OneNote sharing security flawed

Question

Maybe I am missing something but here is the scenario I encounter, which makes me wonder if OneNote sharing is a really bad idea.

Step 1: I create a OneNote notebook and share it with ******@outlook.com - I set it to allow editing and require to sign in with a MS account

******@outlook.com gets my email with the link, and for whatever reason he purposely or accidentally shares the link with other people.

Step 2: anyone - I repeat ANYONE - with a Microsoft account that has that link to my OneNote notebook can see, edit, delete and do whatever they want with it.

I find that extremely insecure.

If I share it with ******@outlook.com, I would expect that only people that sign in as ******@outlook.com would have access to the notebook. This is not the case. Anybody with a MS account and the link can do whatever they want.

This works e.g. with Google drive shared files completely different. If I share a document on Google drive with ******@gmail.com, only someone who knows the link and logs in as ******@gmail.com can see and access the shared file. That is security.

Am I missing something or is this another occasion where MS simply does not "get" security?

Answer 1

Yes, it appears as if it was designed to allow anyOne to use a share link just Once. I imagine it's useful if your email account isn't your preferred notebook account...  Not saying there aren't flaws and it would be good to get verification, I for one will definitely only be sharing read only links in future until I can verify who activated the share.  And I thank you for bringing it up.

Answer 2

You think they designed it to be on purpose insecure where anybody with a MS account can access your OneNote notebooks?

Answer 3

Replicated this.

Found that the provided link only allows one person to log in.  So agree that it's a flaw but wonder if it's by design.