5 ms·

...and from what I can tell, their online account security is craptastic. Here’s a true story that happened to my family. My son is the only person in the hous

...and from what I can tell, their online account security is craptastic. Here’s a true story that happened to my family. My son is the only person in the house who uses Windows. For his game machine. He set up a Microsoft online account. It got hacked - someone set up a fake family and managed to get my son’s account listed under it as a child. As a consequence, he couldn’t install any new software. I’m not sure what the point of this particular hack is, but that was the result. So we called Microsoft customer service. It turns out that there is no way to get an account removed from a family once it’s listed there. The Windows rep we talked to had a recourse, though. He proposed that we, the three of us, attempt to reverse-hack the fake “dad”’s account over the phone by trying to guess his password. I had to explain to the gentleman that, even though we were within our moral rights to do this, a) it was almost certainly illegal, and b) doomed to failure. He didn’t understand the issue. Eventually we had to agree to disagree, and hang up on him. We never got my son’s account back. We wiped his computer and installed Windows via “use offline account”. I’m glad this was last year and not today, I guess?

EugeneOZ 7y ago
Astonishing story, thanks for sharing. It actually says a lot about their level of customers support and care.
thrower123 7y ago
I'm almost certain that you were not talking to a real Microsoft employee. Most Fortune 500s have their helpdesks and customer service outsourced to the Tatas and Wipros, Cognizants and HCLs of the world, who may or may not further subcontract the actual bodies filling the roles. Quite frankly, first-level support is useless and ignorant; at best they have scripts for common issues, but to do anything you need to defeat their efforts to no-op and close the ticket, and instead get escalated to a real person with some agency and authority.
- withaplomb 7y ago
  Even people who are bad at their jobs are real people. We can’t assume that everyone of low intelligence or motivation is sub human. Just say agency and authority, that made your point.
  - thrower123 7y ago
    In the context of their jobs, they are a meat-based chatbot. This is no reflection on them personally, this is by design of their job role. They have metrics hanging over them to close calls as quickly as possible, without escalating. They are expected to handle dozens or hundreds of calls a day. There is no slack to actually try to resolve the user's problems in any way that requires more creativity than sticking to the SOP script, and moreover, they are usually mandated to stick to a very standardized procedure, with defined suggestions and language that they have to use, in a specific order. A good first-level support person would spoon-feed you the right incantations to get escalated, in a way that their cutthroat metrics aren't negatively impacted. It's a fucked up system, but this is how call-centers work.
- yjftsjthsd-h 7y ago
  If you contact a company through their official channels and they connect to a third party, they get to keep the blame.
- minedwiz 7y ago
  Forget customer service, not even Microsoft's internal IT helpdesk is staffed by FTEs.
tzs 7y ago
> ...and from what I can tell, their online account security is craptastic. I'm not convinced that their offline security is good, either. I sometimes will pick up my Surface Pro 4 and disconnect it from the charger. Disconnecting from the charger usually (but not always...not sure what determines it) wakes it. It then turns on their equivalent of Apple's Face ID, and tries to log in. Sometimes I don't actually want that yet, as I just picked it up to take it somewhere else. So I'll hit the power button to put it back to sleep. The screen blanks...and then sometimes it quickly comes back, logged in. The thing is I've sometimes had it do this when I've been careful to have my face out of view, holding it so I can only barely see the screen around the edge to see if disconnecting power will wake it up and I'll need to hit power to put it back to sleep. This doesn't happen all the time, but it has happened several times, leading me to wonder if there is some sort of glitch if you interrupt a face-based login attempt at just the right time via the power button causing it to think it logged in. Anyone else seen this?
- sarcasmOrTears 7y ago
  That's why I gave it back after a week. That and updates.
- orev 7y ago
  Face logon takes some seconds to initialize, and if you interrupt it it gets confused. But the solution to your issue is to have the type cover closed when you unplug it.
  - Normal_gaussian 7y ago
    That is hardly a solution to a security issue. I can't ensure the burglar keeps the cover closed
    - richardwhiuk 7y ago
      The burglar won't have your face?
      - 7y ago
ddingus 7y ago
It is a griefers hack. Your son gets denied and basically has to do work, or make a new account.
- WorldMaker 7y ago
  It's also a "griefer's first social engineering" hack, so it has at least some small "fun" difficulty connected to it. To add a child account when you aren't directly creating the child account on the same device, Microsoft requires an Invite flow that sends an email to the child account asking them to accept "joining the family". So either the griefer also had the password to the account to login to the account on their machine (or otherwise access emails to it) or they somehow social engineered the victim to accepting an invitation to "join them" for something. The griefer can blame the victim for being gullible and claim that it wasn't the griefer's fault the victim fell for it.
deleted 7y ago
[deleted]
oefrha 7y ago
Yep, and last I checked (earlier this year I believe), there’s still a 14-character length limit on the MS account password. My bank’s better than that for crying out loud. Forget diceware or any other sane scheme, say hello to random hard-to-type punctuation characters. And now you’re forced to use that as your computer password too, which you probably have to type multiple times a day. (Okay, thankfully local account is still possible.)
- Santosh83 7y ago
  This isn't the case with me. My MS a/c (which is also my Windows login a/c) has a 44 character password.
- a254613e 7y ago
  Are you talking about online microsoft account or something windows specific? Because that's not true, my password has been 40+ characters for a long time and I change it pretty often. For local login you can use a PIN, or set up windows hello, if you don't want to type in the long password every time.
  - oefrha 7y ago
    > Are you talking about online microsoft account or something windows specific? I'm talking about the Microsoft online account, and I stand by my statement that I was limited to 14 characters until relatively recently (maybe not earlier-this-year recent, that part I'm not sure). Looking at my Microsoft password history, I've changed it five times since 2012 (when I started using a password manager), each one is 14 characters long; the last change was done in 2016. I've been using 32+ character passwords wherever possible since 2012, so the only reason I was using 14 characters for Microsoft was because of the artificial limit imposed on me. And I did check a few times after 2016 to confirm the limit. Anyway, I just tried to change the password again and this time I was warned that my Microsoft and Skype accounts would be merged if I carried through with the password change, so something did change after I last checked. > For local login you can use a PIN, or set up windows hello, if you don't want to type in the long password every time. I'm aware, but I don't consider a PIN secure, and I don't think Windows Hello is an option for most desktop workstations.
jevgeni 7y ago
Today you still can use and create an offline account. If you’re offline. People here don’t read the original thread.
- jdnenej 7y ago
  It's a really nasty dark pattern. Most users won't realise they have to disconnect from the internet to sign up and will fall for Microsoft's trap.
pndy 7y ago
> ...and from what I can tell, their online account security is craptastic. There's something weird and shady going on: I did created MS account to get this "marvelous" free Windows 10 offer once the update was smuggled on my Windows 7 installation and in subsequent buggy releases I had to reinstall the OS from scratch. So I had to login to activate this thing but I choose to not use the account later switching to local one (I did created an offline one during OOBE) and yet, Windows is still holding credentials to the online account somewhere because Activity section of the MSA Privacy page is still registering OneDrive activity coming from my desktop. I am not logged anywhere in OS, credentials manager is cleared out, OneDrive application is removed but still, it happens.
CRConrad 7y ago
Several people here have talked about “hacks” like what happened to ypur son, and I'm of course not saying they're wrong. I don't quite get the idea what it's supposed to get such hackers, though, so I think you shouldn't rule out sheer incompetence: Maybe someone else has a family member with the same or a similar name and was trying to add rhem, and a search threw up your son's name and they added him by mistake? Shouldn't be able to happen, of course, but given it's Microsoft we're talking about, who would swear it couldn't?
- GVIrish 7y ago
  As a sibling comment said, some people are griefers who only seek to inconvenience or otherwise harass others. Particularly with online games.
  - bigwavedave 7y ago
    Especially as a form of revenge. Yeah, it's petty, but it's been my experience that "petty" (and so many other gamers are going to down vote this) describes 90% of gaming cultures.
- GlenTheMachine 7y ago
  IIRC this particular family had several thousand children. I don’t think it was a mistake.
archi42 7y ago
It seems to me MS customer support is incapable of doing anything meaningful with your account, except making it easier to be hacked via social engineering. My MS account had my desktop's Win 10 Pro N (the one with less crap) license attached to it. When I bought a new laptop with Win 10 Pro (regular, non-N), my desktop would suddenly claim that its license was invalid. Great. Called support, but nothing they could do except recommending to reinstall Windows. No guarantee the other system would then not go into that "your license is invalid state" if I use the N license again. Solution: Screw them, I'll install kmspico. I'm probably lucky I use that sh*tshow of an OS only for gaming, and Linux for everything else (including work - we're essentially a Linux company even though most of our customers (embedded devs) still use windows.
- gruez 7y ago
  >My MS account had my desktop's Win 10 Pro N (the one with less crap) Not sure what you mean by "less crap". The only advantage of the N versions is that it doesn't have Windows Media Player. You need enterprise to set telemetry level to lowest, and enterprise LTSC to not have Windows store (and a bunch of other UWP apps) installed by default.
robin_reala 7y ago
The family accounts are crazy anyway. I once worked for an agency that had just bought its first Windows Phone for testing. Setting it up I dutifully signed in with the company’s MS account, but found that I couldn’t install any apps and there were loads of restrictions. It took me multiple hours of debugging to realise that because someone at the past had entered the company’s formation date in the birthdate of the MS account Windows Phone thought I was a child and blocked me from doing a load of the things I needed to do.
- rovr138 7y ago
  That sounds okay for a child though.
samstave 7y ago
Thanks for that lovely story. It made me laugh at how badly MS is navigating whatever the fuck it is they envision this path they are going down/paving. However, it did give me a Business Idea; (this is for some hungry 20somethings out there): Sell a machine image which is basically a windows VM on top of Linux with support, which can handle and navigate all this bullshit that MS is throwing at common users, instead of trying to force the population to become sysads themselves.

EugeneOZ 7y ago

Astonishing story, thanks for sharing. It actually says a lot about their level of customers support and care.

thrower123 7y ago

I'm almost certain that you were not talking to a real Microsoft employee. Most Fortune 500s have their helpdesks and customer service outsourced to the Tatas and Wipros, Cognizants and HCLs of the world, who may or may not further subcontract the actual bodies filling the roles. Quite frankly, first-level support is useless and ignorant; at best they have scripts for common issues, but to do anything you need to defeat their efforts to no-op and close the ticket, and instead get escalated to a real person with some agency and authority.

withaplomb 7y ago
Even people who are bad at their jobs are real people. We can’t assume that everyone of low intelligence or motivation is sub human. Just say agency and authority, that made your point.
- thrower123 7y ago
  In the context of their jobs, they are a meat-based chatbot. This is no reflection on them personally, this is by design of their job role. They have metrics hanging over them to close calls as quickly as possible, without escalating. They are expected to handle dozens or hundreds of calls a day. There is no slack to actually try to resolve the user's problems in any way that requires more creativity than sticking to the SOP script, and moreover, they are usually mandated to stick to a very standardized procedure, with defined suggestions and language that they have to use, in a specific order. A good first-level support person would spoon-feed you the right incantations to get escalated, in a way that their cutthroat metrics aren't negatively impacted. It's a fucked up system, but this is how call-centers work.
yjftsjthsd-h 7y ago
If you contact a company through their official channels and they connect to a third party, they get to keep the blame.
minedwiz 7y ago
Forget customer service, not even Microsoft's internal IT helpdesk is staffed by FTEs.

tzs 7y ago

> ...and from what I can tell, their online account security is craptastic. I'm not convinced that their offline security is good, either. I sometimes will pick up my Surface Pro 4 and disconnect it from the charger. Disconnecting from the charger usually (but not always...not sure what determines it) wakes it. It then turns on their equivalent of Apple's Face ID, and tries to log in. Sometimes I don't actually want that yet, as I just picked it up to take it somewhere else. So I'll hit the power button to put it back to sleep. The screen blanks...and then sometimes it quickly comes back, logged in. The thing is I've sometimes had it do this when I've been careful to have my face out of view, holding it so I can only barely see the screen around the edge to see if disconnecting power will wake it up and I'll need to hit power to put it back to sleep. This doesn't happen all the time, but it has happened several times, leading me to wonder if there is some sort of glitch if you interrupt a face-based login attempt at just the right time via the power button causing it to think it logged in. Anyone else seen this?

sarcasmOrTears 7y ago
That's why I gave it back after a week. That and updates.
orev 7y ago
Face logon takes some seconds to initialize, and if you interrupt it it gets confused. But the solution to your issue is to have the type cover closed when you unplug it.
- Normal_gaussian 7y ago
  That is hardly a solution to a security issue. I can't ensure the burglar keeps the cover closed
  - richardwhiuk 7y ago
    The burglar won't have your face?
    - 7y ago

ddingus 7y ago

It is a griefers hack. Your son gets denied and basically has to do work, or make a new account.

WorldMaker 7y ago
It's also a "griefer's first social engineering" hack, so it has at least some small "fun" difficulty connected to it. To add a child account when you aren't directly creating the child account on the same device, Microsoft requires an Invite flow that sends an email to the child account asking them to accept "joining the family". So either the griefer also had the password to the account to login to the account on their machine (or otherwise access emails to it) or they somehow social engineered the victim to accepting an invitation to "join them" for something. The griefer can blame the victim for being gullible and claim that it wasn't the griefer's fault the victim fell for it.

deleted 7y ago

[deleted]

oefrha 7y ago

Yep, and last I checked (earlier this year I believe), there’s still a 14-character length limit on the MS account password. My bank’s better than that for crying out loud. Forget diceware or any other sane scheme, say hello to random hard-to-type punctuation characters. And now you’re forced to use that as your computer password too, which you probably have to type multiple times a day. (Okay, thankfully local account is still possible.)

Santosh83 7y ago
This isn't the case with me. My MS a/c (which is also my Windows login a/c) has a 44 character password.
a254613e 7y ago
Are you talking about online microsoft account or something windows specific? Because that's not true, my password has been 40+ characters for a long time and I change it pretty often. For local login you can use a PIN, or set up windows hello, if you don't want to type in the long password every time.
- oefrha 7y ago
  > Are you talking about online microsoft account or something windows specific? I'm talking about the Microsoft online account, and I stand by my statement that I was limited to 14 characters until relatively recently (maybe not earlier-this-year recent, that part I'm not sure). Looking at my Microsoft password history, I've changed it five times since 2012 (when I started using a password manager), each one is 14 characters long; the last change was done in 2016. I've been using 32+ character passwords wherever possible since 2012, so the only reason I was using 14 characters for Microsoft was because of the artificial limit imposed on me. And I did check a few times after 2016 to confirm the limit. Anyway, I just tried to change the password again and this time I was warned that my Microsoft and Skype accounts would be merged if I carried through with the password change, so something did change after I last checked. > For local login you can use a PIN, or set up windows hello, if you don't want to type in the long password every time. I'm aware, but I don't consider a PIN secure, and I don't think Windows Hello is an option for most desktop workstations.

jevgeni 7y ago

Today you still can use and create an offline account. If you’re offline. People here don’t read the original thread.

jdnenej 7y ago
It's a really nasty dark pattern. Most users won't realise they have to disconnect from the internet to sign up and will fall for Microsoft's trap.

pndy 7y ago

> ...and from what I can tell, their online account security is craptastic. There's something weird and shady going on: I did created MS account to get this "marvelous" free Windows 10 offer once the update was smuggled on my Windows 7 installation and in subsequent buggy releases I had to reinstall the OS from scratch. So I had to login to activate this thing but I choose to not use the account later switching to local one (I did created an offline one during OOBE) and yet, Windows is still holding credentials to the online account somewhere because Activity section of the MSA Privacy page is still registering OneDrive activity coming from my desktop. I am not logged anywhere in OS, credentials manager is cleared out, OneDrive application is removed but still, it happens.

CRConrad 7y ago

Several people here have talked about “hacks” like what happened to ypur son, and I'm of course not saying they're wrong. I don't quite get the idea what it's supposed to get such hackers, though, so I think you shouldn't rule out sheer incompetence: Maybe someone else has a family member with the same or a similar name and was trying to add rhem, and a search threw up your son's name and they added him by mistake? Shouldn't be able to happen, of course, but given it's Microsoft we're talking about, who would swear it couldn't?

GVIrish 7y ago
As a sibling comment said, some people are griefers who only seek to inconvenience or otherwise harass others. Particularly with online games.
- bigwavedave 7y ago
  Especially as a form of revenge. Yeah, it's petty, but it's been my experience that "petty" (and so many other gamers are going to down vote this) describes 90% of gaming cultures.
GlenTheMachine 7y ago
IIRC this particular family had several thousand children. I don’t think it was a mistake.

archi42 7y ago

It seems to me MS customer support is incapable of doing anything meaningful with your account, except making it easier to be hacked via social engineering. My MS account had my desktop's Win 10 Pro N (the one with less crap) license attached to it. When I bought a new laptop with Win 10 Pro (regular, non-N), my desktop would suddenly claim that its license was invalid. Great. Called support, but nothing they could do except recommending to reinstall Windows. No guarantee the other system would then not go into that "your license is invalid state" if I use the N license again. Solution: Screw them, I'll install kmspico. I'm probably lucky I use that sh*tshow of an OS only for gaming, and Linux for everything else (including work - we're essentially a Linux company even though most of our customers (embedded devs) still use windows.

gruez 7y ago
>My MS account had my desktop's Win 10 Pro N (the one with less crap) Not sure what you mean by "less crap". The only advantage of the N versions is that it doesn't have Windows Media Player. You need enterprise to set telemetry level to lowest, and enterprise LTSC to not have Windows store (and a bunch of other UWP apps) installed by default.

robin_reala 7y ago

The family accounts are crazy anyway. I once worked for an agency that had just bought its first Windows Phone for testing. Setting it up I dutifully signed in with the company’s MS account, but found that I couldn’t install any apps and there were loads of restrictions. It took me multiple hours of debugging to realise that because someone at the past had entered the company’s formation date in the birthdate of the MS account Windows Phone thought I was a child and blocked me from doing a load of the things I needed to do.

rovr138 7y ago
That sounds okay for a child though.

samstave 7y ago

Thanks for that lovely story. It made me laugh at how badly MS is navigating whatever the fuck it is they envision this path they are going down/paving. However, it did give me a Business Idea; (this is for some hungry 20somethings out there): Sell a machine image which is basically a windows VM on top of Linux with support, which can handle and navigate all this bullshit that MS is throwing at common users, instead of trying to force the population to become sysads themselves.