Reminder: Checking E-Mail Clients Reminder: Checking E-Mail Clients

Through the use of cloud-based e-mail clients, such as the new free Outlook app and other e-mail clients (see below), secret login data and e-mail contents can get transferred to third-parties without notice (see news from December 6, 2023). Using cloudbased e-mail clients and backup programmes poses a significant threat to the university data and information security, from the perspective of the IT security and the data protection officer at the University of Bonn.

The paid for Outlook programme (from Microsoft Office) is not affected. It can be used further. Currently, there are no security concerns, as these applications communicate directly with the e-mail servers of the University of Bonn and no data is transferred to the Microsoft Cloud. 

To prevent disclosure of login-data and data outflow, using the following programmes with your Uni-ID is not allowed because of informations security and data protection reasons, in accordance with the HRZ user regulations (see § 3 Para. 2 Clause 5) and must be discontinued immediately: 

• Outlook-App for Android and iOS,
• "New Outlook for Windows" (included from version 23H2 in Windows 11),
• Windows Mail (predecessor of the "New Outlooks")
• Outlook for macOS (when using IMAP with CloudSync),
• Google-Mail (Cloud- and POP3 direct access),
• Edison Mail,
• Newton,
• BlueMail (under certain conditions on mobile phones),
• Spark und
• Xiaomi Mail.

What to do now?

Should you use one of the applications mentioned above, please change immediately (as mentioned in the news from January 20, 2024) to another product and change your Uni-ID password afterwards.

The HRZ will block the retrieval through cloud based E-Mail programmes from the 30.03.2024 by enforcing appropriate technical measures. This means that afterwards you will not be able to receive or send e-mails through the aforementioned applications.

Security risks also with cloud-backup

Please note that backup applications from Google and Apple are also categorised as highly problematic and must not be used, when they lead to outflow of university data (incl. login-data) to external cloud storages.