1

Is the following an appropriate question for Security.SE? If not, can you suggest the right place?

When viewing message in Outlook 2013 (getting it's mail from Exchange 2013) there is an small link in near the header with "Bing maps" link. After clicking on that link the app does some thinking, emits a message like "we think we found an address", and then shows an embedded map of the address found.

Bing Maps link in Outlook 2013 (click through picture for MS page on Outlook apps)

Going to Outlook's Manage Apps page connects to the Exchange server where one can eventually find some info on the Bing Maps app, and enable/disable it. Under permissions it says

"When you click this app, it will be able to access limited information in the active message, such as phone numbers, postal addresses, or URLs in the message body or subject. The app may send this data to a third-party service."

Bing Maps app info from OWA

My question is: Where exactly does the "is this an address?" calculation take place -- Outlook, local Exchange, Microsoft HQ, or undisclosed 3rd party service -- and what are the information and/or security risks associated with it?

My concern is that when clicking on this link the content of the message (and it's headers? and other messages in the thread? and my current location? ...?) is sent off premise, e.g. beyond our locally hosted and secured Exchange server to Somewhere Outside, perhaps many parties.

I'm just an end user, and have nothing to do with the our Exchange server. I'm not automatically against an app that (possibly) shares information externally. I just want to know how it functions, so I can decide for myself when it's appropriate to use or not use the feature. 99% of the time for my email it won't matter. However I have colleagues who deal with things like personal medical info of others for whom this might be a very big concern.

1 Answer 1

Reset to default
2

It is not very in topic here, not because it has nothing to do with security, but because the message actually tells you the data can go to Microsoft or any third party they want to send it to.

We have no way of identifying which third parties here, so cannot answer your question as to where your data will go.

2
  • the question isn't so much about "to whom will it go", but what, exactly, is sent. Is the whole message sent off site or is most of the scanning done locally? (where the exchange server is considered local) I guess it just requires too much inside knowledge to answer. In any case, thanks for answering whether it's an appropriate fit for Security.SE
    – matt wilkie
    Mar 5, 2014 at 17:47
  • If you want to ask the question, "What is sent" then that is almost certainly answerable on Stack Exchange. Probably not Security, as it's a basic computing question - someone could easily sniff the traffic to find out.
    – Rory Alsop Mod
    Mar 5, 2014 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .