If you think using secure HTTP would be enough to protect your privacy when checking webmail, think again. When users connect to their Microsoft user account page, Outlook.com, or OneDrive.com even when using HTTPS, the connection leaks a unique identifier that can be used to retrieve their name and profile photo in plaintext.

A unique identifier called a CID is exposed because it's sent as part of a Domain Name Service lookup for the address of the storage server containing profile data and as part of the initiation of an encrypted connection. As a result, it could be used to track users when they connect to services from both computers and mobile devices, possibly even identifying users as their requests leave the Tor anonymizing network.

In a lab test, Ars confirmed the leak, first publicized this weekend by a blogger based in Beijing. Packet captures of connections to Outlook.com, the Windows account page, and OneDrive.com revealed DNS lookup requests for a host with the format cid-[user's CID here].users.storage.live.com. The CID is also embedded in the Server Name Indication (SNI) extension data exchanged during the Transport Layer Security "handshake" that secures the session to the services, as Ars confirmed in an inspection of the packets.

The CID can be used to retrieve the user's profile image, and it can also be used via the OneDrive site to retrieve a user's account display name. By accessing metadata from Microsoft's Live service with the CID, someone could also retrieve information about when the account was last accessed and when it was created. The same metadata can expose information associated with the Live Calendar application, including user location. But it can also be used as a unique tracker for individuals—a "strong identifier" in National Security Agency parlance—to spot their network traffic as it flows across the Internet. This data can then be used to correlate someone's identity with other traffic from the same IP address. While using an anonymizing network such as Tor would conceal the origin point of the traffic, CID data would be exposed once traffic left a Tor exit node.

Ars reached out to Microsoft for comment on the leaked data. A Microsoft spokesperson said that the company is aware of the issue, and that the APIs that cause the leakage are being phased out.