News for hackers. Stuff that matters.

A comment on OneDrive File Picker Flaw Provides Apps Full Read Access Entire OneDrive.

Re:OneDrive File Picker Flaw Provides Apps Full Read Access ... by pawanjswal on Monday June 02, 2025 @01:42AM (#44156078)
It's hard to believe that the OneDrive File Picker still doesn't have fine grained OAuth scopes in 2025. Allowing read access to the whole drive just to upload one file goes against the principle of least privilege.
[ Parent | on HN ]
Re:OneDrive File Picker Flaw Provides Apps Full Read Access ... by hulitu on Wednesday June 04, 2025 @06:09AM (#44179098)
> It's hard to believe that the OneDrive File Picker still doesn't have fine grained OAuth scopes in 2025

We are talking about Microsoft here. Me gets a new laptop, company allows SW instalation only from an internal portal, i don't find Teams there, i ask a colleague how does one one install Teams: IT said to download it from microsoft.com. ROTFL. Of course it does not need "elevated priviledges" to install. Of course it is installed for every account on the computer and has access to all user files. But some people still _believe_ the (first appeared in Win95) "most secure Windows ever" lie.

[ Parent | on HN ]