You down with OTP? You know me (how to fail at encryption by M$)

In their relentless pursuit of the Holy Fail, Microsoft has managed to screw up one of the best message encryption techniques; the One-Time Pad (OTP). The way OTP traditionally works is you give the user either the encrypted message itself or some manner of access token where the key is a one-time, single use, preferably randomly-generated item. Your implementation may vary, but that's a very ground-level explanation.

This all works very well together because the recipient gets an encrypted message in his inbox, and the key to unlock it via some other channel. VIA SOME OTHER CHANNEL!!! Those are the key words in this whole scheme. Microsoft has forgotten this seemingly important part of the idea. You be the judge. I will give you the link. You read around the marketing and cyber-dust to get to the meat of the concept they outline here: https://technet.microsoft.com/en-us/library/Dn569285.aspx and their OTP idea here: https://technet.microsoft.com/en-us/library/use-a-one-time-passcode-to-view-an-encrypted-message.aspx

Did you spot the problem? Good, I knew you could do it. In case it is not obvious, Microsoft is sending the message AND the key through the same channel with a few layers of indirection. Admittedly it took a trip to Scriptjunkie town (@scriptjunkie1) for me to really dig into what they were actually trying to do. At first, it sounded pretty good. Then Scriptjunkie asked "So, what attack vector is taken out of the picture by using this?" The answer was, of course, none.

If the message with the super-special-encrypted link goes across the non-enciphered transom, they only need to grab the link to get their OTP and finally their message. I'm sure there's some fancy client-side tricks they employ to try to make sure you are who you say you are, but how well has that ever worked? If the connection the email passed over was encrypted all the way (meaning in-transit, and at rest at all links), you wouldn't need the OTP in the first place.

With just a touch of the Kafkaesque, the name of the offering is Azure Rights Management Service. The literature is not very forthcoming with how they do key management, they just say they do the key management FOR you. Considering the cozy relationship between US companies, the cloud, and certain three-letter agencies, I don't know how much I would put stock in something that is not end-to-end. I'm sure this pricey add-on will check a few boxes on the CISO checklist, though...maybe that's all anyone really wants. Sigh.

TLDR;
Azure Rights Management IRL: I walk up to you and give you a bag containing a lockbox, then tell you the key is taped to the bottom.

Thanks to Scriptjunkie for the sanity check at the beginning.