's name was showing up. I went to the profile and changed it. Then I went to the People section and noticed there were a lot of contacts listed (a couple of hundred probably), and someone tried to talk to me on Messenger. This seems like a pretty big bug. I'm not sure if it imported the wrong data into my new account or if it linked my account to this other persons. Either way, pretty big security concern.
[1]https://domains.live.com/manage/default.aspx