Shib for Skype

[Cantor, Scott]

> Never actually touched ECP configuration before... but that is a great hint!
> Hmm..then might be ADAL it is...

ADAL is web based.

ECP is used in O365 to support non-web mail clients on other platforms via a proxy and they use the same approach with a WS-Trust proxy if you use ADFS. In short, Microsoft does not support a model whereby you can prevent the passwords from reaching their servers. In my view, that renders most of this a waste of time, since if you sync passwords to them, they're stored in a pretty secure fashion. The risk is in transit, and somebody attacking those proxies on their network as a choke point to harvest millions of passwords, and that is unavoidable unless you just force webmail on people and block mobile mail clients.

SSO is nice, but is it worth the hassle of dealing with O365 in the end if you still end up handing them your passwords? I think reasonable people can differ on that and people should certainly understand this issue before they make a decision.

-- Scott