3 ms·

It's not only Windows 10 app store support that's like that. Every Microsoft product support shares the same constraints and lack of solutions/answers. After m

It's not only Windows 10 app store support that's like that. Every Microsoft product support shares the same constraints and lack of solutions/answers. After moving abroad I was unable to access my Microsoft account(locked), for more than a month, just because I couldn't provide them with the last IP address I had used to access my account, along with last 5 received email subjects, 5 contacts in my contact list among many other unreasonable questions the common user doesn't even know how to answer. All this because I didn't own my recovery email address any longer.

msravi 11y ago
Wait... they can read your email to verify who you say you are? Really? When did that happen?
- vmateixeira 11y ago
  Because of being unable to check my recovery email address, this is the email I got on a 3rd email account. http://postimg.org/image/oxinp1yot/ http://postimg.org/image/oxinp1yot/
- vmateixeira 11y ago
  Yes, they can. They can access your contact list, your folders and your emails. They did this on my locked account.
- userbinator 11y ago
  Why are you surprised? Microsoft owns the servers. Email is by default not a secure form of communication. Assume everything you send that isn't encrypted by you to be in plaintext and readable by all the systems it passes through and is stored in.
  - Piskvorrr 11y ago
    That's the issue, right there. MS owns the servers - and extrapolates that it also owns whatever is on them, because "obviously you should have known better than use our servers." Even though this is probably legal, the "w3 0wnz0rz y00" mindset is the toxic ingredient here.
- acdha 11y ago
  This is roughly the same process Google uses, too. Hopefully they avoided the couple of years where Google forgot to have that form submit to a working email address: https://www.google.com/search?q=higgins-prod-lost-hard-landing@google.com+bounces+site:productforums.google.com https://www.google.com/search?q=higgins-prod-lost-hard-landi... While we're on the topic, now is a great time to print some backup codes and lock them in your safe. Sometimes it is easier to wait until you return home to recover from a lost / wiped smartphone.
static_noise 11y ago
To be fair, it's much worse to have your account hijacked than it being inaccessible for some time.
- vmateixeira 11y ago
  Not having a process in place for such situations is what doesn't make sense to me. We're talking about a big corporation. Funny thing about it is that their support is so badly designed (to cut costs I suppose) that over the phone line there's not an option to talk with an operator regarding a Microsoft account. All you get is a "check microsoft online support for help on your account being locked"... which, guess what... requires authentication[1]! [1]https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1453290782&rver=6.5.6509.0&wp=LBI&wreply=https:%2F%2Fsupport.microsoft.com%2Fen-gb%2Fgetsupport%3Foaspworkflow%3Dstart_1.0.0.0%26wfname%3Dcapsub%26productkey%3Dwolnewmail%26locale%3Den-gb%26selectedproduct%3DOutlook%26selectedissue%3DYour%2Baccount%2Bhas%2Bbeen%2Btemporarily%2Bblocked%26Service%253a%3DGeneral%2BIssue%26ccsid%3D635888875690235695&lc=1033&id=288908 https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1...
- stromgo 11y ago
  You have to consider the prior probability of having your account hijacked. In my case it is very low because I'm careful, but unfortunately authentication systems are one-size-fits-all and are designed for the average careless user. All I get from these systems is weakened security, disruption, and no benefits. I wish I could tell an authentication system that I will not forget my password and to not set up a recovery path using my mother's maiden name. I wish I could tell it that I'm willing to accept the risk of a hijack and to never unexpectedly lock my account because some machine learning algorithm thinks that my activity is suspicious. If anyone here works on an authentication system, then please add these settings.
kuschku 11y ago
BTW, if you wait for a month, you can reset the password without any knowledge of the account, and without the recovery email. You can just request a reset mail to another address, wait 30 days, and it will arrive.
- vmateixeira 11y ago
  In my case they locked my account because I changed country and tried to access it from a different place. The password reset mechanism didn't help. Actually, after getting my account unlocked, I was forced to change password and my new password became temporary for 30 days (couldn't change it again).

msravi 11y ago

Wait... they can read your email to verify who you say you are? Really? When did that happen?

vmateixeira 11y ago
Because of being unable to check my recovery email address, this is the email I got on a 3rd email account. http://postimg.org/image/oxinp1yot/ http://postimg.org/image/oxinp1yot/
vmateixeira 11y ago
Yes, they can. They can access your contact list, your folders and your emails. They did this on my locked account.
userbinator 11y ago
Why are you surprised? Microsoft owns the servers. Email is by default not a secure form of communication. Assume everything you send that isn't encrypted by you to be in plaintext and readable by all the systems it passes through and is stored in.
- Piskvorrr 11y ago
  That's the issue, right there. MS owns the servers - and extrapolates that it also owns whatever is on them, because "obviously you should have known better than use our servers." Even though this is probably legal, the "w3 0wnz0rz y00" mindset is the toxic ingredient here.
acdha 11y ago
This is roughly the same process Google uses, too. Hopefully they avoided the couple of years where Google forgot to have that form submit to a working email address: https://www.google.com/search?q=higgins-prod-lost-hard-landing@google.com+bounces+site:productforums.google.com https://www.google.com/search?q=higgins-prod-lost-hard-landi... While we're on the topic, now is a great time to print some backup codes and lock them in your safe. Sometimes it is easier to wait until you return home to recover from a lost / wiped smartphone.

static_noise 11y ago

To be fair, it's much worse to have your account hijacked than it being inaccessible for some time.

vmateixeira 11y ago
Not having a process in place for such situations is what doesn't make sense to me. We're talking about a big corporation. Funny thing about it is that their support is so badly designed (to cut costs I suppose) that over the phone line there's not an option to talk with an operator regarding a Microsoft account. All you get is a "check microsoft online support for help on your account being locked"... which, guess what... requires authentication[1]! [1]https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1453290782&rver=6.5.6509.0&wp=LBI&wreply=https:%2F%2Fsupport.microsoft.com%2Fen-gb%2Fgetsupport%3Foaspworkflow%3Dstart_1.0.0.0%26wfname%3Dcapsub%26productkey%3Dwolnewmail%26locale%3Den-gb%26selectedproduct%3DOutlook%26selectedissue%3DYour%2Baccount%2Bhas%2Bbeen%2Btemporarily%2Bblocked%26Service%253a%3DGeneral%2BIssue%26ccsid%3D635888875690235695&lc=1033&id=288908 https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1...
stromgo 11y ago
You have to consider the prior probability of having your account hijacked. In my case it is very low because I'm careful, but unfortunately authentication systems are one-size-fits-all and are designed for the average careless user. All I get from these systems is weakened security, disruption, and no benefits. I wish I could tell an authentication system that I will not forget my password and to not set up a recovery path using my mother's maiden name. I wish I could tell it that I'm willing to accept the risk of a hijack and to never unexpectedly lock my account because some machine learning algorithm thinks that my activity is suspicious. If anyone here works on an authentication system, then please add these settings.

kuschku 11y ago

BTW, if you wait for a month, you can reset the password without any knowledge of the account, and without the recovery email. You can just request a reset mail to another address, wait 30 days, and it will arrive.

vmateixeira 11y ago
In my case they locked my account because I changed country and tried to access it from a different place. The password reset mechanism didn't help. Actually, after getting my account unlocked, I was forced to change password and my new password became temporary for 30 days (couldn't change it again).