4 ms·

This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction. After entering my password, the ap

This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction. After entering my password, the app usually takes me to a second page where I am required to type out my email address. I'd much rather prefer that I get an email immediately, because the way things currently are, I won't be notified of any attempts that breach my password but not my 2FA. It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). If I pick the text message option, then (after confirming my number the same way as above) I get a 7-digit code. For some odd reason, I find it much more difficult to remember a 7-digit code than a 6-digit one, which seems to be standard for most other companies. I don't see any extra security benefit in a longer 2FA code, but maybe there's a valid reason for this one. The issues above are mildly annoying on a PC. In an Xbox, however, with the onscreen keyboard, it honestly makes me want to throw my console out the window.

will4274 7y ago
> It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user re-type it, the attacker has now discovered the TFA email address and will try the same hacked password against that (usually Gmail) account. If Microsoft displays nothing, users with multiple emails get confused about which inbox to check. Displaying a starred out email address and asking for a re-type solves both problems. It also prevents Microsoft from having a huge SMS bill each time a big company gets hacked and the hackers try all the passwords. The solution for Xbox is really for Xbox to use a flow designed for low input devices, like the OAuth device flow which allows you to do all the typing on your computer of cell phone, not the Xbox controller.
- oceliker 7y ago
  > Displaying a starred out email address and asking for a re-type solves both problems. Sure, but why not simply show the starred out email without asking for the re-type? I agree with the Xbox idea, that would perfectly solve the problem.

will4274 7y ago

> It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user re-type it, the attacker has now discovered the TFA email address and will try the same hacked password against that (usually Gmail) account. If Microsoft displays nothing, users with multiple emails get confused about which inbox to check. Displaying a starred out email address and asking for a re-type solves both problems. It also prevents Microsoft from having a huge SMS bill each time a big company gets hacked and the hackers try all the passwords. The solution for Xbox is really for Xbox to use a flow designed for low input devices, like the OAuth device flow which allows you to do all the typing on your computer of cell phone, not the Xbox controller.

oceliker 7y ago
> Displaying a starred out email address and asking for a re-type solves both problems. Sure, but why not simply show the starred out email without asking for the re-type? I agree with the Xbox idea, that would perfectly solve the problem.