> It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). I think you're over focused

> It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user re-type it, the attacker has now discovered the TFA email address and will try the same hacked password against that (usually Gmail) account. If Microsoft displays nothing, users with multiple emails get confused about which inbox to check. Displaying a starred out email address and asking for a re-type solves both problems. It also prevents Microsoft from having a huge SMS bill each time a big company gets hacked and the hackers try all the passwords. The solution for Xbox is really for Xbox to use a flow designed for low input devices, like the OAuth device flow which allows you to do all the typing on your computer of cell phone, not the Xbox controller.