3 ms·

Can someone explain to me why Microsoft migrating my Minecraft account to my Microsoft account is not a huge security anti-pattern, given that this is the same

by jl6 5y ago

Can someone explain to me why Microsoft migrating my Minecraft account to my Microsoft account is not a huge security anti-pattern, given that this is the same account I use to access my high-importance Azure account? Do we really believe that the Minecraft launcher presents no additional attack surface and handles authentication material with the same rigor as the Azure login process?

madeofpalk 5y ago
I don't know about the specifics of Minecraft launcher, but usually these types of unified login schemes are all based on OAuth. The Minecraft launcher never/shouldn't get your actual login, and instead they get a scope-restricted oauth access/refresh token. So everyone is actually authenticating through the same secure interface, and even if one application's credentials get leaked, all they would give access to would be your Minecraft profile, and nothing else. Hopefully. Separately though, I think it's a good idea to have different Apple/Microsoft/Google/whatever accounts for different purposes. I'm not sure if it makes a whole load of sense to have your (business?) high importance Azure account on the same Microsoft account as your Xbox/Minecraft profile.
- tehbeard 5y ago
  Do not make a second Microsoft account, it'll just end in frustration. Story: I have two Minecraft accounts (I used to do plugin work and it made testing easier to have an alt.). I migrated my main one to my MS account (one that's been in use with xbox and O365 for a decade+ at this point), no problem. I migrated the second one to a new account a few weeks back after they pushed that it'll be mandatory after 10th March; usied a gmail address for the new MS account because I'm done dealing with outlook. It all worked, for a week.... I'm now locked out of that second account, with them demanding a mobile number to "verify" it's me... I haven't had the energy to go yell at them yet. It's the same bullshit I hear happens with twitter accounts where they also demand a mobile number. The truth is I think my "primary" account has my mobile number already attached... and I'm scared that I'll lose access to that as well if I try to use it to unstick my second account, getting "auto-banned" in much the same way they described my second account (which ONLY ever got used to login to Minecraft) for suspicious automatically detected activity and violation of TOS.
  - Tijdreiziger 5y ago
    Perhaps you can just solve this by getting a cheap prepaid SIM? Although that opens up a potential attack vector if the number expires after a while and gets recycled… and having to spend money to fix a problem MS created is stupid.
- nicce 5y ago
  > I don't know about the specifics of Minecraft launcher, but usually these types of unified login schemes are all based on OAuth. The Minecraft launcher never/shouldn't get your actual login, and instead they get a scope-restricted oauth access/refresh token. Benefits really depend on your threat model. Login process uses same credentials which can access everything. But afterwards, the credentials stored in Minecraft has limited access, if third party has a way to steal them.
amanzi 5y ago
To be fair, I've found that Microsoft have the best security for their accounts - much better than Apple ID or Google Accounts. Excellent 2FA support and if you have it set up with the Authenticator app, you will almost never need to type in your Microsoft account password. Unlike Apple or Google where I find that I often need to type in those passwords which forces me to pick easier passwords.
judge2020 5y ago
If you can spare the expense ($5/mo/user and a domain) you really should be putting Azure resources in a Microsoft 365 tenant instead of using MSA/live.com accounts. Microsoft will act as a 'processor' instead of a 'controller' of your data in this configuration.

by jl6 5y ago

madeofpalk 5y ago

I don't know about the specifics of Minecraft launcher, but usually these types of unified login schemes are all based on OAuth. The Minecraft launcher never/shouldn't get your actual login, and instead they get a scope-restricted oauth access/refresh token. So everyone is actually authenticating through the same secure interface, and even if one application's credentials get leaked, all they would give access to would be your Minecraft profile, and nothing else. Hopefully. Separately though, I think it's a good idea to have different Apple/Microsoft/Google/whatever accounts for different purposes. I'm not sure if it makes a whole load of sense to have your (business?) high importance Azure account on the same Microsoft account as your Xbox/Minecraft profile.

tehbeard 5y ago
Do not make a second Microsoft account, it'll just end in frustration. Story: I have two Minecraft accounts (I used to do plugin work and it made testing easier to have an alt.). I migrated my main one to my MS account (one that's been in use with xbox and O365 for a decade+ at this point), no problem. I migrated the second one to a new account a few weeks back after they pushed that it'll be mandatory after 10th March; usied a gmail address for the new MS account because I'm done dealing with outlook. It all worked, for a week.... I'm now locked out of that second account, with them demanding a mobile number to "verify" it's me... I haven't had the energy to go yell at them yet. It's the same bullshit I hear happens with twitter accounts where they also demand a mobile number. The truth is I think my "primary" account has my mobile number already attached... and I'm scared that I'll lose access to that as well if I try to use it to unstick my second account, getting "auto-banned" in much the same way they described my second account (which ONLY ever got used to login to Minecraft) for suspicious automatically detected activity and violation of TOS.
- Tijdreiziger 5y ago
  Perhaps you can just solve this by getting a cheap prepaid SIM? Although that opens up a potential attack vector if the number expires after a while and gets recycled… and having to spend money to fix a problem MS created is stupid.
nicce 5y ago
> I don't know about the specifics of Minecraft launcher, but usually these types of unified login schemes are all based on OAuth. The Minecraft launcher never/shouldn't get your actual login, and instead they get a scope-restricted oauth access/refresh token. Benefits really depend on your threat model. Login process uses same credentials which can access everything. But afterwards, the credentials stored in Minecraft has limited access, if third party has a way to steal them.

amanzi 5y ago

To be fair, I've found that Microsoft have the best security for their accounts - much better than Apple ID or Google Accounts. Excellent 2FA support and if you have it set up with the Authenticator app, you will almost never need to type in your Microsoft account password. Unlike Apple or Google where I find that I often need to type in those passwords which forces me to pick easier passwords.

judge2020 5y ago

If you can spare the expense ($5/mo/user and a domain) you really should be putting Azure resources in a Microsoft 365 tenant instead of using MSA/live.com accounts. Microsoft will act as a 'processor' instead of a 'controller' of your data in this configuration.